Skip to content

Commit a632487

Browse files
authored
Merge pull request #229529 from MicrosoftDocs/main
Publish to live, Sunday 4 PM PST, 3/5
2 parents bf9faf6 + 5d315fc commit a632487

File tree

51 files changed

+533
-772
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+533
-772
lines changed

.openpublishing.redirection.defender-for-cloud.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -804,6 +804,11 @@
804804
"source_path_from_root": "/articles/defender-for-cloud/supported-machines-endpoint-solutions-clouds-servers.md",
805805
"redirect_url": "/azure/defender-for-cloud/support-matrix-defender-for-servers",
806806
"redirect_document_id": true
807+
},
808+
{
809+
"source_path_from_root": "/articles/defender-for-cloud/faq-azure-monitor-logs.yml",
810+
"redirect_url": "/azure/defender-for-cloud/faq-data-collection-agents",
811+
"redirect_document_id": true
807812
}
808813
]
809814
}

.openpublishing.redirection.defender-for-iot.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
{
22
"redirections": [
3+
{
4+
"source_path_from_root": "/articles/defender-for-iot/organizations/how-to-work-with-device-notifications.md",
5+
"redirect_url": "/azure/defender-for-iot/organizations/how-to-work-with-the-sensor-device-map#manage-device-notifications-from-an-ot-sensor-device-map",
6+
"redirect_document_id": false
7+
},
8+
{
9+
"source_path_from_root": "/articles/defender-for-iot/organizations/how-to-view-information-per-zone.md",
10+
"redirect_url": "/azure/defender-for-iot/organizations/how-to-work-with-the-sensor-device-map#view-a-device-map-for-a-specific-zone",
11+
"redirect_document_id": false
12+
},
313
{
414
"source_path_from_root": "/articles/defender-for-iot/organizations/resources-training-sessions.md",
515
"redirect_url": "https://techcommunity.microsoft.com/t5/microsoft-defender-for-iot-blog/microsoft-defender-for-iot-ninja-training/ba-p/2428899",

articles/azure-monitor/alerts/alerts-create-new-alert-rule.md

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ author: AbbyMSFT
55
ms.author: abbyweisberg
66
ms.topic: conceptual
77
ms.custom: ignite-2022
8-
ms.date: 02/12/2023
8+
ms.date: 03/05/2023
99
ms.reviewer: harelbr
1010
---
1111
# Create a new alert rule
@@ -30,23 +30,20 @@ Then you define these elements for the resulting alert actions by using:
3030

3131
1. On the **Select a resource** pane, set the scope for your alert rule. You can filter by **subscription**, **resource type**, or **resource location**.
3232

33-
The **Available signal types** for your selected resources are at the bottom right of the pane.
34-
3533
> [!NOTE]
3634
> If you select a Log analytics workspace resource, keep in mind that if the workspace receives telemetry from resources in more than one subscription, alerts are sent about those resources from different subscriptions.
3735
3836
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-select-resource.png" alt-text="Screenshot that shows the select resource pane for creating a new alert rule.":::
3937

40-
1. Select **Include all future resources** to include any future resources added to the selected scope.
41-
1. Select **Done**.
38+
1. Select **Apply**.
4239
1. Select **Next: Condition** at the bottom of the page.
43-
1. On the **Select a signal** pane, filter the list of signals by using the signal type and monitor service:
40+
1. On the **Select a signal** pane, you can search for the signal name or you can filter the list of signals by:
4441
- **Signal type**: The [type of alert rule](alerts-overview.md#types-of-alerts) you're creating.
45-
- **Monitor service**: The service sending the signal. This list is pre-populated based on the type of alert rule you selected.
42+
- **Signal source**: The service sending the signal. The list is pre-populated based on the type of alert rule you selected.
4643

