|
| 1 | +--- |
| 2 | +title: Integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points |
| 3 | +description: Learn how to integrate Microsoft Defender for Cloud and Azure Backup using logic app. |
| 4 | +ms.topic: how-to |
| 5 | +ms.custom: references_regions |
| 6 | +ms.date: 12/30/2022 |
| 7 | +author: v-amallick |
| 8 | +ms.service: backup |
| 9 | +ms.author: v-amallick |
| 10 | +--- |
| 11 | + |
| 12 | +# Solution sample to integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points |
| 13 | + |
| 14 | +This article describes the sample solution that demonstrates how to integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points. Assume there has been a breach on the Virtual Machine that is protected by both Defender and Azure Backup. Defender detects the ransomware, raises an alert which includes details of the activity and suggested recommendations to remediate. As soon as a ransomware signal is detected from Defender, ensuring backups are preserved (i.e., paused from expiring) to minimize the data loss is top of our customers’ mind. |
| 15 | + |
| 16 | +Azure Backup provides several security capabilities to help you protect your backup data. [Soft delete](backup-azure-security-feature-cloud.md), [Immutable vaults](backup-azure-immutable-vault-concept.md), [Multi-User Authorization (MUA)](multi-user-authorization-concept.md) are part of a comprehensive data protection strategy for backup data. Soft delete is enabled by default, with option to make it always-on (irreversible). Soft deleted backup data is retained at no additional cost for *14* days, with option to [extend the duration](backup-azure-enhanced-soft-delete-about.md). Enabling immutability on vaults can protect backup data by blocking any operations that could lead to loss of recovery points. You can configure Multi-user authorization (MUA) for Azure Backup as an additional layer of protection to critical operations on your Recovery Services vaults. By default, critical alert for destructive operation (such as stop protection with delete backup data) is raised and an email is sent to subscription owners, admins, and co-admins. |
| 17 | + |
| 18 | +Microsoft Defender for Cloud (MDC) is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for all of your Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources. Defender for Cloud generates security alerts when threats are identified in your cloud, hybrid, or on-premises environment. It's available when you enable enhanced security features. Each alert provides details of affected resources along with the information you need to quickly investigate the issue and steps to take to remediate an attack. If a malware or a ransomware attacks on an Azure Virtual Machine, Microsoft Defender for Cloud detects suspicious activity and indicators associated with ransomware on an Azure VM and generates a Security Alert. Examples of the Defender for Cloud Alerts that trigger on a Ransomware detection: *Ransomware indicators detected*, *Behavior similar to ransomware detected*, and so on. |
| 19 | + |
| 20 | +>[!Note] |
| 21 | +> This sample solution is scoped to Azure Virtual Machines. You can deployed the logic app only at a subscription level, which means all Azure VMs under the subscription can use the logic app to pause expiry of recovery points in the event of a security alert. |
| 22 | +
|
| 23 | +## Solution details |
| 24 | + |
| 25 | +This sample solution demonstrates integration of Azure Backup with Microsoft Defender for Cloud (MDC) for detection and response to alerts to accelerate response. Sample illustrates the following three use cases: |
| 26 | + |
| 27 | +- Ability to send email alerts to the Backup Admin. |
| 28 | +- Security Admin to triage and manually trigger logic app to secure backups. |
| 29 | +- Workflow to automatically respond to the alert by performing the *Disable Backup Policy (Stop backup and retain data)* operation. |
| 30 | + |
| 31 | +:::image type="content" source="./media/backup-azure-integrate-microsoft-defender-using-logic-apps/logic-apps-flow-diagram.png" alt-text="Diagram shows how Microsoft Defender for Cloud and Azure Backup using Logic apps helps protecting the backup data."::: |
| 32 | + |
| 33 | +## Prerequisites |
| 34 | + |
| 35 | +- [Enable Azure Backup for Azure virtual machines](tutorial-backup-vm-at-scale.md). |
| 36 | +- [Enable Microsoft Defender for Servers Plan 2 for the Subscription](../defender-for-cloud/enable-enhanced-security.md#enable-enhanced-security-features-on-a-subscription). |
| 37 | + |
| 38 | +## Deploy Azure Logic Apps |
| 39 | + |
| 40 | +To deploy Azure Logic Apps, follow these steps: |
| 41 | + |
| 42 | +1. Go to [GitHub](https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workflow%20automation/Protect%20Azure%20VM%20Backup%20from%20Ransomware) and select **Deploy to Azure**. |
| 43 | + |
| 44 | + :::image type="content" source="./media/backup-azure-integrate-microsoft-defender-using-logic-apps/start-azure-logic-apps-deployment.png" alt-text="Screenshot shows how to start Azure Logic Apps from GitHub."::: |
| 45 | + |
| 46 | +2. On the **deployment** pane, enter the following details: |
| 47 | + |
| 48 | + - **Subscription**: Select the subscription whose Azure VMs the logic app should govern. |
| 49 | + - **Name**: Enter a suitable name for the logic app. |
| 50 | + - **Region**: Choose the region with which the subscription is associated. |
