Defender for Cloud – Part 5: Security Alerts

This next part describes Security Alerts for the Azure resources. These are great to find out what’s going on if you don’t use or have forwarded alerts to Sentinel or you don’t have access to Defender portal (https://security.microsoft.com) where you also can see these.

Summary of the Security Alerts

Security alerts are generated by workload protection plans when threats are identified in your Azure, hybrid, or multicloud environments.

Security alerts are triggered by advanced detections available when you enable Defender plans for specific resource types.
Each alert provides details of affected resources, issues, and remediation steps.
MDC classifies alerts and prioritizes them by severity.
Alerts are displayed in the portal for 90 days, even if the resource related to the alert was deleted during that time.
Alerts can be exported to CSV format.
Alerts can also be streamed directly to a Security Information and Event Management (SIEM) such as Microsoft Sentinel, Security Orchestration Automated Response (SOAR), or IT Service Management (ITSM) solution. Security Alerts are also seen in Defender portal if it’s in use.
MDC leverages the MITRE ATT&CK Matrix to associate alerts with their perceived intent, helping formalize security domain knowledge.

Overview of Security Alerts

Like always I have drew areas about different functions to explain what these means:

Azure Graph query, suppression rules, security alerts map, alerts workbook, CSV report and guides
Alert status information in resources and classifications by severity
Filters
Actual alert listing

Since there was no security alerts in my subscription I used sample alerts which MDC generates.

Section 1 - Functions

Change status

You can change the alert status for example you want to manage alerts by this view.

Normally in more mature companies alerts are forwarded for example to Sentinel and handled there.

In Sentinel there’s a Defender for Cloud Data Connector which forwards those alerts from MDC to Sentinel. There’s also possible to select a Bi-directional sync so if Alert is closed in Sentinel it is also Closed in MDC’s Alert table and vice versa.

Open query

Open query link opens Azure Resource Graph Explorer where you can use pre-made templates to query Security recommendations or you can made your own queries. The query languge is KQL (Kusto Query Language)

Suppression rules

In MDC there is a possibility to create a suppression rules for security alerts which aren’t interesting or relevant. Rules let you automatically dismiss similar alerts in the future.

Some examples of how to use suppression rule are:

Suppress alerts that you’ve identified as false positives
Suppress alerts that are being triggered too often to be useful

Here’s a animated image to describe how rule is done (a bit old but it works)

Security alerts map

This map presents security alerts that contain IP addresses targeting your resources. Markings on the map represent sources of the attack on your resources.

Sample alerts

You can create sample alerts from the security alerts page in the Azure portal.

Use sample alerts to:

evaluate the value and capabilities of your Microsoft Defender for Cloud plans.
validate any configurations you’ve made for your security alerts (such as SIEM integrations, workflow automation, and email notifications).

In my case writing this post I generates sample security alerts to demostrate how alerts work and what you can to with those.

Active Alerts Workbook

Active Alerts workbook is quick way to get a snapshop what kind of alerts you have in your environments.

It shows alert count by the severity
Resource groups where those alerts are
Alerts by the tag (if there are any)
Top 5 attacked resource by the severity
Top alert types
New alerts within 24 hours
Alerts sorted by the Mitre Att&ck tactics
Also list view & map view of alerts (not shown in images)

Click images to get a bigger picture:

Download CSV report

As the link says you can download the Security alerts as a CSV report. There are more informations as this clip shows:

Guides & Feedback

When you click Guides & Feedback link portal opens the side panel where you can see Useful links and Community tools sections.

Useful links

Security alerts and incidents – Microsoft Defender for Cloud | Microsoft Learn

Reference guide for security alerts – Microsoft Defender for Cloud | Microsoft Learn

Manage and respond to security alerts – Microsoft Defender for Cloud | Microsoft Learn

Community tools from GitHub

Also some community tools from Microsoft Azure’s Defender for Cloud GitHub repo.

Section 2 - Alerts status and classifications

This is just a static image of alert status (I mean there are no links), how many resources those alerts are affected and open alerts by the severity. Thought it’s static it updates automatically by the system.

Section 3 - Search & Filters

Search

You can write to Search box what would you like to find.

Subscription

You can select which subscription you want to search the alerts.

Other filters

You can choose from the filter dropdown what you want to search:

Section 4 - Results

Security alert results are based on what you choose above. In my case and the default columns are Severity

Alert name
Affected resource
Resource Group
Activity Start Time
MITRE ATT&CK tactics
Status

How to manage the alerts?

You can manage alerts different ways but let’s focus to manage in Defender for Cloud.

Like I wrote before you change the alert status by selecting the checkbox in front of Alert Severity and from the top of the panel from the drop down list with title Change Status.

If you click the alert name the alert opens to side panel:

Review the high-level information about the security alert.

- Alert severity, status, and activity time
- Description that explains the precise activity that was detected
- Affected resources
- Kill chain intent of the activity on the MITRE ATT&CK matrix (if applicable)

Full details

If you click the view full details button you can see everything from the selected alert.

Take action

After investigating a security alert, you can respond to the alert. By clickin the take action button you will see the remediate actions.

In this case there are six different sections to help the case:

Inspect resource context. Since this is a sample alert there are no logs available but in real case there could be.
Mitigate the threat. Some short guides what to do. Also if there are any other alerts regarding to that resource those alerts can be seen clicking the link.
Prevent future attacks. If there are security misconfigurations in resources you should fix those to prevent similar alerts in the future.
Trigger automated response. You can use logic apps to automate the response to alert and therefore reduce the attack surface.
Suppress similar alerts. It’s possible to create suppression rules to automatically remediate the alerts.
Configure email notification settings. You can set email notifications to who and in which conditions alert notification emails are send.

Finally when you complete the investigation into the alert and responded in the appropriate way, change the status to Dismissed.

Email notification about Security alerts

As a default Microsoft sends email about security alerts if you have defined them in Environment settings.

A sample email below:

To set those email notifications go to Environment Settings, choose the wanted subscription and then click Email notifications and set email:

Here was a presentation of Security Alerts. Hope you get the idea of it. The part is the Attack path analysis. Stay tuned.

The parts of the MDC blog series

Jussi Metso

Author is a a lifelong IT enthusiast, Microsoft Security MVP and interested in Cloud Security, XDR, SIEM and AI. Motto: Learning is the key for your future.

Share on Social Media

Discover more from Jussi Metso

Subscribe to get the latest posts sent to your email.

DEFENDER FOR CLOUD #cloudsecurity #mdcseries

Table of Contents