Chapter 15
The first consideration in our monitoring solution is which additional products, over and above the basic monitoring and logging, we will use. The ability to monitor for threats can be achieved using Azure Defender; however, if we want to be able to better respond to these threats, especially in an automated fashion, we require an advanced SIEM such as Azure Sentinel.
Azure Sentinel requires a Log Analytics workspace for capturing logs and metrics, and therefore the next step is to decide how we would structure this. For example, do we use a single workspace or multiple workspaces?
As security and overall health monitoring are managed by a single team, the best option would be to use a single workspace. However, as each division is responsible for their own solutions, we should additionally send the logs they need to their own individual workspaces as well. This can be configured on each Azure component.
Finally, to help control costs on proof-of-concept systems, we...