Deploy Microsoft Defender for Cloud via Terraform
Terraform is an Infrastructure as a Code tool created by Hashicorp. It’s used to manage your infrastructure in Azure, as well as other clouds. In this article, we’ll be showing you how to deploy Microsoft Defender for Cloud (MDC) using Terraform from scratch.Policy Distribution Dashboard for Microsoft Defender for Cloud
Understanding the current state of your environment is the first step towards improving its security posture. Microsoft Defender for Cloud is designed to strengthen the three pillars every enterprise relies on which is Protection, Detection & Response providing you CSPM & CWPP functionalities. In Defender for Cloud, the posture management features provide Visibility and hardening guidance and the central feature that enables you to achieve these goals is Secure Score. Defender for Cloud continually assesses your resources, subscriptions and organization for security issues, and it aggregates all the findings into a single score by providing you list of recommendations. Typically, these are gaping holes that need to be fixed ASAP, while some recommendations are more long-term or just less critical and some more critical. Current Challenge One of the questions we constantly get asked is, How do I ensure that the Security posture will not start deteriorating again after the fixes have been made (or) how do I ensure I apply guardrails at the beginning of deployment phase for every service in Azure. It is often the case that development teams have full control of their subscriptions/resources. As a result, the configurations start to drift. The cure is simple, we need to have a security baseline defined. Before you start reading about the proposed solution, it is important to understand, Defender for Cloud and Azure policies work together to help monitor and report on compliance in your environment. Like security policies, Defender for Cloud initiatives are also created in Azure Policy. You can use Azure policy to manage your policies, build initiatives, and assign initiatives to multiple subscriptions or for entire management groups. The default initiative automatically gets assigned to every subscription in Defender for Cloud and that is Azure Security Benchmark. Azure Security Benchmark (ASB) consolidates Microsoft security best practices in Azure. It’s a great resource for design decisions, and the controls are mapped to industry standards. We have also created a policy set in Azure which can be used for monitoring resource compliance against the baseline. This widely respected benchmark builds on the controls from the Center for Internet Security (CIS) and National Institute of Standards and Technology (NIST) with a focus on cloud-centric security. Almost every recommendation from Defender for Cloud has an underlying policy that is derived from a requirement in the benchmark. To learn about the built-in policies that are monitored by Defender for Cloud, check this out. Here you can find all the Azure Policy definitions in the Defender for Cloud category. Proposed Solution Up until now, there was no single view with which you could visualize all the policies you have assigned to monitor compliance of your environment. You had to browse through many different blades in Azure to assess and obtain this information. With this blog, I’m introducing you to a workbook that acts as a single pane of glass representing the policies and baselines across multiple subscriptions in Azure, in your environment as the first crucial step is to inventory and gain visibility. What’s in the Dashboard The new Policy Distribution Dashboard for Microsoft Defender for Cloud provides a unified view and deep visibility into the configuration of your overall policy structure in Azure. The dashboard is powered by Azure Resource Graph (ARG) queries and divided into different sections. The workbook can be edited, and all queries can be modified to meet your needs. The workbook provides different sections like: Initiatives that’s assigned to the subscriptions The recommendations that are exempted and that are policy disabled List of Custom policies Regulatory Compliance Assessment State Policies by effect Compliance by policy assignment How to Deploy The Policy Distribution Dashboard is available in the Microsoft Defender for Cloud GitHub Repo page, under Workbooks and can be accessed directly with its direct URL The workbook can be deployed quickly in the Azure Commercial and Gov cloud environments by clicking the respective “Deploy to Azure” buttons on the workbook page. How to Use To use this dashboard, you need at least Reader permission at the subscription level. Assuming you have the required permissions, watch the screen capture below to learn about how to navigate through and use the dashboard. Conclusion The Policy Distribution dashboard provides valuable information about your policy assignments and it’s status. The workbook is available to all customers free of charge and does not require you to be a paid customer of Microsoft Defender for Cloud. Additional Resources To learn more about Microsoft Defender for Cloud, visit: https://aka.ms/ascninja To learn about Microsoft Defender for Cloud workbooks, visit: https://docs.microsoft.com/en-us/azure/security-center/custom-dashboards-azure-workbooks Acknowledgements Special thanks to liorarviv for the partnership in reviewing and providing feedbacks on the artifact and reviewing article. Many thanks to @Rebecca Halla & YuriDiogenes in supporting this initiative and suggesting feedbacks.Automation to Block Outgoing Traffic to Malicious Websites detected by Microsoft Defender for DNS
