Yuri Diogenes's Blog https://docs.microsoft.com/archive/blogs/yuridiogenes/feed.xml Thoughts from a Senior Program Manager @ Microsoft C+AI Security CxE Team Thu, 28 Mar 2019 15:35:18 GMT en-US hourly 1 2018: Azure Security Center Year in Review https://docs.microsoft.com/archive/blogs/yuridiogenes/2018-azure-security-center-year-in-review Mon, 31 Dec 2018 09:22:14 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=8235 February Azure Security Center—advanced prevention and threat detection April GUID migration: Azure Security Center GUID migration: Azure Security Center, US Government regions May GUID migration: Azure Security Center unit-of-measure change July Azure Security Center update July 22 Azure Security Center update July 1 August Configure just-in-time virtual machine access from the VM blade September Azure Security Center innovations now available in preview October Azure Security Center update September 2018 Azure Security Center update - Ignite 2018 November Azure Security Center update - November Security Center Workload Protection for App Service name changes December Azure portal December 2018 update That's a long list, but still a lot to come in 2019, and I'm looking forward to see the evolution of Azure Security Center. Also, I would like to take this opportunity to say thanks to all readers of the Azure Security Center book from Microsoft Press. During Thanksgiving week we were number one at Microsoft Press Store: In September we were number two in the Amazon Best Sellers: In June we were number one in the Amazon Hot New Releases list: Note: We have great plans for this book in 2019, stay tuned! Thanks for the great year, and happy new year to you all!!  ]]> Auditing Changes in Azure Security Center Configuration https://docs.microsoft.com/archive/blogs/yuridiogenes/auditing-changes-in-azure-security-center-configuration Fri, 07 Dec 2018 11:42:49 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=8125 Permissions in Azure Security Center article for more information about the key roles and the actions that these roles can perform. A question that comes up very often is: how can I check who changed my Security Center configuration? Let’s use a very simple example: I noticed that my security contact information only has one email, and used to be three. When that happen? To investigate when this change took place, you can use Azure Activity Log. For this particular case, you should see an entry similar to the one below: If you click in the Delete security contact action that succeeded, you will have access to the JSON content, and there you will be able to see more info regarding who performed this action and when it was done. The use of Activity Log can be also very useful to see who made changes in the Azure Security Center Security Policy. Let’s use as an example the policy below. This policy in the past was configured as AuditIfNotExists and now is showing as disabled: Again, you want to understand: when this change was done and who did it. Using Azure Activity Log, looks for the operation below: Note: if you have a lot of activities, you should add a filter where Operation is Create policy assignment. Open the JSON for this operation, and there investigate the requestbody, and you will see that the MFA policy that was changed to disabled is there:  ]]> Holistic Approach to Enhance your Security Posture https://docs.microsoft.com/archive/blogs/yuridiogenes/holistic-approach-to-enhance-your-security-posture Thu, 08 Nov 2018 14:07:57 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=8105 Holistic Approach to Enhance your Security Posture. In this article I cover some important capabilities that must be in place to enhance the overall security posture of your organization. This is a vendor neutral approach, that will give you the general considerations and rationale behind each choice. If you are an ISSA member, you can download the magazine below in PDF: If you are not member, you can download the PDF of my article from here.]]> Failed to connect to mdsd error in a Linux machine monitored by Azure Security Center https://docs.microsoft.com/archive/blogs/yuridiogenes/failed-to-connect-to-mdsd-error-in-a-linux-machine-monitored-by-azure-security-center Mon, 22 Oct 2018 14:49:48 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=8085 Some customers are already monitoring Linux machines using Security Center for a quiet sometime, many of them just want to visualize security recommendations for Linux platform. Some Linux machines monitored by Security Center, may experience the error described in the title of this blog post, this error appears in the log as shown below: XXXX : Failed to connect to mdsd: dial tcp 127.0.0.1:29130: getsockopt: connection refused XXXX : ERR: Failed to connect to mdsd: dial tcp 127.0.0.1:29130: getsockopt: connection refused In the past, Azure Security Center used the LinuxASM extension to perform data collection in Linux, and now it uses the OMS Agent for Linux. This error in the log may indicate that the LinuxASM extension is still installed. You should uninstall this extension, and make sure that only the OMSAgentForLinux is installed as shown below: If ASC is configure for Auto Provision, the agent will get installed automatically, if not you can use the steps from this article to manually onboard a Linux machine. Keep in mind that now is not only about using ASC to highlight the security posture of your Linux machines, at Ignite we announced that threat detection for Linux is now available in Azure Security Center. Our team recently released a new Linux detections playbook that allows you to test some of these detections and experience the alerts that will generate.  ]]> Unable to start Azure ATP Service https://docs.microsoft.com/archive/blogs/yuridiogenes/unable-to-start-azure-atp-service Fri, 14 Sep 2018 10:55:41 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=8065 Take in consideration a scenario where you deployed Azure ATP, and after the service has worked for some time, one day the service Azure Advanced Threat Protection Sensor keeps on Starting, and after some time it quits (doesn’t show any status), it comes back to Starting, and keeps on this loop. If you go to event viewer, you an event like this one: Log Name:      System Source:        Service Control Manager Date:          9/14/2018 10:32:52 AM Event ID:      7031 Task Category: None Level:         Error Keywords:      Classic User:          N/A Computer:      BRUTOS.fabrikam.com Description: The Azure Advanced Threat Protection Sensor service terminated unexpectedly.  It has done this 18 time(s).  The following corrective action will be taken in 5000 milliseconds: Restart the service. The next step in this type of situation is to look at the “Microsoft.Tri.sensor-Errors.log” file located in the “%programfiles%\Azure Advanced Threat Protection sensor\Version X\Logs” folder. Once you review this file, you may see something like this: 2018-09-14 15:35:50.9871 Error DirectoryServicesClient+<CreateLdapConnectionAsync>d__34 Microsoft.Tri.Infrastructure.ExtendedException: Failed to connect to domain controller [DomainControllerDnsName=BRUTOS.fabrikam.com ErrorCode=49] ---> System.DirectoryServices.Protocols.LdapException: The supplied credential is invalid. Yep, that’s ritght, it was the credential, and you know why? Because the account that it was created and used on step 2 of the Azure ATP deployment changed the password. Every time you change this account's password, you need to update the user's information on Azure ATP Portal, under Directory Services as shown below:   Lesson learned: it is imperative to always change your password, and change it according to your company’s password policy, however make sure to also update the account's information on Azure ATP portal, otherwise you will face a similar issue.]]> Exploring Microsoft Antimalware Alert in Azure Security Center https://docs.microsoft.com/archive/blogs/yuridiogenes/exploring-microsoft-antimalware-alert-in-azure-security-center Mon, 20 Aug 2018 10:45:32 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=8015 Azure Security Center leverages Microsoft Antimalware engine to trigger antimalware related alerts such as the one shown below: While this alert brings awareness about the current threat status, which in this case it was remediated, sometimes you want to know more information about the threat itself (threat name, process, etc). You can use the Search functionality in Security Center to launch Log Analytics and query your workspace for more information on that. Follow the steps below to do that: 1. Click Search in Security Center dashboard 2. Select the workspace that you are using. 3. Under the Run button, click Advanced Analytics option. 4. Click the plus sign to open a new tab: Now you can start your query by using the sample below: ProtectionStatus | where ThreatStatus contains "remediate"  Keep in mind that this query’s result might be long, and ideally you should also filter by computer’s name to narrow it down to the computer you want to know more details about the threat that was remediated. Also, there are many columns available in this table, if you want to focus only on the relevant ones, change your query to: ProtectionStatus | where Computer contains "WS2016VM" | where ThreatStatus contains "remediate"  | project DeviceName , Threat , ThreatStatus , ThreatStatusDetails , ThreatStatusRank , ProtectionStatus , ProtectionStatusRank , ProtectionStatusDetails Here an example of this output: Notice that the output for ThreatStatusRank and ProtectionStatusRank are numbers. These numbers have specific meaning. Use the table below as reference to interpret those numbers:
Threat Status Rank
Active 550
Unknown 470
Remediated 370
Quarantined 350
Blocked 330
Allowed 250
No threats detected 150
 
Protection Status Rank
Threat Detected 550
Unknown 470
Not Reporting 450
Action Required 350
No real time protection 270
Signatures out of date 250
Real time protection 150
  The rank is grouped into segments:
  • 100s = protection in place
  • 200s = some, but insufficient protection in place
  • 300s = action required to remediate a threat
  • 400s = action required to collect data
  • 500s = infection found
Conclusion As you could see througout this post, using Azure Security Center to visualize antimalware alerts is good, but if you need to dig deeper and better understand what that alert was about, you can leverage Log Analytics to search those alerts. If you want to test this on a lab environment, make sure to use our security alerts playbook. One of the steps on this security playbook is to download EICAR malware test file, and once you perform this action, you should be able to see an alert similar to the one showed in this post.]]> Using Azure Monitor to send an Email Notification for Azure Security Center Alerts https://docs.microsoft.com/archive/blogs/yuridiogenes/using-azure-monitor-to-send-an-email-notification-for-azure-security-center-alerts Wed, 01 Aug 2018 11:46:48 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=7985 Security Alerts, keep in mind that these notification will be sent only on the first daily occurrence of a high severity alert. You can read Provide security contact details in Azure Security Center for more information on how to configure this option. However, if you want to receive an email for every single alert that pops up in Azure Security Center, you can use Azure Monitor . Processed events produced by Azure Security Center are published to the Azure Activity log, and via Azure Monitor you can create classic activity log alerts. This streaming log alert is triggered when an activity log event is generated that matches filter criteria that you've assigned. The diagram below shows the flow from Azure Security Center to Azure Monitor: Now that you understand the flow, follow the steps below to configure this integration: 1. Create an Azure Monitor Rule
  • You can create a classic rule using the procedure from this article.
