Skip to content

Commit 88306b1

Browse files
committed
Merge branch 'master' of https://github.com/MicrosoftDocs/azure-docs-pr into asc-melvyn-anh
2 parents e7f5d9a + e1216f0 commit 88306b1

File tree

7 files changed

+134
-65
lines changed

7 files changed

+134
-65
lines changed

articles/azure-government/documentation-government-services-monitoringandmanagement.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,9 @@ The resources currently supported in the second generation alerts experience are
174174
- Microsoft.Web/sites
175175
- Microsoft.Web/sites/slots
176176

177+
> [!NOTE]
178+
> Creating multi-resource metric alert rules on Virtual Machines is **currently not supported**. This article will be updated as soon as this functionality becomes available.
179+
177180
You can still use [classic alerts](../azure-monitor/platform/alerts-classic.overview.md) for resources not yet available in the second generation of alerts.
178181

179182
When using PowerShell/ARM/Rest calls to create metric alerts, you will need to set the "Location" of the metric alert to "USGov Virginia" or "USGov Iowa". An example of the setting is below:
@@ -186,6 +189,7 @@ Add-AzMetricAlertRule -Name vmcpu_gt_1 -Location "USGov Virginia" -ResourceGroup
186189

187190
For more information on using PowerShell, see [public documentation](../azure-monitor/platform/powershell-quickstart-samples.md).
188191

192+
189193
## Application Insights
190194

191195
> [!NOTE]
Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
title: Query ingested telemetry data
3+
description: This article describes how to query ingested telemetry data.
4+
author: sunasing
5+
ms.topic: article
6+
ms.date: 03/11/2020
7+
ms.author: sunasing
8+
---
9+
10+
# Query ingested telemetry data
11+
12+
This article describes how to query ingested sensor data from Azure FarmBeats.
13+
14+
Ingesting data from Internet of Things (IoT) resources such as devices and sensors is a common scenario in FarmBeats. You create metadata for devices and sensors and then ingest the historical data to FarmBeats in a canonical format. Once the sensor data is available on FarmBeats Datahub, we can query the same to generate actionable insights or build models.
15+
16+
## Before you begin
17+
18+
Before you proceed with this article, make sure that you've installed FarmBeats and ingested sensor telemetry data from your IoT devices to FarmBeats
19+
To ingest sensor telemetry data, visit [ingest historical telemetry data](ingest-historical-telemetry-data-in-azure-farmbeats.md)
20+
21+
Before you proceed, also make sure you are familiar with FarmBeats REST APIs as you will query ingested telemetry using APIs. For more details on FarmBeats APIs, please see [FarmBeats REST APIs](rest-api-in-azure-farmbeats.md). **Ensure that you are able to make API requests to your FarmBeats Datahub endpoint**
22+
23+
## Query ingested sensor telemetry data
24+
25+
Follow the below steps to query the ingested sensor telemetry data:
26+
27+
1. Identify the sensor you are interested in. You can do this by making a GET request on /Sensor API. Note the **id** and the **sensorModelId** of the interested sensor object.
28+
29+
2. Make a GET/{id} on /SensorModel API for the **sensorModelId** as noted in step 1. The SensorModel has all the metadata and details about the ingested telemetry from the sensor. For example, SensorMeasure within the SensorModel object has details about what measures is the sensor sending and in what types and units. For example,
30+
31+
```json
32+
{
33+
"name": "moist_soil_last <name of the sensor measure - this is what we will receive as part of the queried telemetry data>",
34+
"dataType": "Double <Data Type - eg. Double>",
35+
"type": "SoilMoisture <Type of measure eg. temperature, soil moisture etc.>",
36+
"unit": "Percentage <Unit of measure eg. Celsius, Percentage etc.>",
37+
"aggregationType": "None <either of None, Average, Maximum, Minimum, StandardDeviation>",
38+
"description": "<Description of the measure>"
39+
}
40+
```
41+
Make a note of the response from the GET/{id} call for the SensorModel.
42+
43+
3. Do a POST call on /Telemetry API with the following input payload
44+
45+
```json
46+
{
47+
"sensorId": "<id of the sensor as noted in step 1>",
48+
"searchSpan": {
49+
"from": "<desired start timestamp in ISO 8601 format; default is UTC>",
50+
"to": "<desired end timestamp in ISO 8601 format; default is UTC>"
51+
},
52+
"filter": {
53+
"tsx": "string"
54+
},
55+
"projectedProperties": [
56+
{
57+
"additionalProp1": "string",
58+
"additionalProp2": "string",
59+
"additionalProp3": "string"
60+
}
61+
]
62+
}
63+
```
64+
4. The response from the /Telemetry API will look something like this:
65+
66+
```json
67+
{
68+
"timestamps": [
69+
"2020-XX-XXT07:30:00Z",
70+
"2020-XX-XXT07:45:00Z"
71+
],
72+
"properties": [
73+
{
74+
"values": [
75+
"<id of the sensor>",
76+
"<id of the sensor>"
77+
],
78+
"name": "Id",
79+
"type": "String"
80+
},
81+
{
82+
"values": [
83+
2.1,
84+
2.2
85+
],
86+
"name": "moist_soil_last <name of the SensorMeasure as defined in the SensorModel object>",
87+
"type": "Double <Data Type of the value - eg. Double>"
88+
}
89+
]
90+
}
91+
```
92+
In the above example response, the queried sensor telemetry gives data for two timestamps along with the measure name ("moist_soil_last") and values of the reported telemetry in the two timestamps. You will need to refer to the associated /SensorModel (as described in step 2) to interpret the type and unit of the reported values.
93+
94+
## Next steps
95+
96+
You now have queried sensor data from your Azure FarmBeats instance. Now, learn how to [generate maps](generate-maps-in-azure-farmbeats.md#generate-maps) for your farms.

