Book Image

Microsoft Defender for Cloud Cookbook

By : Sasha Kranjac
Book Image

Microsoft Defender for Cloud Cookbook

By: Sasha Kranjac

Overview of this book

Microsoft Defender for Cloud is a multi-cloud and hybrid cloud security posture management solution that enables security administrators to build cyber defense for their Azure and non-Azure resources by providing both recommendations and security protection capabilities. This book will start with a foundational overview of Microsoft Defender for Cloud and its core capabilities. Then, the reader is taken on a journey from enabling the service, selecting the correct tier, and configuring the data collection, to working on remediation. Next, we will continue with hands-on guidance on how to implement several security features of Microsoft Defender for Cloud, finishing with monitoring and maintenance-related topics, gaining visibility in advanced threat protection in distributed infrastructure and preventing security failures through automation. By the end of this book, you will know how to get a view of your security posture and where to optimize security protection in your environment as well as the ins and outs of Microsoft Defender for Cloud.
Table of Contents (12 chapters)

Chapter 3: Workflow Automation and Continuous Export

In this chapter, you will learn how to configure Microsoft Defender for Cloud workflow automation, configure continuous data export, and automate Microsoft Defender for Cloud responses.

Although automation is great and very useful, since it reduces security administrator fatigue and greatly shortens the time to react to events and potential threats, it is of the utmost importance to know that you should not automate everything immediately. Automation needs to be planned, and a decision to automate, especially if it concerns security, needs to be justified and developed over time.

Enabling automation just to reduce or eliminate work could make an environment less secure, so some tasks need to remain manual to ensure you can detect potential exposure.

We will cover the following recipes in this chapter:

  • Creating logic apps for use in Microsoft Defender for Cloud
  • Automating threat detection alert responses
  • ...