Microsoft Defender for Cloud Cookbook: Protect multicloud and hybrid cloud environments, manage compliance and strengthen security posture

Description

Effectively secure their cloud and hybrid infrastructure, how to centrally manage security, and improve organizational security posture Key FeaturesImplement and optimize security posture in Azure, hybrid, and multi-cloud environmentsUnderstand Microsoft Defender for Cloud and its featuresProtect workloads using Microsoft Defender for Cloud's threat detection and prevention capabilitiesBook Description Microsoft Defender for Cloud is a multi-cloud and hybrid cloud security posture management solution that enables security administrators to build cyber defense for their Azure and non-Azure resources by providing both recommendations and security protection capabilities. This book will start with a foundational overview of Microsoft Defender for Cloud and its core capabilities. Then, the reader is taken on a journey from enabling the service, selecting the correct tier, and configuring the data collection, to working on remediation. Next, we will continue with hands-on guidance on how to implement several security features of Microsoft Defender for Cloud, finishing with monitoring and maintenance-related topics, gaining visibility in advanced threat protection in distributed infrastructure and preventing security failures through automation. By the end of this book, you will know how to get a view of your security posture and where to optimize security protection in your environment as well as the ins and outs of Microsoft Defender for Cloud. What you will learnUnderstand Microsoft Defender for Cloud features and capabilitiesUnderstand the fundamentals of building a cloud security posture and defending your cloud and on-premises resourcesImplement and optimize security in Azure, multi-cloud and hybrid environments through the single pane of glass - Microsoft Defender for CloudHarden your security posture, identify, track and remediate vulnerabilitiesImprove and harden your security and services security posture with Microsoft Defender for Cloud benchmarks and best practicesDetect and fix threats to services and resourcesWho this book is for This book is for Security engineers, systems administrators, security professionals, IT professionals, system architects, and developers. Anyone whose responsibilities include maintaining security posture, identifying, and remediating vulnerabilities, and securing cloud and hybrid infrastructure. Anyone who is willing to learn about security in Azure and to build secure Azure and hybrid infrastructure, to improve their security posture in Azure, hybrid and multi-cloud environments by leveraging all the features within Microsoft Defender for Cloud. Table of ContentsGetting Started with Microsoft Defender for CloudMulti-Cloud ConnectivityWorkflow Automation and Continuous ExportSecure Score and RecommendationsSecurity AlertsRegulatory Compliance and Security PolicyMicrosoft Defender for Cloud Workload ProtectionFirewall ManagerInformation ProtectionWorkbooks Cover Title Page Copyright and Credits Dedication Contributors Table of Contents Preface Chapter 1: Getting Started with Microsoft Defender for Cloud Technical requirements Enabling Microsoft Defender for Cloud Plans on Azure Subscriptions and Log Analytics Workspaces Getting ready How to do it… How it works… Enabling an Microsoft Defender for Cloud Plans on an Azure Subscription Getting ready How to do it… How it works… There's more… Enabling an Microsoft Defender for Cloud Plans on a Log Analytics Workspace Getting ready How to do it… How it works… Enabling an Microsoft Defender for Cloud Plans on multiple Azure Subscriptions and Log Analytics Workspaces Getting ready How to do it… How it works… Configuring data collection in a Log Analytics Workspace Getting ready How to do it… How it works… Configuring provisioning extensions automatically Getting ready How to do it… How it works… Enabling a Log Analytics agent for Azure VMs manually in the Log Analytics Workspace settings Getting ready How to do it… How it works… Enabling a Log Analytics agent for Azure VMs manually in the Virtual Machine settings Getting ready How to do it… How it works… There's more… Configuring a Log Analytics agent for Azure VMs extension deployment Getting ready How to do it… How it works… Configuring email notifications Getting ready How to do it… How it works… Assigning Microsoft Defender for Cloud permissions Getting ready How to do it… How it works… Onboarding Microsoft Defender for Cloud using PowerShell Getting ready How to do it… How it works… There's more… Enabling Microsoft Defender for Cloud integration with other Microsoft security services Getting ready How to do it… How it works… Chapter 2: Multi-Cloud Connectivity Technical requirements Connecting non-Azure virtual machines using Azure Arc Getting ready How to do it… How it works… Connecting non-Azure virtual machines using Microsoft Defender for Cloud portal pages Getting ready How to do