Summary
Over the course of this module, you explored the security capabilities of Azure Arc-enabled servers. You explored security services including Microsoft Defender for Cloud, Microsoft Defender for Servers, and Microsoft Sentinel. These services offer improved visibility, threat intelligence, and help customers like Tailwind Traders to ensure regulatory compliance.
First, you explored the capabilities of Microsoft Defender for Cloud across continuous assessment, securing, and defending resources. Next, you learned about onboarding Azure Arc-enabled servers to Defender for Cloud. Additionally, you learned about Microsoft Defender for Servers' enhanced security features. Finally, you learned about Microsoft Sentinel's SIEM and SOAR functionalities.
Tailwind Traders' compute infrastructure is multicloud and hybrid. Azure Arc-enabled servers offer a powerful way to streamline and improve security across your organization's infrastructure. Microsoft's security solutions aren't limited to Azure. Through Azure Arc, you can extend them across your digital estate.
More info
Use these resources to review prerequisites, follow detailed procedures, and explore the security capabilities covered in this module.
Azure Arc and portal access
Review Azure Arc deployment requirements and access the management portals:
- Azure Arc overview
- Azure Arc-enabled servers overview
- Azure Arc-enabled servers deployment
- Azure Connected Machine agent deployment options
- Azure Arc supported operating systems
- Azure Arc network requirements
- Azure portal
- Microsoft Defender portal
Defender for Cloud configuration and compliance
Use this guidance to configure permissions, assess compliance, and connect multicloud resources:
- Implement security recommendations
- MCSB in Defender for Cloud
- Regulatory compliance standards
- Default compliance standards
- Defender for Cloud permissions
- Security Admin role definition
- Connect your AWS account
- Connect your GCP project
- Defender for Cloud release notes
- Manage plans in the Defender portal
- Operating-system misconfiguration guidance
- Defender for Containers support matrix
Defender for Servers protections
Review plan coverage, enable endpoint protection, and configure server security features:
- Defender for Servers overview and plan comparison
- Enable Defender for Servers
- Defender for Servers support matrix
- Enable Defender for Endpoint integration
- Defender for Endpoint integration prerequisites
- Defender for Endpoint deployment and verification by platform
- Vulnerability assessment collection methods
- Agentless collection architecture
- Set up integrated vulnerability assessment
- Defender Vulnerability Management remediation requests
- Enable file integrity monitoring
- Enable file integrity monitoring in the Azure portal
- Review file integrity monitoring changes
- Windows security alerts overview
- Alerts for Windows machines
- Azure Update Manager overview
- Microsoft Defender for Cloud pricing
Windows application security
Use these resources to plan application-control policies, attack surface reduction rules, and audit settings:
- App Control for Business
- App Control for Business feature availability
- App Control for Business deployment guide
- Use audit events to create App Control policy rules
- Attack surface reduction overview
- Attack surface reduction rules overview
- Windows audit-policy guidance
Microsoft Sentinel setup and operations
Review Sentinel prerequisites, configure connectors, and prepare for the Defender portal experience:
- Microsoft Sentinel overview
- Microsoft Sentinel Azure portal retirement timeline
- Microsoft Sentinel onboarding
- Microsoft Sentinel prerequisites
- Microsoft Sentinel workspace requirements
- Microsoft Sentinel roles
- Microsoft Sentinel roles for specific tasks
- Onboard Microsoft Sentinel to the Defender portal
- Microsoft Sentinel transition guide
- Analytics changes in the Defender portal
- Connector changes after moving to Defender
- What's new in Microsoft Sentinel
- Collect Windows security events
- Windows security event sets
- Configure Syslog and CEF ingestion
- Cross-workspace queries
- Microsoft Defender ATP connector
- Microsoft Sentinel pricing
Azure Monitor Agent and data collection
Use these references to configure agents and collection rules, verify ingestion, and interpret query results:
- Azure Monitor Agent requirements
- Azure Monitor Agent supported operating systems
- Azure Monitor Agent network configuration
- Verify AMA installation
- Create and edit data collection rules
- Windows event collection with Azure Monitor Agent
- Local Syslog collection with Azure Monitor Agent
- Standard log columns
- Syslog table schema