Skip to content

Commit 03500ae

Browse files
authored
Merge pull request #191727 from bmansheim/dfc-servers-p1
Defender for servers P1 and P2
2 parents 729268b + b35fd6f commit 03500ae

16 files changed

+148
-71
lines changed

articles/defender-for-cloud/adaptive-application-controls.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
title: Adaptive application controls in Microsoft Defender for Cloud
33
description: This document helps you use adaptive application control in Microsoft Defender for Cloud to create an allowlist of applications running for Azure machines.
4+
author: bmansheim
5+
ms.author: benmansheim
46
ms.topic: how-to
57
ms.date: 11/09/2021
68

@@ -37,7 +39,7 @@ No enforcement options are currently available. Adaptive application controls ar
3739
|Aspect|Details|
3840
|----|:----|
3941
|Release state:|General availability (GA)|
40-
|Pricing:|Requires [Microsoft Defender for servers](defender-for-servers-introduction.md)|
42+
|Pricing:|Requires [Microsoft Defender for servers Plan 2](defender-for-servers-introduction.md#what-are-the-microsoft-defender-for-server-plans)|
4143
|Supported machines:|:::image type="icon" source="./media/icons/yes-icon.png"::: Azure and non-Azure machines running Windows and Linux<br>:::image type="icon" source="./media/icons/yes-icon.png"::: [Azure Arc](../azure-arc/index.yml) machines|
4244
|Required roles and permissions:|**Security Reader** and **Reader** roles can both view groups and the lists of known-safe applications<br>**Contributor** and **Security Admin** roles can both edit groups and the lists of known-safe applications|
4345
|Clouds:|:::image type="icon" source="./media/icons/yes-icon.png"::: Commercial clouds<br>:::image type="icon" source="./media/icons/yes-icon.png"::: National (Azure Government, Azure China 21Vianet)<br>:::image type="icon" source="./media/icons/yes-icon.png"::: Connected AWS accounts|

articles/defender-for-cloud/adaptive-network-hardening.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
title: Adaptive network hardening in Microsoft Defender for Cloud | Microsoft Docs
33
description: Learn how to use actual traffic patterns to harden your network security groups (NSG) rules and further improve your security posture.
4-
ms.topic: how-to
5-
ms.author: benmansheim
64
author: bmansheim
5+
ms.author: benmansheim
6+
ms.topic: how-to
77
ms.date: 11/09/2021
88
---
99
# Improve your network security posture with adaptive network hardening
@@ -18,7 +18,7 @@ This page explains how to configure and manage adaptive network hardening in Def
1818
|Aspect|Details|
1919
|----|:----|
2020
|Release state:|General availability (GA)|
21-
|Pricing:|Requires [Microsoft Defender for servers](defender-for-servers-introduction.md)|
21+
|Pricing:|Requires [Microsoft Defender for servers Plan 2](defender-for-servers-introduction.md#what-are-the-microsoft-defender-for-server-plans)|
2222
|Required roles and permissions:|Write permissions on the machine’s NSGs|
2323
|Clouds:|:::image type="icon" source="./media/icons/yes-icon.png"::: Commercial clouds<br>:::image type="icon" source="./media/icons/no-icon.png"::: National (Azure Government, Azure China 21Vianet)<br>:::image type="icon" source="./media/icons/no-icon.png"::: Connected AWS accounts|
2424

articles/defender-for-cloud/defender-for-servers-introduction.md

Lines changed: 49 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Microsoft Defender for servers - the benefits and features
33
description: Learn about the benefits and features of Microsoft Defender for servers.
4-
ms.date: 03/08/2022
4+
ms.date: 03/28/2022
55
ms.topic: overview
66
ms.author: benmansheim
77
author: bmansheim
@@ -10,7 +10,7 @@ author: bmansheim
1010