4744
This table describes the services available for each type of alert rule:
4845

49-
|Signal type |Monitor service |Description |
46+
|Signal type |Signal source |Description |
5047
|---------|---------|---------|
5148
|Metrics|Platform |For metric signals, the monitor service is the metric namespace. "Platform" means the metrics are provided by the resource provider, namely, Azure.|
5249
| |Azure.ApplicationInsights|Customer-reported metrics, sent by the Application Insights SDK. |
@@ -60,7 +57,8 @@ Then you define these elements for the resulting alert actions by using:
6057
|Resource health|Resource health|The service that provides the resource-level health status. |
6158
|Service health|Service health|The service that provides the subscription-level health status. |
6259

63-
1. Select the **Signal name**, and follow the steps in the following tab that corresponds to the type of alert you're creating.
60+
1. Select the **Signal name** and **Apply**.
61+
1. Follow the steps in the tab that corresponds to the type of alert you're creating.
6462

6563
### [Metric alert](#tab/metric)
6664

@@ -75,7 +73,7 @@ Then you define these elements for the resulting alert actions by using:
7573

7674
Dimensions are name-value pairs that contain more data about the metric value. By using dimensions, you can filter the metrics and monitor specific time-series, instead of monitoring the aggregate of all the dimensional values.
7775

78-
If you select more than one dimension value, each time series that results from the combination will trigger its own alert and be charged separately. For example, the transactions metric of a storage account can have an API name dimension that contains the name of the API called by each transaction (for example, GetBlob, DeleteBlob, and PutPage). You can choose to have an alert fired when there's a high number of transactions in a specific API (the aggregated data). Or you can use dimensions to alert only when the number of transactions is high for specific APIs.
76+
If you select more than one dimension value, each time series that results from the combination triggers its own alert and is charged separately. For example, the transactions metric of a storage account can have an API name dimension that contains the name of the API called by each transaction (for example, GetBlob, DeleteBlob, and PutPage). You can choose to have an alert fired when there's a high number of transactions in a specific API (the aggregated data). Or you can use dimensions to alert only when the number of transactions is high for specific APIs.
7977

8078
|Field |Description |
8179
|---------|---------|
@@ -89,7 +87,7 @@ Then you define these elements for the resulting alert actions by using:
8987
|Field |Description |
9088
|---------|---------|
9189
|Threshold|Select if the threshold should be evaluated based on a static value or a dynamic value.<br>A **static threshold** evaluates the rule by using the threshold value that you configure.<br>**Dynamic thresholds** use machine learning algorithms to continuously learn the metric behavior patterns and calculate the appropriate thresholds for unexpected behavior. You can learn more about using [dynamic thresholds for metric alerts](alerts-types.md#dynamic-thresholds). |
92-
|Operator|Select the operator for comparing the metric value against the threshold. <br>If you are using dynamic thresholds, alert rules can use tailored thresholds based on metric behavior for both upper and lower bounds in the same alert rule. Select one of these operators: <br> - Greater than the upper threshold or lower than the lower threshold (default) <br> - Greater than the upper threshold <br> - Lower than the lower threshold|
90+
|Operator|Select the operator for comparing the metric value against the threshold. <br>If you're using dynamic thresholds, alert rules can use tailored thresholds based on metric behavior for both upper and lower bounds in the same alert rule. Select one of these operators: <br> - Greater than the upper threshold or lower than the lower threshold (default) <br> - Greater than the upper threshold <br> - Lower than the lower threshold|
9391
|Aggregation type|Select the aggregation function to apply on the data points: Sum, Count, Average, Min, or Max. |
9492
|Threshold value|If you selected a **static** threshold, enter the threshold value for the condition logic. |
9593
|Unit|If the selected metric signal supports different units, such as bytes, KB, MB, and GB, and if you selected a **static** threshold, enter the unit for the condition logic.|
@@ -102,9 +100,9 @@ Then you define these elements for the resulting alert actions by using:
102100
|Field |Description |
103101
|---------|---------|
104102
|Check every|Select how often the alert rule checks if the condition is met. |
105-
|Lookback period|Select how far back to look each time the data is checked. For example, every 1 minute you’ll be looking at the past 5 minutes.|
103+
|Lookback period|Select how far back to look each time the data is checked. For example, every 1 minute, look back 5 minutes.|
106104

