You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/defender-for-resource-manager-usage.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ author: dcurwin
9
9
10
10
# Respond to Microsoft Defender for Resource Manager alerts
11
11
12
-
When you receive an alert from Microsoft Defender for Resource Manager, we recommend you investigate and respond to the alert as described below. Microsoft Defender for Resource Manager protects all connected resources, so even if you're familiar with the application or user that triggered the alert, it's important to verify the situation surrounding every alert.
12
+
When you receive an alert from Microsoft Defender for Resource Manager, we recommend you investigate and respond to the alert as described below. Defender for Resource Manager protects all connected resources, so even if you're familiar with the application or user that triggered the alert, it's important to verify the situation surrounding every alert.
13
13
14
14
## Step 1: Contact
15
15
@@ -19,17 +19,17 @@ When you receive an alert from Microsoft Defender for Resource Manager, we recom
19
19
20
20
## Step 2: Investigate alerts from Microsoft Defender for Resource Manager
21
21
22
-
Security alerts from Microsoft Defender for Resource Manager are based on threats detected by monitoring Azure Resource Manager operations. Defender for Cloud uses internal log sources of Azure Resource Manager as well as Azure Activity log, a platform log in Azure that provides insight into subscription-level events.
22
+
Security alerts from Defender for Resource Manager are based on threats detected by monitoring Azure Resource Manager operations. Defender for Cloud uses internal log sources of Azure Resource Manager as well as Azure Activity log, a platform log in Azure that provides insight into subscription-level events.
23
23
24
-
Microsoft Defender for Resource Manager provides visibility into activity that comes from third party service providers that have delegated access as part of the resource manager alerts. For example, `Azure Resource Manager operation from suspicious proxy IP address - delegated access`.
24
+
Defender for Resource Manager provides visibility into activity that comes from third party service providers that have delegated access as part of the resource manager alerts. For example, `Azure Resource Manager operation from suspicious proxy IP address - delegated access`.
25
25
26
26
`Delegated access` refers to access with [Azure Lighthouse](/azure/lighthouse/overview) or with [Delegated administration privileges](/partner-center/dap-faq).
27
27
28
28
Alerts that show `Delegated access` also include a customized description and remediation steps.
29
29
30
30
Learn more about [Azure Activity log](../azure-monitor/essentials/activity-log.md).
31
31
32
-
To investigate security alerts from Microsoft Defender for Resource Manager:
32
+
To investigate security alerts from Defender for Resource Manager:
33
33
34
34
1. Open Azure Activity log.
35
35
@@ -66,7 +66,7 @@ To investigate security alerts from Microsoft Defender for Resource Manager:
66
66
67
67
## Next steps
68
68
69
-
This page explained the process of responding to an alert from Microsoft Defender for Resource Manager. For related information see the following pages:
69
+
This page explained the process of responding to an alert from Defender for Resource Manager. For related information, see the following pages:
70
70
71
71
-[Overview of Microsoft Defender for Resource Manager](defender-for-resource-manager-introduction.md)
0 commit comments