Deploy Microsoft Defender for Cloud via Terraform
Terraform is an Infrastructure as a Code tool created by Hashicorp. It’s used to manage your infrastructure in Azure, as well as other clouds. In this article, we’ll be showing you how to deploy Microsoft Defender for Cloud (MDC) using Terraform from scratch.Microsoft Defender for Cloud PoC Series - Multicloud with GCP
Introduction The purpose of this article is to provide specific guidelines on how to perform a Proof of Concept (PoC) for Microsoft Defender for Cloud’s native GCP (Google Cloud Platform) support. This article is part of a series of articles called The Microsoft Defender for Cloud PoC Series, each providing specific guidelines on how to perform a PoC for a specific Microsoft Defender for Cloud plan. For a more holistic approach and where you need to validate Microsoft Defender for Cloud’s Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) capabilities all up, see the How to Effectively Perform an Microsoft Defender for Cloud PoC article. Planning This section highlights important considerations and availability information that you should be aware of when planning for the PoC. NOTE: At the time of writing this article, Microsoft Defender for Cloud native GCP support isn’t available for national clouds (such as Azure Government and Azure China 21Vianet). For most actual information, see Feature support in government and national clouds. The first step of the PoC begins with gaining a clear understanding of the benefits the native GCP support in Microsoft Defender for Cloud brings to your organization. This includes: Native Agentless CSPM for GCP resources Native CWP support for GCP GKE clusters Native CWP support for GCP Virtual Machine instances Native CWP support for SQL servers running on GCP Compute instances The CSPM for GCP resources is completely agentless and at the time of writing this article, supports the data types in GCP as mentioned towards the end of this article. Additionally, Microsoft Defender for Cloud currently also supports assessing your GCP resources against regulatory standards which currently include: GCP Default, GCP CIS 1.1.0, GCP CIS 1.2.0, GCP ISO 27001, GCP NIST 800 53, and PCI DSS 3.2.1. NOTE: Standards are added to the dashboard as they become available. The preceding list might not contain recently added standards. Keep in mind that the CSPM plan for GCP resources is available for Free. Refer to this document for additional information. The CWP support for GCP GKE clusters offers a wide set of capabilities including discovery of unprotected clusters, advanced threat detection for the control plane and workload level, Kubernetes data plane recommendations (through the Azure Policy extension) and more. The CWP support for GCP VM instances offers a wide set of capabilities, including automatic provisioning of pre-requisites on existing and new machines, vulnerability assessment, integrated license for Microsoft Defender for Endpoint (MDE), file integrity monitoring and more. The CWP support for SQL servers running on GCP Compute Instances offers a wide set of capabilities, including advanced threat protection, vulnerability assessment scanning, and more. Now that we’ve touched briefly on the benefits that Microsoft Defender for Cloud’s native GCP support provides, let’s move onto the next step. Next up is identifying which use cases the PoC should cover. A few common use cases are ensuring that Compute instances do not have public IP addresses, ensuring that the default network does not exist in a project, or ensuring that VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys. Preparation and Implementation: This section highlights the requirements that you should be aware of before starting the PoC. For the complete list of permission requirements and additional pre-requisites, see the Availability section. There are three main steps when preparing to enable Microsoft Defender for Cloud’s native GCP support. Determining which capabilities are in the scope of the PoC At the time of writing this article, Defender for Cloud supports the following GCP capabilities: (see Figure 1): Native Agentless CSPM for GCP resources Native CWP support for GCP GKE clusters Native CWP support for GCP Virtual Machine instances Native CWP support for SQL servers running on GCP Compute Engine Figure 1: Native CSPM and CWP capabilities for GCP in Microsoft Defender for Cloud Selecting the GCP projects on which you’d like to perform the PoC For the purposes of this PoC, it’s important that you identify which GCP project(s) are going to be used to perform the PoC of Defender for Cloud’s native GCP support. You can choose a single GCP project or optionally, you can choose your GCP organization, which will include each project discovered under the provisioned organization. Connecting GCP projects Microsoft Defender for Cloud Figure 2: Connecting GCP accounts to Microsoft Defender for Cloud To connect GCP projects to Microsoft Defender for Cloud you need to perform a series of steps in Azure and GCP. For detailed technical guidance see Connect your GCP projects. For a video of step-by-step guidance on how this process looks like end-to-end in Azure and GCP, see this short video. NOTE: If you’ve enabled sending control plane audit logs from the GKE control plane to your project’s Cloud Logging and are exporting data out of GCP (i.e. to Azure or an external SIEM), you will incur additional costs on the GCP side. Validation Once you’ve created the connector, you can validate it by analyzing the data relevant to the use cases that your PoC covers. When validating recommendations for GCP resources and adding custom assessments, you can consult Custom assessments and standards in Microsoft Defender for Cloud for GCP workloads (Preview) - Microsoft Tech Community. When validating alerts