One common type of security attack that occurs when an attacker has gained access to a virtual machine is that they will attempt to go to suspicious IP addresses. Attackers may do this for any number of reasons, including to perform data exfiltration from your Azure resources using DNS tunnelling, download malware to communicate with command and control servers, perform DNS attacks which is communication with malicious DNS resolvers, and to communicate with domains used for malicious activities such as phishing and crypto mining. All of these activities can be detected by Microsoft Defender for DNS, which is part of Microsoft Defender for Cloud. When the outgoing traffic has been detected to be to suspicious IP addresses by the Microsoft Defender for DNS plan, Microsoft Defender for DNS will trigger an alert. Some ways to investigate the alert can be found in the Take Action tab of the alert: In this case, we recommend that you set up the following workflow automation, which will automatically block this attack from occurring by creating a network security rule in the virtual machine's network security group to block outgoing traffic to this malicious IP address. What are the prerequisites for this automation? The Microsoft Defender for DNS plan should be enabled, as per here. You should have deployed a VM the standard way with any operating system. Note: It’s not guaranteed for this automation to succeed correctly if the VM is using a domain controller or if the DNS is sent through a DNS server in the VNET. This automation can be utilised for the alerts that come from Defender for DNS that contain the malicious IP address that the attacker is attempting to go to. You can validate this by creating these alerts yourself on the VM by following the instructions here. This automation can be used on the following alerts: Attempted communication with suspicious sinkholed domain Network intrusion detection signature activation Communication with suspicious random domain name Communication with possible phishing domain Anonymity network activity Anonymity network activity using web proxy How does the automation work? When Microsoft Defender for Cloud detects someone is attempting to go to a malicious IP address from your virtual machine, it triggers an alert to bring you awareness about this potential attack. The automation uses this alert as a trigger to block the outgoing traffic of the IP by creating a security rule in the NSG attached to the VM to deny outbound traffic to the IP address attached to the alert. In the alerts of this type, you can find the outbound IP address appearing in the 'address' field of the alert. The Logic App uses a system-assigned Managed Identity. You need to assign Contributor permissions or Security Reader and Network Contributor permissions to the Logic App's Managed Identity so it is able to create an NSG rule once there is an attack detected. You need to assign these roles on all subscriptions or management groups you want to monitor and manage resources in using this playbook. Note: You can assign permissions only if your account has been assigned Owner or User Access Administrator roles, and make sure all selected subscriptions registered to Microsoft Defender for Cloud. Refer to the Readme file in our GitHub Repository for detailed procedure. Deployment process and details Navigate to Microsoft Defender for Cloud GitHub repository and select “Deploy to Azure” as shown in Image 1: Image 1: Git Hub repository Once you have clicked on ‘Deploy’ option in the screen above, you should automatically be redirected to the Azure portal Custom deployment page where you can fill in the details of requirement as shown in Image 2, as shown below: Image 2: Azure portal, Custom Deployment The ARM template will create the Logic App Playbook and an API connection to Office 365, and ascalert. You need to authorize the Office 365 API connection so it can access the sender mailbox and send the email notification from there. Once you review and create from Image 2, you would notice below resources created from the ARM template (Refer Image 3) Image 3: Summary of the resources created from the ARM template Define when the Logic App should automatically run: Workflow automation feature of Microsoft Defender for Cloud can trigger Logic Apps on security