Microsoft Defender for Cloud

Defender for Cloud is a monitoring tool for security posture management and threat protection.
It monitors your cloud, on-premises, hybrid, and multicloud environments to provide guidance and notifications aimed at strengthening your security posture.
Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyber attacks, and streamline security management.
Deployment of Defender for Cloud is easy, it’s already natively integrated to Azure.
When necessary, Defender for Cloud can automatically deploy a Log Analytics agent to gather security-related data.

Protection for Every Environment

Defender for Cloud is an Azure-native service, many Azure services are monitored and protected without needing any deployment.
For Azure machines, deployment is handled directly.
For hybrid and multicloud environments, Microsoft Defender plans are extended to non Azure machines with the help of Azure Arc.
Cloud security posture management (CSPM) features are extended to multicloud machines without the need for any agents.

You can add Defender for Cloud capabilities to your hybrid cloud environment to protect your non-Azure servers.
To extend protection to on-premises machines, deploy Azure Arc and enable Defender for Cloud's enhanced security features.

Defender for Cloud can also protect resources in other clouds (such as AWS and GCP). Defender for Cloud's CSPM features extend to your AWS resources.
Defender for Containers brings threat detection and advanced defenses to your Amazon EKS Linux clusters.
Defender for Servers brings threat detection and advanced defenses to your Windows and Linux EC2 instances.

Networks:
- Defender for Cloud helps you limit exposure to brute force attacks.
- You can harden your network by preventing unnecessary access.
- Reducing access to virtual machine ports, using the just-in-time VM access
- You can set secure access policies on selected ports, for only authorized users, allowed source IP address ranges or IP addresses, and for a limited amount of time.
Azure PaaS services:
- Detect threats targeting Azure services including Azure App Service, Azure SQL, Azure Storage Account, and more services.
- You can also perform anomaly detection on your Azure activity logs using the native integration with Defender for Cloud Apps (formerly known as Microsoft Cloud App Security).
Azure data services:
- Defender for Cloud includes capabilities that help you automatically classify your data in Azure SQL.
- You can also get assessments for potential vulnerabilities across Azure SQL and Storage services, and recommendations for how to mitigate them.

Defender for Cloud fills three vital needs
- Continuously assess – Know your security posture. Identify and track vulnerabilities.
- Secure – Harden resources and services with Azure Security Benchmark.
- Defend – Detect and resolve threats to resources, workloads, and services.

Defender for cloud helps you continuously assess your environment.
Defender for Cloud includes vulnerability assessment solutions for your virtual machines, container registries, and SQL servers.
Defender for servers includes automatic, native integration with Defender for Endpoint. With this integration enabled, you'll have access to the vulnerability findings from Microsoft threat and vulnerability management.
From these assessment tools you’ll have regular, detailed vulnerability scans that cover your compute, data, and infrastructure. You can review and respond to the results of these scans all from within Defender for Cloud.

To secure your workloads, you need security policies in place that are tailored to your environment and situation.
In Defender for Cloud, you can set your policies to run on management groups, across subscriptions, and even for a whole tenant.
Defender for Cloud is constantly monitoring for new resources being deployed across your workloads. Defender for Cloud assesses if new resources are configured according to security best practices. If not, they're flagged and you get a prioritized list of recommendations for what you need to fix.
The list of recommendations is enabled and supported by the Azure Security Benchmark.
Microsoft-authored, Azure-specific, benchmark provides a set of guidelines for security and compliance best practices based on common compliance frameworks.
Defender for Cloud allows you to apply secure configuration standards across your resources.
Defender for Cloud groups the recommendations into security controls and adds a secure score value to each control. The secure score gives you an at-a-glance indicator of the health of your security posture, while the controls give you a working list of things to consider to improve your security score and your overall security posture.

Defender for Cloud also helps you defend your environment by providing
- Security alerts and
- Advanced threat protection features.
When Defender for Cloud detects a threat in any area of your environment, it generates a security alert.
Security alerts
- Describe details of the affected resources
- Suggest remediation steps
- Provide, in some cases, an option to trigger a logic app in response
Defender for Cloud's threat protection includes fusion kill-chain analysis, which automatically correlates alerts in your environment based on cyber kill-chain analysis, to help you better understand the full story of an attack campaign, where it started, and what kind of impact it had on your resources.
Provides advanced threat protection features for many of your deployed resources, including
- Virtual machines,
- SQL databases,
- Containers,
- Web applications, and your
- Network.
Defender for cloud provides advanced threat protection include
- Securing the management ports of your VMs with just-in-time access, and
- Adaptive application controls to create allowlists for what apps should and shouldn't run on your machines.