for GCP VM instances, you can consult reference list of alerts for machines. When validating alerts for GKE clusters, you can consult reference list of alerts for containers – Kubernetes clusters. When validating alerts for SQL servers running on GCP VM instances, you can consult reference list of alerts. You can also export Defender for Cloud security alerts to a SIEM (i.e. Azure Sentinel or 3 rd party SIEM). Learn more about how to stream alerts to a SIEM, SOAR or ITSM. Learn more about how to investigate Microsoft Defender for Cloud alerts using Microsoft Sentinel. Closing Considerations: By the end of this PoC, you should be able to determine the value of the native GCP integration in Defender for Cloud. The native GCP support provides agentless CSPM for GCP resources and advanced CWP capabilities for servers, containers, and databases. For a more holistic approach where you need to validate Microsoft Defender for Cloud’s CSPM and CWP capabilities, see How to Effectively Perform an Microsoft Defender for Cloud PoC article. P.S. To stay up to date on helpful tips and new release, subscribe to our Microsoft Defender for Cloud Newsletter and join our Tech Community where you can be one of the first to hear the latest Defender for Cloud news, announcements and get your questions answered by Azure Security experts.Azure Security Center Webinar: Secure Score
Want to learn about Secure Score in Azure Security Center? Join our webinar. Details and registration at https://aka.ms/ASCSSWebinar. Azure Secure Score is a simple but elegant tool that will help you improve your infrastructure security by identifying and ranking the highest impact configuration changes you can make. We have recently introduced tools such as "virtual analyst" which enable you to increase your Secure Score in an automated fashion. More details can be found at https://docs.microsoft.com/en-us/azure/security-center/security-center-secure-score. We are hosting two identical sessions at the following times: Tuesday, September 10, 2019 at 08:00 PT / 11:00 ET / 15:00 GMT, and Wednesday, September 11, 2019 at 09:00 GMT / 11:00 CEST / 17:00 HKT Afterward, recordings will be posted to https://aka.ms/ASCRecordings. We hope you’ll join us!Breaking down security silos: Microsoft Defender for Cloud Expands into the Defender Portal
Picture this: You’re managing security across Azure, AWS, and GCP. Alerts are coming from every direction, dashboards are scattered and your team spends more time switching portals than mitigating threats. Sound familiar? That’s the reality for many organizations today. Now imagine a different world—where visibility, control and response converge into one unified experience, where posture management, vulnerability insights and incident response live side by side. That world is no longer a dream: Microsoft Defender for Cloud (MDC) is now integrated into Defender XDR in public preview. The expansion of MDC into the Defender portal isn’t just a facelift. It’s a strategic leap forward toward a Cloud-Native Application Protection Platform (CNAPP) that scales with your business. With Microsoft Defender for Cloud’s deep integration into the unified portal, we eliminate security silos and bring a modern, streamlined experience that is more intuitive and purpose-built for today’s security teams, while delivering a single pane of glass for hybrid and multi-cloud security. Here’s what makes this release a game-changer: Unified dashboard See everything with a single pane of glass—security posture, coverage, trends—across Azure, AWS and GCP. No more blind spots. Risk-based recommendations Prioritize by exploitability and business impact. Focus on what matters most, not just noise. Attack path analysis across all Defenders Visualize potential breach paths and cut them off before attackers can exploit them. Unified cloud assets inventory A consolidated view of assets, health data and onboarding state—so you know exactly where you stand. Cloud scopes & unified RBAC Create boundaries between teams, ensure each persona has access to the right level of data in the Defender portal. The enhanced in-portal experience includes all familiar Defender for Cloud capabilities and adds powerful new cloud-native workflows — now accessible directly within the Defender portal. Over time, additional features will be rolled out so that security teams can rely on a single pane of glass for all their pre- and post-breach operations. Unified cloud security dashboard A brand-new “Cloud Security→ Overview” page in Defender portal gives you a central place to assess your cloud posture across all connected clouds and environments (Azure, AWS, GCP, on-prem and onboarded environments such as Azure DevOps, Github, Gitlab, DockerHub, Jfrog). The unified dashboard displays the new Cloud Security Score, Threat Detection alerts and Defender coverage statistics. Amongst the high-level metrics, you can find the number of assessed resources, count of active recommendations, security alerts and more, giving you at-a-glance insight into your environment’s health. From here, you can drill into individual areas: Security posture, Exposure Management bringing visibility over Recommendations and Vulnerability Management, a unified asset inventory, workload specific insights and historical security posture data going back up to 6 months. Cloud Assets Inventory The cloud asset inventory view provides a unified, contextual inventory of all resources you have connected to Defender for Cloud — across cloud environments or on-premises. Assets are categorized by workload type, criticality, Defender coverage status, with integrated health data, risk signals, associated exposure management data, recommendations and related attack paths. Resources with unresolved security recommendations or alerts are clearly flagged — helping you quickly