1111
[!INCLUDE [Banner for top of topics](./includes/banner.md)]
1212

13-
Microsoft Defender for servers is one of the enhanced security features of Microsoft Defender for Cloud. Use it to add threat detection and advanced defenses to your Windows and Linux machines whether they're running in Azure, on-premises, or in a multi-cloud environment.
13+
Microsoft Defender for servers is one of the enhanced security features of Microsoft Defender for Cloud. Use it to add threat detection and advanced defenses to your Windows and Linux machines whether they're running in Azure, AWS, GCP, and on-premises environment.
1414

1515
To protect machines in hybrid and multi-cloud environments, Defender for Cloud uses [Azure Arc](../azure-arc/index.yml). Connect your hybrid and multi-cloud machines as explained in the relevant quickstart:
1616
- [Connect your non-Azure machines to Microsoft Defender for Cloud](quickstart-onboard-machines.md)
@@ -19,24 +19,62 @@ To protect machines in hybrid and multi-cloud environments, Defender for Cloud u
1919
> [!TIP]
2020
> For details of which Defender for servers features are relevant for machines running on other cloud environments, see [Supported features for virtual machines and servers](supported-machines-endpoint-solutions-clouds-servers.md?tabs=features-windows#supported-features-for-virtual-machines-and-servers-).
2121
22-
## What are the benefits of Microsoft Defender for servers?
22+
## What are the Microsoft Defender for server plans?
2323

24-
The threat detection and protection capabilities provided with Microsoft Defender for servers include:
24+
Microsoft Defender for servers provides threat detection and advanced defenses to your Windows and Linux machines whether they're running in Azure, AWS, GCP, or on-premises. Microsoft Defender for Servers is available in two plans:
25+
26+
- **Microsoft Defender for servers Plan 1** - deploys Microsoft Defender for Endpoint to your servers with these additional capabilities:
27+
- Microsoft Defender for Endpoint licenses are charged per hour instead of per seat, lowering costs for protecting virtual machines only when they are in use.
28+
- Microsoft Defender for Endpoint is deployed automatically to all cloud workloads so that you know they are protected when they spin up.
29+
- Alerts and vulnerability data from Microsoft Defender for Endpoint is shown in Microsoft Defender for Cloud
30+
31+
- **Microsoft Defender for servers Plan 2** (formerly Defender for servers) - includes the benefits of Plan 1 and support for all of the other Microsoft Defender for servers features.
32+
33+
For pricing details in your currency of choice and according to your region, see the [pricing page](https://azure.microsoft.com/pricing/details/defender-for-cloud/).
34+
35+
To enable the Microsoft Defender for servers plans:
36+
37+
1. Go to **Environment settings** and select your subscription.
38+
2. If Microsoft Defender for servers is not enabled, set it to **On**.
39+
Plan 2 is selected by default.
2540

26-
- **Integrated license for Microsoft Defender for Endpoint** - Microsoft Defender for servers includes [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender). Together, they provide comprehensive endpoint detection and response (EDR) capabilities. For more information, see [Protect your endpoints](integration-defender-for-endpoint.md).
41+
If you want to change the Defender for server plan:
42+
1. In the **Plan/Pricing** column, click **configure**.
43+
2. Select the plan that you want.
44+
45+
The following table describes what's included in each plan at a high level.
46+
47+
| Feature | Free in Microsoft Defender for Cloud | Defender for servers Plan 1 | Defender for servers Plan 2 |
48+
|:---|:---|:---|:---|
49+
| Automatic onboarding for resources in Azure, AWS, GCP | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: |
50+
| Microsoft threat and vulnerability management | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: |
51+
| Cloud security posture management (CSPM) | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: |
52+
| Flexibility to use Microsoft Defender for Cloud or Microsoft 365 Defender portal | | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: |
53+
| Integration of Microsoft Defender for Cloud and Microsoft Defender for Endpoint (alerts, software inventory, Vulnerability Assessment) | | :::image type="icon" source="./media/icons/yes-icon.png"::: | :::image type="icon" source="./media/icons/yes-icon.png"::: |
54+
| Log-analytics (500MB free) | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
55+
| Security Policy & Regulatory Compliance | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
56+
| Vulnerability Assessment using Qualys | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
57+
| Threat detections: OS level, network layer, control plane | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
58+
| Adaptive application controls | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
59+
| File integrity monitoring | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
60+
| Just-in time VM access | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
61+
| Adaptive Network Hardening | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
62+
<!-- | Future – TVM P2 | | | :::image type="icon" source="./media/icons/yes-icon.png"::: |
63+
| Future – disk scanning insights | | | :::image type="icon" source="./media/icons/yes-icon.png"::: | -->
64+
65+
## What are the benefits of Defender for servers?
66+
67+
The threat detection and protection capabilities provided with Microsoft Defender for servers include:
2768

