Book Image

Mastering Windows Security and Hardening - Second Edition

By : Mark Dunkerley, Matt Tumbarello
5 (1)
Book Image

Mastering Windows Security and Hardening - Second Edition

5 (1)
By: Mark Dunkerley, Matt Tumbarello

Overview of this book

Are you looking for the most current and effective ways to protect Windows-based systems from being compromised by intruders? This updated second edition is a detailed guide that helps you gain the expertise to implement efficient security measures and create robust defense solutions using modern technologies. The first part of the book covers security fundamentals with details around building and implementing baseline controls. As you advance, you’ll learn how to effectively secure and harden your Windows-based systems through hardware, virtualization, networking, and identity and access management (IAM). The second section will cover administering security controls for Windows clients and servers with remote policy management using Intune, Configuration Manager, Group Policy, Defender for Endpoint, and other Microsoft 365 and Azure cloud security technologies. In the last section, you’ll discover how to protect, detect, and respond with security monitoring, reporting, operations, testing, and auditing. By the end of this book, you’ll have developed an understanding of the processes and tools involved in enforcing security controls and implementing zero-trust security principles to protect Windows systems.
Table of Contents (21 chapters)
1
Part 1: Getting Started and Fundamentals
7
Part 2: Applying Security and Hardening
15
Part 3: Protecting, Detecting, and Responding for Windows Environments

Collecting telemetry with Azure Monitor Logs

Azure Monitor Logs, also known as Azure Log Analytics, is a data collection repository and analysis tool that supports Windows systems and many other resources and services running in Azure. The log data that is collected is stored in a repository known as 
a Log Analytics workspace, where it can be parsed and analyzed using the Kusto Query Language (KQL). Log Analytics workspaces are used to power dashboards in Azure Workbooks, feed Azure Monitor to aggregate performance data, and provide many other telemetry-driven solutions. Log Analytics workspaces are also used to source data for analysis in security solutions such as Defender for Cloud, Azure Sentinel, and other SIEMs through API connections. A few examples of the data that can be sent into Log Analytics from Windows systems are as follows:

  • Windows event logs such as application, system, and security event logs
  • Windows performance counters such as memory and processor...