You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/storage/common/storage-advanced-threat-protection.md
+89-23Lines changed: 89 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,46 +1,76 @@
1
1
---
2
-
title: Monitoring Threats in Azure Storage
2
+
title: Advanced Threat Protection for Azure Storage
3
3
description: Configure Azure Storage Advanced Threat Protection to detect anomalies in account activity and notify you of potentially harmful attempts to access your account.
4
4
services: storage
5
5
author: rmatchoro
6
6
ms.service: storage
7
7
ms.topic: article
8
-
ms.date: 09/24/2018
9
-
ms.author: ronmat
8
+
ms.date: 03/11/2019
9
+
ms.author: monhaber
10
10
ms.manager: shaik
11
11
---
12
12
13
-
# Azure Storage Advanced Threat Protection
13
+
# Advanced Threat Protection for Azure Storage
14
14
15
-
Azure Storage Advanced Threat Protection detects anomalies in account activity and notifies you of potentially harmful attempts to access your account. This layer of protection allows you to address threats without the need to be a security expert or manage security monitoring systems.
15
+
Advanced Threat Protection for Azure Storage provides an additional layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit storage accounts. This layer of protection allows you to address threats without the need to be a security expert or manage security monitoring systems.
16
16
17
-
Threats are surfaced by defining security alerts that trigger when anomalies in activity occur. These alerts integrate with [Azure Security Center](https://azure.microsoft.com/services/security-center/) which include details of suspicious activity and recommendations on how to investigate and remediate threats.
17
+
Security alerts are triggered when anomalies in activity occur. These security alerts are integrated with [Azure Security Center](https://azure.microsoft.com/services/security-center/), and are also sent via email to subscription administrators, with details of suspicious activity and recommendations on how to investigate and remediate threats.
18
18
19
19
> [!NOTE]
20
-
> Azure Storage Advanced Threat Protection is currently available only for the Blob service. Security alerts are integrated with Azure Security Center and are sent via email to subscription administrators.
20
+
> Advanced Threat Protection for Azure Storage is currently available only for the Blob storage. Details about the new pricing is available in the [Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-pricing) pricing page, including an option for a trial period for the first 30 days without charge.
21
21
22
-
Azure Storage Advanced Threat Protection ingests diagnostic logs of read, write and delete requests to Blob service for threat detection. To investigate the alerts from Advanced Threat Protection, you need to [configure diagnostics logs](storage-monitor-storage-account.md#configure-logging) to enable all levels of logs for the Blob service.
22
+
Advanced Threat Protection for Azure Storage ingests diagnostic logs of read, write, and delete requests to Blob storage for threat detection. To investigate the alerts from Advanced Threat Protection, you can view related storage activity using Storage Analytics Logging. For more information, see how to [configure Storage Analytics logging](storage-monitor-storage-account.md#configure-logging).
23
23
24
-
## Set up Advanced Threat Protection in the portal
24
+
## Set up Advanced Threat Protection
25
+
26
+
### Using the portal
25
27
26
28
1. Launch the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
27
29
28
30
2. Navigate to the configuration page of the Azure Storage account you want to protect. In the **Settings** page, select **Advanced Threat Protection**.
29
31
30
32
3. In the **Advanced Threat Protection** configuration blade
31
33
* Turn **ON** Advanced *Threat Protection*
32
-
* Click **Save** to save the new or updated Advanced Threat Protection policy.
34
+
* Click **Save** to save the new or updated Advanced Threat Protection policy. (Prices in the image are for example purposes only.)
33
35
34
36
35
37
36
-
## Explore anomalies
38
+
### Using Azure Security Center
39
+
When you subscribe to the Standard tier in Azure Security Center, Advanced Threat Protection is set up on your storage accounts. For more information see [Upgrade to Security Center's Standard tier for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-pricing). (Prices in the image are for example purposes only.)
40
+
41
+
42
+
43
+
### Using Azure Resource Manager templates
44
+
45
+
Use an Azure Resource Manager template to deploy an Azure Storage account with Advanced Threat Protection enabled.
46
+
For more information, see
47
+
[Storage account with Advanced Threat Protection](https://azure.microsoft.com/resources/templates/201-storage-advanced-threat-protection-create/).
48
+
49
+
### Using REST API
50
+
Use Rest API commands to create, update, or get the Advanced Threat Protection setting for a specific storage account.
When storage activity anomalies occur, you receive an email notification with information about the suspicious security event. Details of the event include:
39
65
40
-
* nature of the anomaly
41
-
* storage account name
42
-
* storage type
43
-
* event time
66
+
* The nature of the anomaly
67
+
* The storage account name
68
+
* The event time
69
+
* The storage type
70
+
* The potential causes
71
+
* The investigation steps
72
+
* The remediation steps
73
+
44
74
45
75
The email also includes details on possible causes and recommended actions to investigate and mitigate the potential threat.
