Friday Five: Azure Sentinel, Power Automate, More!

by Contributed | Dec 4, 2020 | Azure, Microsoft, Technology

This article is contributed. See the original author and article here.

The UP Podcast with Lisa Crosbie & Megan V. Walker 

Lisa Crosbie and Megan V. Walker are Business Application MVPs. With Lisa in Australia and Megan in the United Kingdom, the pair thought it was a great idea to start a podcast together about Microsoft Business Applications, the Power Platform, Dynamics 365, and Microsoft technologies. The UP Podcast shares what is new and exciting, highlights community content,  and seeks to share and learn with the audience. Follow on Twitter @LisaMCrosbie, @MeganVWalker, @the_UP_podcast.

How to automatically re-enable flow using Power Automate

Hiroaki Nagao is a Business Applications MVP from Japan. Currently working as a system administrator in an operating company, Hiroaki is a core member of the local Power Apps / Power Automate community. A regular blogger with more than 100 posts this year, find more on his blog or Twitter @mofumofu_dance

Engage Your Audience with Forms Polls in Microsoft Teams Meetings

Matti Paukkonen is an Office Apps & Services MVP and Modern Work Architect from Finland. He has more than 10 years’ experience of Microsoft collaboration solutions, like SharePoint, Microsoft Teams and Microsoft 365. He writes technical blog articles, organizes a local Teams User Group, and participates on several communities and speaks on events. Follow him on Twitter @mpaukkon.

Azure Sentinel: Connecting the Enterprise Firewalls

John Joyner is an inventor, author, speaker, and professor on datacenter and enterprise cloud computing topics. John, who has been named as an MVP for the past twelve years, teaches a cloud computing management course at the University of Arkansas. For more, check out his Twitter @john_joyner

ML.NET Model Builder: Getting Started (using ASP.NET Core)

Syed Shanu is a Microsoft MVP, a two-time C# MVP and two-time Code project MVP. Syed is also an author, blogger and speaker. He’s from Madurai, India, and works as Technical Lead in South Korea. With more than 10 Years of experience with Microsoft technologies, Syed is an active person in the community and always happy to share his knowledge on topics related to ASP.NET , MVC, ASP.NET Core, Web API, SQL Server, UWP, Azure, among others. You can see his contributions to MSDN and TechNet Wiki here. Follow him on Twitter @syedshanu3.   

Security Controls in Azure Security Center: Apply adaptive application control

by Contributed | Dec 3, 2020 | Azure, Microsoft, Technology

This article is contributed. See the original author and article here.

As part of our recent Azure Security Center (ASC) Blog Series, we are diving into the different controls within ASC’s Secure Score.  In this post we will be discussing the control of “Apply Adaptive Application control”.  

This security control contains up to 7 recommendations, depending on the resources you have deployed within your environment, and it is worth maximum of 1 point (2%) that counts towards your overall Secure Score. To understand about Azure Security Center’s secure score make sure you read this article. These recommendations are meant to keep your resources safe and improve your security hygiene.

Apply adaptive application control contains the following 7 recommendations, depending on your environment:

• Log Analytics agent should be installed on your virtual machine 


• Monitoring agent should be installed on your machines


• Log Analytics agent should be installed on your Windows-based Azure Arc machines


• Log Analytics agent should be installed on your Linux-based Azure Arc machines 


• Log Analytics agent health issues should be resolved on your machines 


• Adaptive application controls for defining safe applications should be enabled on your machines 


• Allowlist rules in your adaptive application control policy should be updated 

The example screenshot below shows an environment in which only 6 of those 7 recommendations are within the scope of Apply adaptive application control security control, because the recommendations which do not apply to any resource within your environment do not appear.  

