Category Archives: Monitoring & Detection

Notes on Azure Backup Soft-delete feature in a cybersecurity context

Posted on 07/22/2021 by azsec

Backup would be the last hope for you in an attempt of recovering your infrastructure after a cyber attack. Malware doesn’t only steal and exfiltrate data but also scans and deletes your backup. The soft delete feature is designed to … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged | Leave a comment

Multi-homing Logging with new Azure Monitor Agent

Posted on 01/18/2021 by azsec

Sending logs from Azure virtual machine/virtual machine scale set to different Azure Log Analytics workspace (as known as multi-homing) is a common requirement in a large cloud environment. In the past Azure only supported configuring multi-homing on Windows virtual machine. … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | Leave a comment

Alert Grouping feature in Azure Sentinel

Posted on 02/24/2020 by azsec

One of the things that SecOps guys needs when working with Azure Sentinel is the ability to group all alerts that have similar characteristics into a single incident in order to better manage and respond. Given an example about Traffic … Continue reading →

Posted in Monitoring & Detection | Tagged , | 3 Comments

Export virtual machines with ASC monitoring agent issue

Posted on 02/08/2020 by azsec

There is a recommendation named “Monitoring agent health issues should be resolved on your machine” in Azure Security Center that provides you list of unhealthy resources (virtual machine resource type). There are several reasons that can cause unhealthy monitoring state … Continue reading →

Posted in Monitoring & Detection | Tagged , | 1 Comment

What Blue Team needs to know about Run Script feature in Azure

Posted on 01/20/2020 by azsec

Run Script is great feature that help cloud system admin perform command or script execution on target virtual machine without RDP or setting up a PsRemote that may not be allowed in your organization. Nontheless Run Script also allows bad … Continue reading →

Posted in Monitoring & Detection | Tagged , | 1 Comment

An analysis of Suspicious Authentication activity from Azure Security Center

Posted on 01/10/2020 by azsec

There are some readers after following this article to simulate alerts generated from Azure Security Center approaching me asking about one of the alerts they have seen named Suspicious authentication activity. They don’t know whether their testing virtual machines in … Continue reading →

Posted in Monitoring & Detection | Tagged , , | 2 Comments

Security Monitoring and Detection Tips for your Storage Account – Part 4

Posted on 12/31/2019 by azsec

In part 3, you were introduced some storage account related alerts that are generated by Azure Security Center -Advanced Threat Protection. You also got to know a few ways to manually generate those alerts so you could look into how … Continue reading →

Posted in Monitoring & Detection | Tagged , | 1 Comment

Security Monitoring and Detection Tips for your Storage Account – Part 3

Posted on 12/20/2019 by azsec

In previous article you learned about different ways to collect Azure Storage account logs. You also learned about a model of centralizing Storage account log. No matter how you want to build, your storage account log should be ready for  … Continue reading →

Posted in Monitoring & Detection | Tagged , | 4 Comments

Security Monitoring and Detection Tips for your Storage Account – Part 2

Posted on 12/09/2019 by azsec

The previous part of the series introduced you three different types of log that Azure Storage account provide. Each of them can be used for different purpose but can be correlated together for a single view. Understanding every piece of … Continue reading →

Posted in Monitoring & Detection | Tagged , | 7 Comments

Security Monitoring and Detection Tips for your Storage Account – Part 1

Posted on 12/09/2019 by azsec

Capital One breach was one of the biggest data breaches in 2019 which affected over 100 million people. There was a compromised access key that was used to access to an S3 storage bucket (equivalent to Azure Storage Account) to … Continue reading →

Posted in Monitoring & Detection | Tagged , | 6 Comments