107-
1. (Optional) In the **Advanced options** section, you can specify how many failures within a specific time period will trigger the alert. For example, you can specify that you only want to trigger an alert if there were three failures in the last hour. This setting is defined by your application business policy.
105+
1. (Optional) In the **Advanced options** section, you can specify how many failures within a specific time period trigger an alert. For example, you can specify that you only want to trigger an alert if there were three failures in the last hour. Your application business policy should determine this setting.
108106

109107
Select values for these fields:
110108

@@ -121,7 +119,7 @@ Then you define these elements for the resulting alert actions by using:
121119
> [!NOTE]
122120
> If you're creating a new log alert rule, note that the current alert rule wizard is different from the earlier experience. For more information, see [Changes to the log alert rule creation experience](#changes-to-the-log-alert-rule-creation-experience).
123121
124-
1. On the **Logs** pane, write a query that will return the log events for which you want to create an alert.
122+
1. On the **Logs** pane, write a query that returns the log events for which you want to create an alert.
125123
To use one of the predefined alert rule queries, expand the **Schema and filter** pane on the left of the **Logs** pane. Then select the **Queries** tab, and select one of the queries.
126124

127125
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-log-rule-query-pane.png" alt-text="Screenshot that shows the Query pane when creating a new log alert rule.":::
@@ -177,7 +175,7 @@ Then you define these elements for the resulting alert actions by using:
177175

178176
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-create-log-rule-logic.png" alt-text="Screenshot that shows the Alert logic section of a new log alert rule.":::
179177

180-
1. (Optional) In the **Advanced options** section, you can specify the number of failures and the alert evaluation period required to trigger an alert. For example, if you set **Aggregation granularity** to 5 minutes, you can specify that you only want to trigger an alert if there were three failures (15 minutes) in the last hour. This setting is defined by your application business policy.
178+
1. (Optional) In the **Advanced options** section, you can specify the number of failures and the alert evaluation period required to trigger an alert. For example, if you set **Aggregation granularity** to 5 minutes, you can specify that you only want to trigger an alert if there were three failures (15 minutes) in the last hour. Your application business policy determines this setting.
181179

182180
Select values for these fields under **Number of violations to trigger the alert**:
183181

@@ -334,7 +332,7 @@ Then you define these elements for the resulting alert actions by using:
334332

335333
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-rule-tags-tab.png" alt-text="Screenshot that shows the Tags tab when creating a new alert rule.":::
336334

337-
1. On the **Review + create** tab, a validation will run and inform you of any issues.
335+
1. On the **Review + create** tab, the rule is validated, and lets you know about any issues.
338336
1. When validation passes and you've reviewed the settings, select the **Create** button.
339337

340338
:::image type="content" source="media/alerts-create-new-alert-rule/alerts-rule-review-create.png" alt-text="Screenshot that shows the Review and create tab when creating a new alert rule.":::

articles/azure-monitor/alerts/alerts-manage-alert-rules.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Manage your alert rules in the Azure portal, or using the CLI or Po
44
author: AbbyMSFT
55
ms.author: abbyweisberg
66
ms.topic: conceptual
7-
ms.date: 02/20/2023
7+
ms.date: 03/05/2023
88
ms.reviewer: harelbr
99
---
1010
# Manage your alert rules
-59.3 KB
Loading

articles/azure-monitor/essentials/azure-monitor-workspace-overview.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ ms.date: 01/22/2023
1111
# Azure Monitor workspace (preview)
1212
An Azure Monitor workspace is a unique environment for data collected by Azure Monitor. Each workspace has its own data repository, configuration, and permissions.
1313