Image 1 – Recommendations within the Apply adaptive application control

Like the rest of the Secure Score controls, all these recommendations must be considered in order to get the full points and drive up your Secure Score (you can review all of the recommendations here). Also, some might have a “Quick Fix!” button as well!  No excuses not to enable those, it simplifies remediation and enables you to quickly increase your secure score, improving your environment’s security. To understand how Quick Fix works, please make sure to visit here  

Category #1: Log Analytics agent should be installed on your virtual machine

To monitor for security vulnerabilities and threats, Azure Security Center depends on the Log Analytics Agent. The agent collects various security-related configuration details and event logs from connected machines, and then copies the data to your Log Analytics workspace for further analysis. Without the agent, Security Center will not be able to collect security data from the VM and some security 

recommendations and alerts will be unavailable and within 24hrs, Security Center will determine that the VM is missing the extension and recommends you to install it via this security control. You could manually install the agent with the help of this recommendation or If you have auto-provisioning turned on, when Security Center identifies missing agent, it installs the extension automatically which in-turn reduces management overhead. Refer to this article to understand deployment options. Several questions arise at this point for scenarios like, how auto provisioning works in cases where there is already an agent installed and to understand that please read this information.

The following recommendations belong to this category:

• Monitoring agent should be installed on your machines.


• Log Analytics agent should be installed on your Windows-based Azure Arc machines. This recommendation applies to Windows-based Azure Arc machines


• Log Analytics agent should be installed on your Linux-based Azure Arc machines. This recommendation applies to Linux-based Azure Arc machines

Alternatively, to fix this recommendation, you can visit our Github Repository and leverage the automations we have published there.  

Category #2: Log Analytics agent health issues should be resolved on your machines

You’ll notice this recommendation when Azure Security Center finds Log Analytics agent unhealthy which means, a VM is unmonitored by Security Center since the VM does not have healthy Log Analytics agent extension. This could be due to several reasons, one of it could be the agents are not able to connect to and register with Security Center due to no access to the network resources. Read more about this scenario here. To fully benefit from all of Security Center’s capabilities, the Log Analytics agent extension is required.

For more information about the reasons Security Center is unable to successfully monitor VMs and computers initialized for automatic provisioning, see Monitoring agent health issues.

NOTE: The above recommendations (Category #1 and #2) to install the agent and recommendation about agent health issues are pre-requisites. You might observe these recommendations also show up in a different security control, and if they were remediated there, it will not appear here in this Security control.

Category #3: Adaptive application controls for defining safe applications should be enabled on your machines

Application allowlist is not necessarily a new concept. One of the biggest challenges of dealing with the application allowlist is how to maintain that list. The traditional approach of using AppLocker in Windows is a good solution, but still has the overhead of keeping up with the applications and making the initial baseline work properly for our needs.

Adaptive application controls is one of the advanced protection features you can benefit from, when you upgrade to Azure Defender ON, this falls under the cloud Workload Platform Protection (CWPP).

Adaptive application controls help to harden your VMs against malware by making it easier to control which applications can run on your Azure VMs. Azure Defender has built-in intelligence that allows you to apply allowlist rules based on machine learning. This intelligence analyzes the processes that are running in your VMs, creates a baseline of applications, and groups the virtual machines. From here, recommendations are provided that allow you to automatically apply the appropriate allowlist rules. The use of machine learning intelligence makes it super simple to configure and maintain application the allowlist.

With this feature, you’re able to alert on or audit . These can even be malicious applications that might otherwise be missed by endpoint protection solutions, or applications with known vulnerabilities. By default, Azure Defender enables application control in Audit mode. No enforcement options are available at this time of writing.

Adaptive Application Control do not support Windows machines for which AppLocker policy is already enabled by either group policy objects (GPOs) or Local Security policy.

Hope this helps you understand why it is super important for you to enable them. Learning about Adaptive Application Control is essential for anyone looking to gain more granular control and security within their environment, so make sure to read our documentation.

Category #4: Allowlist rules in your adaptive application control policy should be updated

This recommendation will be displayed when Azure Defender’s machine learning identifies potentially legitimate behavior that hasn’t previously been allowed. This recommendation suggests you to add new rules to the existing policy to reduce the number of false positives in adaptive application controls violation alerts. To edit the application control policy please refer to this for more information.

Next Steps

As with all security controls, you need to make sure to remediate all recommendations within the control that apply to a particular resource in order to gain credit towards your secure score.

I hope you enjoyed reading this blog post as much as I enjoyed writing it and learned how this specific control can assist you to strengthen your Azure security posture.

• The main blog post to this series (found here)


• The DOCs article about Secure Score (this one) 

Reviewer

Special Thanks to @Yuri Diogenes, Principal Program Manager in the CxE ASC Team for reviewing this article.