Microsoft announces a slew of security enhancements for Azure

mood · Nov 4, 2019

Microsoft announces a slew of security enhancements for Azure
November 4, 2019
https://www.neowin.net/news/microsoft-announces-a-slew-of-security-enhancements-for-azure

To further protect its Azure customers, Microsoft has announced a variety of security-related enhancements for the platform - and Security Center in particular - at Ignite 2019.
Azure Sentinel
First up is better threat protection for cloud resources by way of Azure Sentinel, the security information and event management (SIEM) offering from Microsoft's cloud. This means that any threat can be investigated, hunted and correlated with other signals quicker.

Sentinel also now has built-in hunting queries for Linux and network events, the ability to launch Azure Notebooks straight from the SIEM solution, and new analytics and investigation tools to offer better insights on suspicious URLs.
Azure Security Center
At the conference, the Redmond giant has also announced that Security Center is getting a number of enhancements, including workflow automation using Azure Logic Apps, better integrations with continuous export, better alerts and recommendations, onboarding of on-premises services to Security Center via Admin Center, and Azure Security Center Community. The last one is a centralized GitHub that's open to contributors.
Click to expand...

Azure Firewall Manager (public preview)
Last but not least is Firewall Manager - now available in public preview -, which is a "cloud-native firewall-as-a-service" capability. It allows enterprise clients to govern and log traffic flows using a DevOps approach. It supports application and network-level filtering rules and it integrates with the Microsoft Threat Intelligence feed.
Click to expand...

mood · Aug 9, 2021

Microsoft adds Fusion ransomware attack detection to Azure Sentinel
August 9, 2021
https://www.bleepingcomputer.com/ne...ansomware-attack-detection-to-azure-sentinel/

Microsoft says that the Azure Sentinel cloud-native SIEM (Security Information and Event Management) platform is now able to detect potential ransomware activity using the Fusion machine learning model.
Azure Sentinel uses built-in artificial intelligence (AI) technology to quickly analyze vast volumes of data across enterprise environments, hunting for potential threat actor activity.

Microsoft announced today that its cloud-based SIEM now supports Fusion detections for possible ransomware attacks and triggers high severity Multiple alerts possibly related to Ransomware activity detected incidents.
Click to expand...

Admins advised to consider systems as 'potentially compromised'

"Incidents are generated for alerts that are possibly associated with Ransomware activities, when they occur during a specific time-frame, and are associated with the Execution and Defense Evasion stages of an attack," Microsoft explains.
"You can use the alerts listed in the incident to analyze the techniques possibly used by attackers to compromise a host/device and to evade detection."
Click to expand...

Log in or Sign up

Microsoft announces a slew of security enhancements for Azure

mood Updates Team

mood Updates Team