28-
When Defender for Endpoint detects a threat, it triggers an alert. The alert is shown in Defender for Cloud. From Defender for Cloud, you can also pivot to the Defender for Endpoint console, and perform a detailed investigation to uncover the scope of the attack. Learn more about Microsoft Defender for Endpoint.
69+
- **Integrated license for Microsoft Defender for Endpoint** - Microsoft Defender for servers includes [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender). Together, they provide comprehensive endpoint detection and response (EDR) capabilities. When you enable Microsoft Defender for servers, you give consent for Defender for Cloud to access the Microsoft Defender for Endpoint data related to vulnerabilities, installed software, and alerts for your endpoints.
2970

30-
> [!IMPORTANT]
31-
> Defender for Cloud’s integration with Microsoft Defender for Endpoint is enabled by default. So when you enable Microsoft Defender for servers, you give consent for Defender for Cloud to access the Microsoft Defender for Endpoint data related to vulnerabilities, installed software, and alerts for your endpoints.
32-
>
33-
> Learn more in [Protect your endpoints with Defender for Cloud's integrated EDR solution: Microsoft Defender for Endpoint](integration-defender-for-endpoint.md).
71+
When Defender for Endpoint detects a threat, it triggers an alert. The alert is shown in Defender for Cloud. From Defender for Cloud, you can also pivot to the Defender for Endpoint console, and perform a detailed investigation to uncover the scope of the attack. For more information, see [Protect your endpoints](integration-defender-for-endpoint.md).
3472

3573
- **Vulnerability assessment tools for machines** - Microsoft Defender for servers includes a choice of vulnerability discovery and management tools for your machines. From Defender for Cloud's settings pages, you can select which of these tools to deploy to your machines and the discovered vulnerabilities will be shown in a security recommendation.
3674

3775
- **Microsoft threat and vulnerability management** - Discover vulnerabilities and misconfigurations in real time with Microsoft Defender for Endpoint, and without the need of additional agents or periodic scans. [Threat and vulnerability management](/microsoft-365/security/defender-endpoint/next-gen-threat-and-vuln-mgt) prioritizes vulnerabilities based on the threat landscape, detections in your organization, sensitive information on vulnerable devices, and business context. Learn more in [Investigate weaknesses with Microsoft Defender for Endpoint's threat and vulnerability management](deploy-vulnerability-assessment-tvm.md)
3876

39-
- **Vulnerability scanner powered by Qualys** - Qualys' scanner is one of the leading tools for real-time identification of vulnerabilities in your Azure and hybrid virtual machines. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Defender for Cloud. Learn more in [Defender for Cloud's integrated Qualys scanner for Azure and hybrid machines](deploy-vulnerability-assessment-vm.md).
77+
- **Vulnerability scanner powered by Qualys** - The Qualys scanner is one of the leading tools for real-time identification of vulnerabilities in your Azure and hybrid virtual machines. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Defender for Cloud. Learn more in [Defender for Cloud's integrated Qualys scanner for Azure and hybrid machines](deploy-vulnerability-assessment-vm.md).
4078