prioritize on risky or non-compliant assets. While you will get a complete list of cloud assets under "All assets", the rest of the tabs show you the complete view into each workload, with detailed and specific insights on each workload (VMs, Data, Containers, AI, API, DevOps, Identity and Serverless). Posture & Risk Management: From Secure Score to risk-based recommendations The traditional posture-management and CSPM capabilities of Defender for Cloud expand into the Defender portal under “Exposure Management.” A key upgrade is the new Cloud Secure Score — a risk-based model that factors in asset criticality and risk factors (e.g. internet exposure, data sensitivity) to give a more accurate, prioritized view of cloud security posture. The score ranges from 0 to 100, where 100 means perfect posture. It aggregates across all assets, weighting each asset by its criticality and the risk of its open recommendations. You can view the Cloud Secure Score overall, by subscription, cloud environment or workload type. This allows security teams to quickly understand which parts of their estate require urgent attention, and track posture improvements over time. Defender for Cloud continues to generate security recommendations based on assessments against built-in (or custom) security standards. When you have the Defender CSPM plan enabled in the Defender portal, these recommendations are surfaced with risk-based prioritization, where recommendations are tied to high-risk or critical assets show up first — helping you remediate what matters most. Each recommendation shows risk level, number of attack paths, MITRE ATT&CK tactics and techniques. For each recommendation you will see the remediation steps, attack map and the initiatives it contributes to - such as the Cloud Secure score. Continued remediation — across all subscriptions and environments — is the path toward a hardened cloud estate. Proactive Attack Surface Management: Attack path analysis A powerful addition is the "Attack paths" overview, which helps you visualize potential paths attackers could use — from external exposure zones to your most critical business assets to infiltrate your environment and access sensitive data. Defender’s algorithm models your network, resource interactions, vulnerabilities and external exposures to surface realistic, exploitable attack paths, rather than generic threat scenarios, while putting focus on the top targets, entry points and choke points involved in attack paths. The Attack Paths page organizes findings by risk level and correlates data across all Defender solutions, allowing users to rapidly detect high-impact attack paths and focus remediation on the most vulnerable assets. For some workloads, for example container-based or runtime workloads, additional prerequisites may apply (e.g. enabling agentless scanning or relevant Defender plans) to get full visualization. Governance, Visibility and Access: Cloud Scopes and Unified RBAC The expansion into the Defender portal doesn’t just bring new dashboards — it also brings unified access and governance using a single identity and RBAC model for the Defender solutions. Now you can manage cloud security permissions alongside identity, device and app permissions. Cloud Scopes ensure that teams with appropriate roles within the defined permission groups (e.g. Security operations, Security posture) can access the assets and features they need, scoped to specific subscriptions and environments. This unified scope system simplifies operations, reduces privilege sprawl and enforces consistent governance across cloud environments and across security domains. The expansion of Defender for Cloud into the Defender portal is more than a consolidation—it’s a strategic shift toward a truly integrated security ecosystem. Cloud security is no longer an isolated discipline. It is intertwined with exposure management, threat detection, identity protection and organizational governance. To conclude, this new experience empowers security teams to: Understand cloud risk in full context Prioritize remediation that reduces real-world threats Investigate attacks holistically across cloud and non-cloud systems Govern access and configurations with greater consistency Predict and prevent attack paths before they happen In this new era, cloud security becomes a continuous, intelligent and unified journey. The Defender portal is now the command center for that journey—one where insights, context and action converge to help organizations secure the present while anticipating the future. Ready to Explore? Defender for Cloud in the Defender portal Integration FAQ Enable Preview Features Azure portal vs Defender portal feature comparison What’s New in Defender for Cloud
Unleashing the Power of Microsoft Defender for Cloud – Unique Capabilities for Robust Protection
So you have implemented a non-native Cloud Security Posture Management solution but there are security gaps that you might not have considered. How Defender for Cloud is uniquely positioned to secure your cloud attack surface.Mission 65: Secure Score Webinar am 13. September
Angesichts der steigenden Anzahl von Cyberattacken ist die Sicherheit von Unternehmen zunehmend gefährdet. Aus diesem Grund stellt Microsoft mit dem Microsoft Secure Score ein kostenloses Tool zur Verfügung, mit dem die aktuelle Sicherheitskonfiguration anhand einer Punktzahl bewertet wird. Auf dieser Grundlage wird eine Empfehlung zur Verbesserung der Sicherheitslage erstellt. Dadurch können zielgerichtete Maßnahmen ergriffen werden, um die Punktzahl zu erhöhen und die eigene Sicherheit effektiv zu stärken. 13. September | 15:00 - 16:00 Uhr Agenda Secure Score in Azure und Microsoft 365 Live Demo Konfiguration von Sicherheitseinstellungen Funktionen und Features Best Practices Q&A Melden Sie sich kostenlos hier an.