alerts and recommendations. For example, you might want Microsoft Defender for Cloud to email a specific user when an alert occurs. When you add the workflow automation and trigger conditions, the triggers will initiate this automatic workflow. In this example, you want the Logic App to run when a security alert that contains "domain" is generated. Note: Read more about workflow automation here When an attempt to go to a suspicious domain is detected by Microsoft Defender for Cloud as shown in Image 4, this would automatically apply the automation and blocks the traffic of the IP by creating a security rule in the NSG attached to the VM to deny outbound traffic to the IP address associated with the json of the alert as shown in Image 4. Image 4: IP blocked by Microsoft Defender for Cloud You would receive an email notification on the alert details as shown in Image 5: Image 5: Email received to show automation has been triggered This logic app as well as many other can be found here: Direct Link to GitHub sample Microsoft Defender for Cloud GitHub Repo Most organizations lack the time and expertise required to respond to these alerts so many go unaddressed. Having this type of automation can address the threat immediately. I hope you enjoyed reading this article and implementing it! Special thanks to: Tom Janetscheck, Senior Program Manager, Microsoft Defender for Cloud, Microsoft Safeena Begum Lepakshi, Senior Program Manager, Microsoft Defender for Cloud, Microsoft Ido Keshet, Senior Program Manager, Microsoft Defender for Cloud, Microsoft Thomas Vuylsteke, Senior Customer Engineer, Microsoft YuriDiogenes, Principal PM Manager, Microsoft Defender for CloudMicrosoft Defender for Cloud PoC Series - Multicloud with GCP
Introduction The purpose of this article is to provide specific guidelines on how to perform a Proof of Concept (PoC) for Microsoft Defender for Cloud’s native GCP (Google Cloud Platform) support. This article is part of a series of articles called The Microsoft Defender for Cloud PoC Series, each providing specific guidelines on how to perform a PoC for a specific Microsoft Defender for Cloud plan. For a more holistic approach and where you need to validate Microsoft Defender for Cloud’s Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWP) capabilities all up, see the How to Effectively Perform an Microsoft Defender for Cloud PoC article. Planning This section highlights important considerations and availability information that you should be aware of when planning for the PoC. NOTE: At the time of writing this article, Microsoft Defender for Cloud native GCP support isn’t available for national clouds (such as Azure Government and Azure China 21Vianet). For most actual information, see Feature support in government and national clouds. The first step of the PoC begins with gaining a clear understanding of the benefits the native GCP support in Microsoft Defender for Cloud brings to your organization. This includes: Native Agentless CSPM for GCP resources Native CWP support for GCP GKE clusters Native CWP support for GCP Virtual Machine instances Native CWP support for SQL servers running on GCP Compute instances The CSPM for GCP resources is completely agentless and at the time of writing this article, supports the data types in GCP as mentioned towards the end of this article. Additionally, Microsoft Defender for Cloud currently also supports assessing your GCP resources against regulatory standards which currently include: GCP Default, GCP CIS 1.1.0, GCP CIS 1.2.0, GCP ISO 27001, GCP NIST 800 53, and PCI DSS 3.2.1. NOTE: Standards are added to the dashboard as they become available. The preceding list might not contain recently added standards. Keep in mind that the CSPM plan for GCP resources is available for Free. Refer to this document for additional information. The CWP support for GCP GKE clusters offers a wide set of capabilities including discovery of unprotected clusters, advanced threat detection for the control plane and workload level, Kubernetes data plane recommendations (through the Azure Policy extension) and more. The CWP support for GCP VM instances offers a wide set of capabilities, including automatic provisioning of pre-requisites on existing and new machines, vulnerability assessment, integrated license for Microsoft Defender for Endpoint (MDE), file integrity monitoring and more. The CWP support for SQL servers running on GCP Compute Instances offers a wide set of capabilities, including advanced threat protection, vulnerability assessment scanning, and more. Now that we’ve touched briefly on the benefits that Microsoft Defender for Cloud’s native GCP support provides, let’s move onto the next step. Next up is identifying which use cases the PoC should cover. A few common use cases are ensuring that Compute instances do not have public IP addresses, ensuring that the default network does not exist in a project, or ensuring that VM disks for critical VMs are encrypted