Category Archives: Security Operation

Notes on Azure Backup Soft-delete feature in a cybersecurity context

Posted on 07/22/2021 by azsec

Backup would be the last hope for you in an attempt of recovering your infrastructure after a cyber attack. Malware doesn’t only steal and exfiltrate data but also scans and deletes your backup. The soft delete feature is designed to … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged | Leave a comment

Create an Azure Role Assignment Watchlist in Azure Sentinel

Posted on 07/13/2021 by azsec

Watchlist in Azure Sentinel allows you to build your own data from external data sources for correlation with analytics or hunting rules in your Azure Sentinel environment. In this article, what we are going to do is explore Azure Sentinel … Continue reading →

Posted in Security Automation, Security Operation | Tagged , | 3 Comments

Multi-homing Logging with new Azure Monitor Agent

Posted on 01/18/2021 by azsec

Sending logs from Azure virtual machine/virtual machine scale set to different Azure Log Analytics workspace (as known as multi-homing) is a common requirement in a large cloud environment. In the past Azure only supported configuring multi-homing on Windows virtual machine. … Continue reading →

Posted in Monitoring & Detection, Security Operation | Tagged , | Leave a comment

Guidance for CVE-2020-0796 SMBv3 Compression vulnerability patching on Azure VM

Posted on 03/13/2020 by azsec

There are discussions around a new CVE coded CVE-2020-0796 that Microsoft indicated a remote code execution vulnerability found in SMBv3.1.1 compression feature. There are questions from people working on Azure environment asking me what to do. The purpose of this … Continue reading →

Posted in Security Operation | Tagged , , | 1 Comment

Filter Azure Security Center alert name in Azure Sentinel incident rule

Posted on 03/05/2020 by azsec

In the past we learnt on how to connect Azure Security Center to Azure Sentinel so every alert generated from Azure Security Center can be an incident in Azure Sentinel. Not all alerts are true positive and sometime you wouldn’t … Continue reading →

Posted in Security Operation | Tagged | Leave a comment

Get started with Azure Sentinel Notebooks

Posted on 01/13/2020 by azsec

Hunting in Azure using Kusto Query Language to write query against Log Analytics workspace may not be enough for you. Given an example like this article, you would want to extract all attacker IP addressees and use VirusTotal to verify … Continue reading →

Posted in Security Operation | Tagged , | 3 Comments

Demystify alert generated by Azure Sentinel versus other 3rd products

Posted on 01/12/2020 by azsec

There is a question in the community asking about alert field in Incident page, along with the question about what it meant. In this article, let’s talk about that and see how to distinguish between alert generated from Azure Sentinel … Continue reading →

Posted in Security Operation | Tagged , , | 1 Comment

VM Security Log to Event Hub for SIEM integration

Posted on 12/03/2019 by azsec

Streaming VM security log to Event Hub and add Event Hub to an Event Hub listener in SIEM is a common step in building SOC. Microsoft has separate articles for Windows and Linux where they give information on diagnostics agent … Continue reading →

Posted in Security Operation | Tagged , | 2 Comments

Thoughts on Azure Sentinel

Posted on 04/12/2019 by azsec

I got bunch of questions regarding what is the purpose or strategy of using Azure Sentinel when we have Azure Security Center (ASC). Giving the fact that everything Azure Sentinel has can be built within ASC technically. However the purpose of … Continue reading →

Posted in Security Operation | Tagged | 3 Comments