4179
- **Just-in-time (JIT) virtual machine (VM) access** - Threat actors actively hunt accessible machines with open management ports, like RDP or SSH. All of your virtual machines are potential targets for an attack. When a VM is successfully compromised, it's used as the entry point to attack further resources within your environment.
4280

articles/defender-for-cloud/deploy-vulnerability-assessment-tvm.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Enable, deploy, and use Microsoft Defender for Endpoint's threat an
44
ms.topic: how-to
55
ms.author: benmansheim
66
author: bmansheim
7-
ms.date: 03/06/2022
7+
ms.date: 03/23/2022
88
---
99

1010
# Investigate weaknesses with Microsoft Defender for Endpoint's threat and vulnerability management
@@ -34,7 +34,7 @@ For a quick overview of threat and vulnerability management, watch this video:
3434
|----|:----|
3535
|Release state:|General availability (GA)|
3636
|Machine types:|:::image type="icon" source="./media/icons/yes-icon.png"::: Azure virtual machines<br>:::image type="icon" source="./media/icons/yes-icon.png"::: Azure Arc-enabled machines <br> [Supported machines](/microsoft-365/security/defender-endpoint/tvm-supported-os)|
37-
|Pricing:|Requires [Microsoft Defender for servers](defender-for-servers-introduction.md)|
37+
|Pricing:|Requires [Microsoft Defender for servers Plan 1 or Plan 2](defender-for-servers-introduction.md#what-are-the-microsoft-defender-for-server-plans)|
3838
|Prerequisites:|Enable the [integration with Microsoft Defender for Endpoint](integration-defender-for-endpoint.md)|
3939
|Required roles and permissions:|[Owner](../role-based-access-control/built-in-roles.md#owner) (resource group level) can deploy the scanner<br>[Security Reader](../role-based-access-control/built-in-roles.md#security-reader) can view findings|
4040
|Clouds:|:::image type="icon" source="./media/icons/yes-icon.png"::: Commercial clouds<br>:::image type="icon" source="./media/icons/no-icon.png"::: National (Azure Government, Azure China 21Vianet)|

articles/defender-for-cloud/deploy-vulnerability-assessment-vm.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
title: Defender for Cloud's integrated vulnerability assessment solution for Azure, hybrid, and multi-cloud machines
33
description: Install a vulnerability assessment solution on your Azure machines to get recommendations in Microsoft Defender for Cloud that can help you protect your Azure and hybrid machines
4-
ms.topic: how-to
5-
ms.author: benmansheim
64
author: bmansheim
5+
ms.author: benmansheim
6+
ms.topic: how-to
77
ms.date: 11/16/2021
88
---
99
# Defender for Cloud's integrated Qualys vulnerability scanner for Azure and hybrid machines
@@ -40,7 +40,7 @@ Deploy the vulnerability assessment solution that best meets your needs and bud
4040
|----|:----|
4141
|Release state:|General availability (GA)|
4242
|Machine types (hybrid scenarios):|:::image type="icon" source="./media/icons/yes-icon.png"::: Azure virtual machines<br>:::image type="icon" source="./media/icons/yes-icon.png"::: Azure Arc-enabled machines|
43-
|Pricing:|Requires [Microsoft Defender for servers](defender-for-servers-introduction.md)|
43+
|Pricing:|Requires [Microsoft Defender for servers Plan 2](defender-for-servers-introduction.md#what-are-the-microsoft-defender-for-server-plans)|
4444
|Required roles and permissions:|[Owner](../role-based-access-control/built-in-roles.md#owner) (resource group level) can deploy the scanner<br>[Security Reader](../role-based-access-control/built-in-roles.md#security-reader) can view findings|
4545
|Clouds:|:::image type="icon" source="./media/icons/yes-icon.png"::: Commercial clouds<br>:::image type="icon" source="./media/icons/no-icon.png"::: National (Azure Government, Azure China 21Vianet)<br>:::image type="icon" source="./media/icons/yes-icon.png"::: Connected AWS accounts|
4646

0 commit comments

Comments
 (0)