articles/industry/agriculture/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99
href: generate-soil-moisture-map-in-azure-farmbeats.md
1010
- name: Ingest historical telemetry data
1111
href: ingest-historical-telemetry-data-in-azure-farmbeats.md
12+
- name: Query ingested telemetry data
13+
href: query-telemetry-data-from-azure-farmbeats.md
1214
- name: Concepts
1315
items:
1416
- name: Integration patterns
11.7 KB
Loading

articles/security-center/recommendations-reference.md

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ms.devlang: na
1010
ms.topic: conceptual
1111
ms.tgt_pltfrm: na
1212
ms.workload: na
13-
ms.date: 12/18/2019
13+
ms.date: 03/11/2020
1414
ms.author: memildin
1515

1616
---
@@ -21,7 +21,10 @@ This article lists the recommendations you might see in Azure Security Center. T
2121

2222
To learn about how to respond to these recommendations, see [Remediate recommendations in Azure Security Center](security-center-remediate-recommendations.md).
2323

24-
Your Secure Score is based on how many Security Center recommendations you have mitigated. To prioritize the recommendations to resolve first, consider the severity of each.
24+
Your Secure Score is based on the number of Security Center recommendations you've completed. To decide which recommendations to resolve first, look at the severity of each one and its potential impact on your Secure Score.
25+
26+
>[!TIP]
27+
> If a recommendation's description says "No related policy", it's usually because that recommendation is dependent on a different recommendation and *its* policy. For example, the recommendation "Endpoint protection health failures should be remediated...", relies on the recommendation that checks whether an endpoint protection solution is even *installed* ("Endpoint protection solution should be installed..."). The underlying recommendation *does* have a policy. Limiting the policies to only the foundational recommendation simplifies policy management.
2528
2629
## <a name="recs-network"></a>Network recommendations
2730