14-
14+
> [!Note]
15+
> Log Analytics workspaces contain logs and metrics data from multiple Azure resources, whereas Azure Monitor workspaces contain only metrics related to Prometheus.
16+
1517
## Contents of Azure Monitor workspace
1618
Azure Monitor workspaces will eventually contain all metric data collected by Azure Monitor. Currently, only Prometheus metrics are data hosted in an Azure Monitor workspace.
1719

articles/azure-monitor/logs/basic-logs-configure.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ Configure a table for Basic logs if:
5858
| Media Services | [AMSLiveEventOperations](/azure/azure-monitor/reference/tables/AMSLiveEventOperations)<br>[AMSKeyDeliveryRequests](/azure/azure-monitor/reference/tables/AMSKeyDeliveryRequests)<br>[AMSMediaAccountHealth](/azure/azure-monitor/reference/tables/AMSMediaAccountHealth)<br>[AMSStreamingEndpointRequests](/azure/azure-monitor/reference/tables/AMSStreamingEndpointRequests) |
5959
| Sphere | [ASCAuditLogs](/azure/azure-monitor/reference/tables/ASCAuditLogs)<br>[ASCDeviceEvents](/azure/azure-monitor/reference/tables/ASCDeviceEvents) |
6060
| Storage | [StorageBlobLogs](/azure/azure-monitor/reference/tables/StorageBlobLogs)<br>[StorageFileLogs](/azure/azure-monitor/reference/tables/StorageFileLogs)<br>[StorageQueueLogs](/azure/azure-monitor/reference/tables/StorageQueueLogs)<br>[StorageTableLogs](/azure/azure-monitor/reference/tables/StorageTableLogs) |
61-
| Storage Mover | [StorageMoverJobRunLogs](/azure/azure-monitor/reference/tables/StorageMoverJobRunLogs) |
61+
| Storage Mover | [StorageMoverJobRunLogs](/azure/azure-monitor/reference/tables/StorageMoverJobRunLogs)<br>[StorageMoverCopyLogsFailed](/azure/azure-monitor/reference/tables/StorageMoverCopyLogsFailed)<br>[StorageMoverCopyLogsTransferred](/azure/azure-monitor/reference/tables/StorageMoverCopyLogsTransferred)<br> |
6262
| Virtual Network Manager | [AVNMNetworkGroupMembershipChange](/azure/azure-monitor/reference/tables/AVNMNetworkGroupMembershipChange) |
6363

6464
> [!NOTE]

articles/defender-for-cloud/TOC.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@
2323
href: faq-data-collection-agents.yml
2424
- name: Azure Virtual Machines questions
2525
href: faq-vms.yml
26-
- name: Azure Log Analytics questions
27-
href: faq-azure-monitor-logs.yml
2826

2927
- name: Quickstarts
3028
items:
@@ -654,6 +652,8 @@
654652
href: episode-twenty-five.md
655653
- name: Governance capability improvements in Defender for Cloud
656654
href: episode-twenty-six.md
655+
- name: Demystifying Defender for Servers
656+
href: episode-twenty-seven.md
657657
- name: Manage user data
658658
href: privacy.md
659659
- name: Microsoft Defender for IoT documentation

articles/defender-for-cloud/defender-for-cloud-introduction.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ Today’s applications require security awareness at the code, infrastructure, a
2323