| 51 | + - **Email**: Enter the email address of the Backup admin for them to receive alerts when policy is suspended. |
| 52 | + - **Resource group**: Select the resource group with which logic apps need to be associated for deployment. |
| 53 | + - **Managed Identity**: [Create and assign a Managed Identity](../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md?pivots=identity-mi-methods-azp#create-a-user-assigned-managed-identity) with the below minimum permissions for the service to perform the *Stop backup and retain data* operation on the backup item automatically during a malware alert. |
| 54 | + |
| 55 | + - Virtual Machine Contributor on the subscription |
| 56 | + - The Backup Operator on the subscription |
| 57 | + - Security Reader |
| 58 | + |
| 59 | + >[!Note] |
| 60 | + >To further tighten the security, we recommend you create a custom role and assign that to the Managed Identity instead of the above built-in roles. This ensures that all the calls run with least privileges. For more information on custom role, see the [Github article](https://github.com/Azure/Microsoft-Defender-for-Cloud/tree/main/Workflow%20automation/Protect%20Azure%20VM%20Backup%20from%20Ransomware). |
| 61 | +
|
| 62 | + - **Managed Identity Subscription**: Enter the name of a Subscription that the Managed Identity should reside in. |
| 63 | + - **Managed Identity Resource Group**: Enter the name of a resource group that the Managed Identity should reside in. |
| 64 | + |
| 65 | + :::image type="content" source="./media/backup-azure-integrate-microsoft-defender-using-logic-apps/enter-details-for azure-logic-apps-deployment.png" alt-text="Screenshot shows how to enter details to deploy Azure Logic Apps."::: |
| 66 | + |
| 67 | + >[!Note] |
| 68 | + >You need *Owner* access on the Subscription to deploy the logic app. |
| 69 | +
|
| 70 | +3. Select **Review + Create**. |
| 71 | + |
| 72 | +## Authorize Office 365 for email alerts |
| 73 | + |
| 74 | +To authorize the API connection to Office 365, follow these steps: |
| 75 | + |
| 76 | +1. Go to the *resource group* you used to deploy the template resources. |
| 77 | +2. Select the *Office365 API connection* (which is one of the resources you deployed) and select the *error that appears at the API connection*. |
| 78 | +3. Select **Edit API connection**. |
| 79 | +4. Select **Authorize**. |
| 80 | + |
| 81 | + >[!Note] |
| 82 | + >Ensure that you authenticate against Azure AD. |
| 83 | +
|
| 84 | +5. Select **Save**. |
| 85 | + |
| 86 | +## Trigger the logic app |
| 87 | + |
| 88 | +You can trigger the deployed logic app *manually* or *automatically* using [workflow automation](../defender-for-cloud/workflow-automation.md). |
| 89 | + |
| 90 | +### Trigger manually |
| 91 | + |
| 92 | +To trigger the logic app manually, follow these steps: |
| 93 | + |
| 94 | +1. Go to **Microsoft Defender for Cloud**, and then select **Security Alerts** on the left pane. |
| 95 | +1. Select the required alert to expand details. |
| 96 | +1. Select **Take action**, choose **Trigger automated response**, and then select **Trigger logic app**. |
| 97 | +1. Search the deployed logic app by name, and then select **Trigger**. |
| 98 | + |
| 99 | +>[!Note] |
| 100 | +>The minimum Azure RBAC permissions needed to trigger an action for the security alert are: |
| 101 | +> |
| 102 | +>- Logic app Operator |
| 103 | +>- Security Admin role |
| 104 | +
|
| 105 | +### Trigger using workflow automation via Azure portal |
| 106 | + |
| 107 | +Workflow automation ensures that during a security alert, your backups corresponding to the VM facing this issue changes to **Stop backup and retain data** state, thus suspend policy and pause recovery point pruning. You can also use Azure Policy to deploy [workflow automation](../defender-for-cloud/workflow-automation.md). |
| 108 | + |
| 109 | +>[!Note] |
| 110 | +>The minimum role required to deploy the workflow automation are: |
| 111 | +> |
| 112 | +>- Logic app Operator |
| 113 | +>- Security Admin |
| 114 | +
|
| 115 | +To trigger the logic app using automatic workflow, follow these steps: |
| 116 | + |
| 117 | +1. Go to **Defender for Cloud**, and then select **Workflow automation** on the left pane. |
| 118 | +1. Select **Add workflow automation** to open the options pane for the new automation. |
| 119 | +1. Enter the following details: |
| 120 | + |
| 121 | + - **Name and Description**: Enter a suitable name for the automation. |
| 122 | + - **Subscription**: Select the subscription same as the scope of the logic app. |
| 123 | + - **Resource group**: Select the resource group in which the automation will reside. |
| 124 | + - **Defender for Cloud Data Type**: Select *Security Alert*. |
| 125 | + - **Alert name contains**: Select *Malware* or *ransomware*. |
| 126 | + - **Alert severity**: Select *High*. |
| 127 | + - **Logic app**: Select the logic app you deployed. |
| 128 | +1. Select **Create**. |
| 129 | + |
| 130 | +## Email alerts |
| 131 | + |
| 132 | +When the backup policy on the backup item gets disabled, the logic app also sends an email to the ID you've entered during deployment. The email ID should ideally be of the *Backup Admin*. You can then investigate the alert and resume the backups when the issue is resolved or if it's a false alarm. |
| 133 | + |
| 134 | +## Next steps |
| 135 | + |
| 136 | +[About backup and restore plan to protect against ransomware](../security/fundamentals/backup-plan-to-protect-against-ransomware.md). |
0 commit comments