Tagging is often part of your cloud governance. You’d use tag to manage cost per subscription. You’d use it to distinguish environment type (e.g. non-production, production, test, development…)
In this article, let’s play with tag a bit. You will learn on how to get subscription tag via Azure ARM template or how to perform applying tag to all subscriptions.
As part of SOC work you may want to get information of Microsoft Defender for Cloud plan on each subscription so you can plan to roll out a defender plan on one that doesn’t have yet.
While Azure PowerShell, REST API or Az CLI can help retrieve information for you, this article would like to share a simple Resource Graph Explore to achieve the similar thing.
There are several ways to test Microsoft Sentinel REST API with GET method. You can test directly (from Try It button) on the REST API docs page. Postman is another option.
I have developed a simple PowerShell script to help you test Microsoft Sentinel REST API. The script cover the most commonly used APIs including alert, incident, threat intelligence, watchlist, bookmark and connector.
As you may know the latest stable Microsoft Sentinel Alert API version 2020-01-01 doesn’t allows you to create an analytics rule in which you can add custom entity mapping, custom detail or incident grouping configuration. It isn’t too helpful for you in the case you would like to do more with the analytics rule or to copy testing rules over to a new Microsoft Sentinel workspace. Fortunately Microsoft has been working on a newer API version to help you enrich the analytics rule.
In this article, I would like to share with you the latest script to help create an analytic rule that you can include custom entity mapping or incident configuration.
In a large deployment, having a non-production environment to test Microsoft Sentinel analytics rule is recommended. Now when everything is ready you would need to copy your rules over to the production environment.
This article provides you a script to help you get the copy done. The script still has several limitations currently that you need to know too.
Microsoft Sentinel (formerly aka Azure Sentinel) has a feature that allows you to create and manage custom Threat Intelligence (TI) indicators (aka IoC – Indicators of Compromise).
There are requests from avid readers asking AzSec to write something about Microsoft Sentinel REST API for Threat Intelligence. To give back to the community as a thanksgiving gift, this article is going to share with you the latest script for creating a new TI indicator in Azure Sentinel.
As part of SOC work you may want to check in your Azure environment the number of VMs or VM Scalesets by Operating System type so you can report to InfoSec leader. Moreover that helps plan security patching better.
This article is just to share with you a simple Resource Graph Explorer to get the job done.
If you are working with Azure Policy you must know about the on-demand Azure Policy evaluation scan that Azure allows you to trigger. Currently, you can only trigger the compliance evaluation at your current subscription context or for a resource group. If your policy is applied at the management group level that contains a lot of subscriptions, triggering the compliance scan for every subscription manually sounds painful.
In this article, let’s see how we can get a list of respective subscriptions under a management group and trigger Azure Policy compliance evaluation at a management group scope.
Enabling and configuring vulnerability assessment (VA) feature on Azure SQL Server is needed in an environment where security and compliance is strictly followed. And now you are asked by InfoSec leader to provide status of VA configuration on all of your Azure SQL Server.
This article is NOT going to tell you on how to audit VA setting which can be done quite easily with Azure Policy. This article is simply to share a PowerShell script to help you retrieve VA setting so you can verify if any of your Azure SQL Server has VA configured and which storage account it uses to store the VA scanning result.
Microsoft Defender for Servers offers you a capability for Azure VMs to help detect threat and to add additional defense. Currently it is supported on both Windows and Linux.
In this article, let’s quickly check if we can deploy the MDE agent via Azure ARM template.
