Book Image

Azure Architecture Explained

By : David Rendón, Brett Hargreaves
Book Image

Azure Architecture Explained

By: David Rendón, Brett Hargreaves

Overview of this book

Azure is a sophisticated technology that requires a detailed understanding to reap its full potential and employ its advanced features. This book provides you with a clear path to designing optimal cloud-based solutions in Azure, by delving into the platform's intricacies. You’ll begin by understanding the effective and efficient security management and operation techniques in Azure to implement the appropriate configurations in Microsoft Entra ID. Next, you’ll explore how to modernize your applications for the cloud, examining the different computation and storage options, as well as using Azure data solutions to help migrate and monitor workloads. You’ll also find out how to build your solutions, including containers, networking components, security principles, governance, and advanced observability. With practical examples and step-by-step instructions, you’ll be empowered to work on infrastructure-as-code to effectively deploy and manage resources in your environment. By the end of this book, you’ll be well-equipped to navigate the world of cloud computing confidently.
Table of Contents (20 chapters)
1
Part 1 – Effective and Efficient Security Management and Operations in Azure
5
Part 2 – Architecting Compute and Network Solutions
12
Part 3 – Making the Most of Infrastructure-as-Code for Azure

Mitigating lateral movements

We can use Microsoft Defender for Identity, which includes a mechanism to detect lateral movements, and a powerful alternate method to remediate lateral movements is by configuring Fusion in Microsoft Sentinel, a correlation engine to detect multistage attacks automatically.

Fusion is a powerful engine integrated with Microsoft Sentinel that identifies combinations of anomalous behaviors and malicious activities observed at different kill chain stages.

Microsoft Sentinel can generate incidents with multiple alerts or activities, and Fusion will correlate all signals from various products and detect advanced attacks. Fusion detections will be shown as Fusion incidents on the Microsoft Sentinel Incidents page. Fusion incidents are stored in the SecurityIncident table in Logs.

How can we enable Fusion? It is enabled as an analytics rule and can help us cover a variety of scenarios, such as the following:

  • Compute resource abuse
  • Credential...