46
76
@@ -54,18 +84,54 @@ You can review and manage your current security alerts from Azure Security Cente
54
84
55
85
Alerts are generated by unusual and potentially harmful attempts to access or exploit storage accounts. These events can trigger the following alerts:
56
86
57
-
***Access from unusual location**: This alert is triggered when there's a change in the access pattern to a storage account. For instance, when someone has accessed a storage account from an unusual geographical location. In some cases, the alert detects a legitimate action (a new application or developer’s maintenance operation). In other cases, the alert detects a malicious action (former employee, external attacker, etc.).
87
+
### Anomalous access pattern alerts
88
+
89
+
***Access from unusual location**: This alert is triggered when there's a change in the access pattern to a storage account. For instance, when someone has accessed a storage account from an unusual geographical location.
90
+
Potential causes:
91
+
* An attacker has accessed your storage account
92
+
* A legitimate user has accessed your storage account from a new location
93
+
94
+
***Application Anomaly**: This alert indicates that an unusual application has accessed this storage account. Potential causes:
95
+
* An attacker has accessed your storage account using a new application.
96
+
* A legitimate user has used a new application/browser to access your storage account.
97
+
98
+
***Anonymous access**: This alert indicates that there is a change in the access pattern to a storage account. For example, this account has been accessed anonymously (i.e. without any authentication), which is unexpected compared to the recent access pattern on this account.
99
+
Potential causes:
100
+
* An attacker has exploited public read access to a container.
101
+
* A legitimate user or application has used public read access to a container.
102
+
103
+
### Anomalous extract/upload alerts
104
+
105
+
***Data Exfiltration**: This alert indicates that an unusually large amount of data has been extracted compared to recent activity on this storage container. Potential causes:
106
+
* An attacker has extracted a large amount of data from a container. (For example: data exfiltration/breach, unauthorized transfer of data)
107
+
* A legitimate user or application has extracted an unusual amount of data from a container. (For example: maintenance activity)
108
+
109
+
***Unexpected delete**: This alert indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account. Potential causes:
110
+
* An attacker has deleted data from your storage account.
111
+
* A legitimate user has performed an unusual deletion.
112
+
113
+
***Upload Azure Cloud Service package**: This alert indicates that an Azure Cloud Service package (.cspkg file) has been uploaded to a storage account in an unusual way, compared to recent activity on this account. Potential causes:
114
+
* An attacker has been preparing to deploy malicious code from your storage account to an Azure cloud service.
115
+
* A legitimate user has been preparing for a legitimate service deployment.
116
+
117
+
### Suspicious storage activities alerts
118
+
119
+
***Access permission change**: This alert indicates that the access permissions of this storage container have been changed in an unusual way. Potential causes:
120
+
* An attacker has changed container permissions to weaken its security.
121
+
* A legitimate user has changed container permissions.
122
+
123
+
***Access Inspection**: This alert indicates that the access permissions of a storage account have been inspected in an unusual way, compared to recent activity on this account. Potential causes:
124
+
* An attacker has performed reconnaissance for a future attack.
125
+
* A legitimate user has performed maintenance on the storage account.
126
+
127
+
***Data Exploration**: This alert indicates that blobs or containers in a storage account have been enumerated in an unusual way, compared to recent activity on this account. Potential causes:
128
+
* An attacker has performed reconnaissance for a future attack.
129
+
* A legitimate user or application logic has explored data within the storage account.
130
+
58
131
59
-
***Unusual data extraction**: This alert is triggered when there's a change in the data extraction pattern from a storage account. For instance, if someone has accessed an unusual amount of data in a storage account. In some cases, the alert detects a legitimate action (maintenance activity). In other cases, the alert detects a malicious action (data exfiltration/breach, unauthorized transfer of data).
60
132
61
-
***Unusual anonymous access:** This alert is triggered when there's a change in the access pattern to a storage account. For instance, suppose someone has anonymously accessed a storage account. In some cases, the alert detects a legitimate access using public read access. In other cases, the alert detects unauthorized access that exploits public read access to a container and its blobs.
62
133
63
-
***Unexpected delete:** This alert is triggered when one or more unexpected delete operations occur in a storage account, based on historical analysis of the storage account. For instance, suppose someone performed a *DeleteBlob* operation using a new application and from a new IP address. In some cases, the alert detects a legitimate action (the administrator used a different browser while traveling on business). In other cases, the alert detects a malicious action (an attacker deleting data).
64
-
65
-
***Access permission change:** This alert is triggered when there’s an unexpected change of access permission to a storage account. For instance, suppose someone changed the access permission to a storage account using a new application and from a new IP address. In some cases, the alert detects a legitimate action (the administrator used a different browser while traveling on business). In other cases, the alert detects a malicious action (e.g., an attacker increasing the privileges of an account they have gained access to).
66
134
67
-
***Upload Azure Cloud Service package:** This alert is triggered when there is an unexpected upload of an Azure Cloud Service package (*.cspkg* file) to a storage account. For instance, suppose a *.cspkg* file was uploaded from a new IP address. In some case, the alert detects a legitimate action. In other cases, the alert detects a malicious action (e.g., a Cloud Service package was uploaded in preparation for a deployment of a malicious service).
0 commit comments