it… How it works… Setting up Amazon Web Services Config and Amazon Web Services Security Hub Getting ready How to do it… How it works… Creating an Identity and Access Management AWS role for Microsoft Defender for Cloud Getting ready How to do it… How it works… Connecting Amazon Web Services to Microsoft Defender for Cloud Getting ready How to do it… How it works… There's more… Configuring GCP Security Command Center and enabling GCP Security Command Center API Getting ready How to do it… How it works… Creating a GCP service account and connecting GCP to Microsoft Defender for Cloud Getting ready How to do it… How it works… Chapter 3: Workflow Automation and Continuous Export Technical requirements Creating logic apps for use in Microsoft Defender for Cloud Getting ready How to do it… How it works… There's more… See also Automating threat detection alert responses Getting ready How to do it… How it works… Automating Microsoft Defender for Cloud recommendation responses Getting ready How to do it… How it works… Automating regulatory compliance standards responses Getting ready How to do it… How it works… Configuring continuous export to Event Hub Getting ready How to do it… How it works… Configuring continuous export to a Log Analytics workspace Getting ready How to do it… How it works… Chapter 4: Secure Score and Recommendations Technical requirements Understanding, filtering, and sorting recommendations Getting ready How to do it... How it works... Downloading a recommendation report Getting ready How to do it... How it works... Creating a recommendation exemption rule Getting ready How to do it... How it works... Creating a recommendation enforcement rule Getting ready How to do it... How it works... There's more... Preventing creating resources using a Deny rule Getting ready How to do it... How it works... There's more... Disabling a recommendation Getting ready How to do it... How it works... Fixing recommendations on affected resources Getting ready How to do it... How it works... Managing a recommendation query in Azure Resource Graph Explorer Getting ready How to do it... How it works... Getting a secure score using Azure Resource Graph Getting ready How to do it... How it works... There's more... Chapter 5: Security Alerts Technical requirements Filtering, grouping, and exporting security alerts Getting ready How to do it How it works There's more Responding to security alerts using automated responses Getting ready How to do it How it works Creating suppression rules Getting ready How to do it How it works There's more Organizing security alerts and changing a security alert status Getting ready How to do it How it works Chapter 6: Regulatory Compliance and Security Policy Technical requirements Managing Microsoft Defender for Cloud's default security policy Getting ready How to do it… How it works… Adding a custom security initiative and policy Getting ready How to do it… How it works… Adding a regulatory compliance standard Getting ready How to do it… How it works… See also Improving regulatory compliance, exempting, and denying a compliance control Getting ready How to do it… How it works… Accessing and downloading compliance reports Getting ready How to do it… How it works… Chapter 7: Microsoft Defender for Cloud Workload Protection Technical requirements Enabling a vulnerability assessment solution Getting ready How to do it… How it works… Enabling and configuring JIT access on a virtual machine Getting ready How to do it… How it works… Requesting access to a JIT-enabled virtual machine Getting ready How to do it… How it works… Configuring the adaptive application control group Getting ready How to do it… How it works… Managing adaptive network hardening Getting ready How to do it… How it works… There's more… Remediating vulnerabilities in Azure Container Registry images Getting ready How to do it… How it works… Managing a SQL vulnerability assessment Getting ready How to do it… How it works… Managing file integrity monitoring Getting ready How to do it… How it works… Chapter 8: Firewall Manager Technical requirements Creating an Azure firewall Getting ready How to do it… How it works… Creating an Azure firewall using PowerShell Getting ready How to do it… How it works… Creating an Azure firewall policy Getting ready How to do it… How it works… Creating an Azure firewall policy using PowerShell Getting ready How to do it… How it works… Chapter 9: Information Protection Creating and managing sensitivity labels Getting ready How to do it… How it works… There's more… Creating and managing information types and managing information protection policy Getting ready How to do it… How it works… There's more… Chapter 10: Workbooks Technical requirements Creating a workbook from an existing template Getting ready How to do it… How it works… Creating a workbook from an empty workbook Getting ready How to do it… How it works… There's more… Managing workbooks and workbook templates Getting ready How to do it… How it works… Index About Packt Other Books You May Enjoy