@@ -51,7 +54,7 @@ Your Secure Score is based on how many Security Center recommendations you have
5154
|**The Kubernetes Service should be upgraded to the latest Kubernetes version**|Upgrade Azure Kubernetes Service clusters to the latest Kubernetes version in order to benefit from up-to-date vulnerability patches. For details regarding specific Kubernetes vulnerabilities see [Kubernetes CVEs](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=kubernetes).<br>(Related policy: [Preview]: Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version)|High|N|Compute resources (Containers)|
5255
|**Pod Security Policies should be defined to reduce the attack vector by removing unnecessary application privileges (Preview)**|Define Pod Security Policies to reduce the attack vector by removing unnecessary application privileges. It is recommended to configure pod security policies so pods can only access resources which they are allowed to access.<br>(Related policy: [Preview]: Pod Security Policies should be defined on Kubernetes Services)|Medium|N|Compute resources (Containers)|
5356
|**Access to a Kubernetes service management API should be limited by authorizing specific IP ranges only**|Restrict access to the Kubernetes service management API by granting API access only to IP addresses in specific ranges. It is recommended to configure authorized IP ranges so only applications from allowed networks can access the cluster.<br>(Related policy: [Preview]: Authorized IP ranges should be defined on Kubernetes Services)|High|N|Compute resources (Containers)|
54-
|**Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys)**|Container image vulnerability assessment scans your registry for security vulnerabilities on each pushed container image and exposes detailed findings per image. Resolving the vulnerabilities can greatly improve your containers security posture and protect them from attacks.<br>(No related policy)|High|N|Compute resources (Containers)|
57+
|**Vulnerabilities in Azure Container Registry images should be remediated (powered by Qualys)**|Container image vulnerability assessment scans your registry for security vulnerabilities on each pushed container image and exposes detailed findings per image. Resolving the vulnerabilities can greatly improve your containers' security posture and protect them from attacks.<br>(No related policy)|High|N|Compute resources (Containers)|
5558
||||||
5659

5760

@@ -102,7 +105,7 @@ Your Secure Score is based on how many Security Center recommendations you have
102105
|**Vulnerabilities should be remediated by a Vulnerability Assessment solution**|Virtual machines for which a vulnerability assessment 3rd party solution is deployed are being continuously assessed against application and OS vulnerabilities. Whenever such vulnerabilities are found, these are available for more information as part of the recommendation.<br>(Related policy: Vulnerabilities should be remediated by a Vulnerability Assessment solution)|High|N|Machine|
103106
|**Vulnerabilities in security configuration on your machines should be remediated**|Remediate vulnerabilities in security configuration on your machines to protect them from attacks.<br>(Related policy: Vulnerabilities in security configuration on your machines should be remediated)|Low|N|Machine|
104107
|**Vulnerabilities in container security configurations should be remediated**|Remediate vulnerabilities in security configuration on machines with Docker installed to protect them from attacks.<br>(Related policy: Vulnerabilities in container security configurations should be remediated)|High|N|Machine|
105-
|**Endpoint protection health issues should be resolved on your machines**|For full Security Center protection, resolve monitoring agent issues on your machines by following the instructions in the Troubleshooting guide.<br>(No related policy - dependent upon "Install endpoint protection solution on your machines")|Medium|N|Machine|
108+
|**Endpoint protection health issues should be resolved on your machines**|For full Security Center protection, resolve monitoring agent issues on your machines by following the instructions in the Troubleshooting guide.<br>(This recommendation is dependent upon the recommendation "Install endpoint protection solution on your machines" and its policy)|Medium|N|Machine|
106109
||||||
107110

108111

articles/security-center/secure-score-security-controls.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ The enhanced Secure Score is shown as a percentage, as shown in the following sc
4141

4242
## Locating your Secure Score
4343

44-
Security Center displays your score prominently: it's the first thing shown in the Overview page. If you click through to the dedicated Secure Score page, you'll see the score broken down by subscription. Click a single subscription to see the detailed list of prioritized recommendations and the potential impact that remediating them will have on the subscriptions score.
44+
Security Center displays your score prominently: it's the first thing shown in the Overview page. If you click through to the dedicated Secure Score page, you'll see the score broken down by subscription. Click a single subscription to see the detailed list of prioritized recommendations and the potential impact that remediating them will have on the subscription's score.
4545

