Did I just stumble on a hidden gem?

[-Akos-]

Hi all,

A while back I asked a question on antimalware monitoring, and @Noa Kuperberg pointed me to the Antimalware assessment. However, last week I noticed Azure Security Center has the same features as the Antimalware assessment, and it even shows that in the pricing and settings:

I see that even the free ASC tier has the ProtectionStatus table in the Log Analytics workspace, so I am indeed able to see the status of the antimalware. Now here comes my confusion: I know that the Azure Security Center "Azure Defender On" paid tier has alerting capabilities on things like brute force attacks, but it seems the free tier has alerting on antimalware (from the IaaSAntimalware extension at least) baked in. I tested this with an eicar test file, and sure enough I am getting alerts.

I tested this on several Azure subscriptions that have no Azure Defender subscription, nor trial enabled. I see alerts not only in ASC, but they come to the Activity Log as well, so I can alert from there, even showing me the file path and threat status whether it was quarantined.

My question: Is this a happy accident, or is even the free tier supposed to have antimalware alerting from Azure Security Center? Or is that ability going away like after a while, like a secret trialware?

P.S. I am well aware that ASC's capabilities extend beyond just antimalware, but this feature alone would be a serious bonus.

[#2 · Accepted solution]

Hi @-Akos-,

Endpoint Protection assessments (including SCEP/Microsoft Antimalware) for Azure resources are part of Azure Security Center without Azure Defender. More information about what features are included in ASC with and without Azure Defender can be found here.

Best regards,

Tom Janetscheck

Senior Program Manager

CxE | Azure Security Center

[#3]

Hi @Tom_Janetscheck 

Thank you for your answer! I have seen that article, but it doesn't say very clearly that you get that for free, but it's great to know that this little gem is a keeper. And it alone will be reason for me to get ASC in every new subscription we manage.