    • Make sure to customize at least this setting:
      • Under Criteria / Event Category, select Security.
    • Read this article to see an example of the Activity Log Schema for Security category.
2. Simulate an alert When the alert is fired, you will receive an email (if this is the action that you selected) similar to the one below: When reviewing this email, you should review all fields, but pay close attention to the following ones:
  • Activity Log Alert: the severity of the alert (in this case is High)
  • Time: the time that the alert was generated
  • Properties: this field will bring the entire lert that you see in Security Center, noticed that within this field, there are other fields, such as resourceType, compromisedEntity, and others. Although they are all in a single paragraph, it is easy to compreehend.
Thank you Kelly Anderson and Gilad Elyashar for reviewing this post!  #TeamWork]]> Recap of Microsoft Inspire + Ready https://docs.microsoft.com/archive/blogs/yuridiogenes/recap-of-microsoft-inspire-ready Tue, 24 Jul 2018 09:37:53 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=7965 Microsoft Inspire and Ready in Las Vegas. It was great to meet Microsoft Partners at the Azure Security booth, where I was primarily demoing Azure Security Center. Below the top five questions that I received: 1) Where my customer can learn more about Azure Security Center and perhaps do some hands-on-lab to experience the platform? Our team put together a readiness roadmap to help you to learn more about Azure Security Center, there you will find articles, videos and links to hands-on-lab. Go to https://aka.ms/ascreadiness for more info. 2) Does Azure Security Center supports Linux? Yes. Make sure to visit Supported platforms in Azure Security Center article for more information about which flavors of Linux are supported. 3) I used this Azure Security Center alert simulation, but I noticed that is only for Windows. Do we have one for Linux? No. We currently don't have one because Linux detection is still in private preview. Once we reach public preview we should have one. For more info, read this blog post. 4) Can I fire an email every time I receive an alert? Yes, but is not auto-triggered. You can use the  Security Playbook feature in ASC to fire an alert, but you need to run that playbook manually. 5) How do I onboard on-premises computers in Azure Security Center? Use this procedure to onboard on-premises Windows computers, and this one to onboard on-premises Linux computers. Microsoft Ready (which is dedicated to MSFTE only), was also great. I had an awesome time delivering the Azure Security Center Hands-On-Lab with Kelly Anderson, and on Friday, Ben Nick and Ajeet Prakash and I delivered the last session of the event. Some public resources that we shared in this session includes:    ]]> Azure Essentials https://docs.microsoft.com/archive/blogs/yuridiogenes/azure-essentials Fri, 13 Jul 2018 17:00:40 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=7935 https://www.microsoft.com/en-us/azureessentials). The reason I said Azure Security, is because you can filter the topic for security and Azure Essentials will format the experience specifically for Azure Security related topics as shown below: Pretty cool, right? Go check it out!]]> New Azure Security Center Dashboard https://docs.microsoft.com/archive/blogs/yuridiogenes/new-azure-security-center-dashboard Mon, 18 Jun 2018 17:29:45 GMT https://blogs.technet.microsoft.com/yuridiogenes/?p=7925 For more information about the new dashboard, read the articles below:  ]]>