4646
## How the Secure Score is calculated
4747

@@ -95,7 +95,7 @@ The table below lists the Security Controls in Azure Security Center. For each c
9595
|**Remediate vulnerabilities**|6|- Advanced data security should be enabled on your SQL servers<br>- Vulnerabilities in Azure Container Registry images should be remediated (Preview)<br>- Vulnerabilities on your SQL databases should be remediated<br>- Vulnerabilities should be remediated by a Vulnerability Assessment solution<br>- Vulnerability assessment should be enabled on your SQL managed instances<br>- Vulnerability assessment should be enabled on your SQL servers<br>- Vulnerability assessment solution should be installed on your virtual machines|
9696
|**Enable encryption at rest**|4|- Disk encryption should be applied on virtual machines<br>- Transparent Data Encryption on SQL databases should be enabled<br>- Automation account variables should be encrypted<br>- Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign<br>- SQL server TDE protector should be encrypted with your own key|
9797
|**Encrypt data in transit**|4|- API App should only be accessible over HTTPS<br>- Function App should only be accessible over HTTPS<br>- Only secure connections to your Redis Cache should be enabled<br>- Secure transfer to storage accounts should be enabled<br>- Web Application should only be accessible over HTTPS|
98-
|**Manage access and permissions**|4|- A maximum of 3 owners should be designated for your subscription<br>- Deprecated accounts should be removed from your subscription (Preview)<br>- Deprecated accounts with owner permissions should be removed from your subscription (Preview)<br>- External accounts with owner permissions should be removed from your subscription (Preview)<br>- External accounts with read permissions should be removed from your subscription<br>- External accounts with write permissions should be removed from your subscription (Preview)<br>- There should be more than one owner assigned to your subscription<br>- Role-Based Access Control (RBAC) should be used on Kubernetes Services (Preview)<br>- Service Fabric clusters should only use Azure Active Directory for client authentication|
98+
|**Manage access and permissions**|4|- A maximum of 3 owners should be designated for your subscription<br>- Deprecated accounts should be removed from your subscription<br>- Deprecated accounts with owner permissions should be removed from your subscription<br>- External accounts with owner permissions should be removed from your subscription<br>- External accounts with read permissions should be removed from your subscription<br>- External accounts with write permissions should be removed from your subscription<br>- There should be more than one owner assigned to your subscription<br>- Role-Based Access Control (RBAC) should be used on Kubernetes Services (Preview)<br>- Service Fabric clusters should only use Azure Active Directory for client authentication|
9999
|**Remediate security configurations**|4|- Pod Security Policies should be defined on Kubernetes Services (Preview)<br>- Vulnerabilities in container security configurations should be remediated<br>- Vulnerabilities in security configuration on your machines should be remediated<br>- Vulnerabilities in security configuration on your virtual machine scale sets should be remediated<br>- Monitoring agent should be installed on your virtual machines<br>- Monitoring agent should be installed on your machines<br>- Monitoring agent should be installed on virtual machine scale sets<br>- Monitoring agent health issues should be resolved on your machines|
100100
|**Restrict unauthorized network access**|4|- IP forwarding on your virtual machine should be disabled<br>- Authorized IP ranges should be defined on Kubernetes Services (Preview)<br>- (DEPRECATED) Access to App Services should be restricted (Preview)<br>- (DEPRECATED) The rules for web applications on IaaS NSGs should be hardened<br>- Virtual machines should be associated with a Network Security Group<br>- CORS should not allow every resource to access your API App<br>- CORS should not allow every resource to access your Function App<br>- CORS should not allow every resource to access your Web Application<br>- Remote debugging should be turned off for API App<br>- Remote debugging should be turned off for Function App<br>- Remote debugging should be turned off for Web Application<br>- Access should be restricted for permissive Network Security Groups with Internet-facing VMs<br>- Network Security Group Rules for Internet facing virtual machines should be hardened|
101101
|**Apply adaptive application control**|3|- Adaptive Application Controls should be enabled on virtual machines<br>- Monitoring agent should be installed on your virtual machines<br>- Monitoring agent should be installed on your machines<br>- Monitoring agent health issues should be resolved on your machines|
@@ -121,7 +121,7 @@ Yes, but for a while they'll be running side by side to ease the transition.
121121
Yes. We recommend disabling recommendations when they're inapplicable in your environment. For instructions on how to disable a specific recommendation, see [Disable security policies](https://docs.microsoft.com/azure/security-center/tutorial-security-policy#disable-security-policies).
122122

123123
### If a Security Control offers me zero points towards my Secure Score, should I ignore it?
124-
In some cases you'll see a control max score greater than zero, but the impact is zero. When the incremental score for fixing resources is negligible, it's rounded to zero. Don't ignore these recommendations as they still bring security improvements. The only exception is the Additional Best Practice control. Remediating these recommendations won't increase your score, but it will enhance your overall security.
124+
In some cases you'll see a control max score greater than zero, but the impact is zero. When the incremental score for fixing resources is negligible, it's rounded to zero. Don't ignore these recommendations as they still bring security improvements. The only exception is the "Additional Best Practice" control. Remediating these recommendations won't increase your score, but it will enhance your overall security.
125125

126126
## Next steps
127127

0 commit comments

Comments
 (0)