with Customer-Supplied Encryption Keys. Preparation and Implementation: This section highlights the requirements that you should be aware of before starting the PoC. For the complete list of permission requirements and additional pre-requisites, see the Availability section. There are three main steps when preparing to enable Microsoft Defender for Cloud’s native GCP support. Determining which capabilities are in the scope of the PoC At the time of writing this article, Defender for Cloud supports the following GCP capabilities: (see Figure 1): Native Agentless CSPM for GCP resources Native CWP support for GCP GKE clusters Native CWP support for GCP Virtual Machine instances Native CWP support for SQL servers running on GCP Compute Engine Figure 1: Native CSPM and CWP capabilities for GCP in Microsoft Defender for Cloud Selecting the GCP projects on which you’d like to perform the PoC For the purposes of this PoC, it’s important that you identify which GCP project(s) are going to be used to perform the PoC of Defender for Cloud’s native GCP support. You can choose a single GCP project or optionally, you can choose your GCP organization, which will include each project discovered under the provisioned organization. Connecting GCP projects Microsoft Defender for Cloud Figure 2: Connecting GCP accounts to Microsoft Defender for Cloud To connect GCP projects to Microsoft Defender for Cloud you need to perform a series of steps in Azure and GCP. For detailed technical guidance see Connect your GCP projects. For a video of step-by-step guidance on how this process looks like end-to-end in Azure and GCP, see this short video. NOTE: If you’ve enabled sending control plane audit logs from the GKE control plane to your project’s Cloud Logging and are exporting data out of GCP (i.e. to Azure or an external SIEM), you will incur additional costs on the GCP side. Validation Once you’ve created the connector, you can validate it by analyzing the data relevant to the use cases that your PoC covers. When validating recommendations for GCP resources and adding custom assessments, you can consult Custom assessments and standards in Microsoft Defender for Cloud for GCP workloads (Preview) - Microsoft Tech Community. When validating alerts for GCP VM instances, you can consult reference list of alerts for machines. When validating alerts for GKE clusters, you can consult reference list of alerts for containers – Kubernetes clusters. When validating alerts for SQL servers running on GCP VM instances, you can consult reference list of alerts. You can also export Defender for Cloud security alerts to a SIEM (i.e. Azure Sentinel or 3 rd party SIEM). Learn more about how to stream alerts to a SIEM, SOAR or ITSM. Learn more about how to investigate Microsoft Defender for Cloud alerts using Microsoft Sentinel. Closing Considerations: By the end of this PoC, you should be able to determine the value of the native GCP integration in Defender for Cloud. The native GCP support provides agentless CSPM for GCP resources and advanced CWP capabilities for servers, containers, and databases. For a more holistic approach where you need to validate Microsoft Defender for Cloud’s CSPM and CWP capabilities, see How to Effectively Perform an Microsoft Defender for Cloud PoC article. P.S. To stay up to date on helpful tips and new release, subscribe to our Microsoft Defender for Cloud Newsletter and join our Tech Community where you can be one of the first to hear the latest Defender for Cloud news, announcements and get your questions answered by Azure Security experts.
Unleashing the Power of Microsoft Defender for Cloud – Unique Capabilities for Robust Protection
So you have implemented a non-native Cloud Security Posture Management solution but there are security gaps that you might not have considered. How Defender for Cloud is uniquely positioned to secure your cloud attack surface.
Secure score power BI dashboard
We are following https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Secure%20Score to deploy secure score over the time dashboard for MDC. however steps for the deployment are very old when we had azure security center instead of MDC and prerequisites are not properly documented. As per the article we need to: Export the secure score data to Log analytics workspace by using continuous report option in MDC portal. Deploy Secure Score over the time workbook which can export the secure score data to Log Analytics workspace (not clear if this will pull reports every 24 hours and what permissions are required on Log Analytics workspace and to deploy the workbook) Do we need to export the secure score data to same Log Analytics workspace on which MDC is deployed or a separate workspace is needed ? If MDC already uses Log analytics workspace in the backend to store the logs then why can't we pull the secure score log data directly? why we need to export the secure score data to Log Analytics workspace first then to connect it to dashboard ?