2424
| Capability | What problem does it solve? | Get started | Defender plan and pricing |
2525
| ---------- | --------------------------- | ----------- | ------------------------- |
26-
| [Code pipeline insights](defender-for-devops-introduction.md) | Empowers security teams with the ability to protect applications and resources from code to cloud across multi-pipeline environments, including GitHub and Azure DevOps. Findings from Defender for DevOps, such as IaaC misconfigurations and exposed secrets, can then be correlated with other contextual cloud security insights to prioritize remediation in code. | Connect [Azure DevOps](quickstart-onboard-devops.md) and [GitHub](quickstart-onboard-github.md) repositories to Defender for Cloud | [Defender for DevOps](https://azure.microsoft.com/pricing/details/defender-for-cloud/) |
26+
| [Code pipeline insights](defender-for-devops-introduction.md) | Empowers security teams with the ability to protect applications and resources from code to cloud across multi-pipeline environments, including GitHub and Azure DevOps. Findings from Defender for DevOps, such as IaC misconfigurations and exposed secrets, can then be correlated with other contextual cloud security insights to prioritize remediation in code. | Connect [Azure DevOps](quickstart-onboard-devops.md) and [GitHub](quickstart-onboard-github.md) repositories to Defender for Cloud | [Defender for DevOps](https://azure.microsoft.com/pricing/details/defender-for-cloud/) |
2727

2828
## Improve your security posture
2929

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
title: Demystifying Defender for Servers | Defender for Cloud in the field
3+
titleSuffix: Microsoft Defender for Cloud
4+
description: Learn about different deployment options in Defender for Servers
5+
ms.topic: reference
6+
ms.date: 03/05/2023
7+
---
8+
9+
# Demystifying Defender for Servers | Defender for Cloud in the field
10+
11+
**Episode description**: In this episode of Defender for Cloud in the Field, Tom Janetscheck joins Yuri Diogenes to talk about the different deployment options in Defender for Servers. Tom covers the different agents available and the scenarios that will be most used for each agent, including the agentless feature. Tom also talks about the different vulnerability assessment solutions available, and how to deploy Defender for Servers at scale via policy or custom automation.
12+
<br>
13+
<br>
14+
<iframe src="https://aka.ms/docs/player?id=dd9d789d-6685-47f1-9947-d31966aa4372" width="1080" height="530" allowFullScreen="true" frameBorder="0"></iframe>
15+
16+
- [02:14](/shows/mdc-in-the-field/demystify-servers#time=02m14s) - Understanding Defender for Servers P1 and P2
17+
- [06:15](/shows/mdc-in-the-field/demystify-servers#time=06m15s) - Pricing model
18+
- [07:37](/shows/mdc-in-the-field/demystify-servers#time=07m37s) - Integration with MDE
19+
- [10:08](/shows/mdc-in-the-field/demystify-servers#time=10m08s) - Using Defender for Servers P2 without MDE
20+
- [11:32](/shows/mdc-in-the-field/demystify-servers#time=11m32s) - Understanding the different types of agents used by Defender for Servers
21+
- [17:11](/shows/mdc-in-the-field/demystify-servers#time=17m11s) - The case for agentless implementation
22+
- [22:52](/shows/mdc-in-the-field/demystify-servers#time=22m52s) - Deploying Defender for Servers at scale
23+
24+
25+
## Recommended resources
26+
- Learn more about [Defender for Servers](plan-defender-for-servers.md)
27+
- Subscribe to [Microsoft Security on YouTube](https://www.youtube.com/playlist?list=PL3ZTgFEc7LysiX4PfHhdJPR7S8mGO14YS)
28+
- Join our [Tech Community](https://aka.ms/SecurityTechCommunity)
29+
- For more about [Microsoft Security](https://msft.it/6002T9HQY)
30+
31+
- Follow us on social media:
32+
33+
- [LinkedIn](https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFk5TXZuQld2NlpBRV9BQlJqMktYSm95WWhCZ3xBQ3Jtc0tsQU13MkNPWGNFZzVuem5zc05wcnp0VGxybHprVTkwS2todWw0b0VCWUl4a2ZKYVktNGM1TVFHTXpmajVLcjRKX0cwVFNJaDlzTld4MnhyenBuUGRCVmdoYzRZTjFmYXRTVlhpZGc4MHhoa3N6ZDhFMA&q=https%3A%2F%2Fwww.linkedin.com%2Fshowcase%2Fmicrosoft-security%2F)
34+
- [Twitter](https://twitter.com/msftsecurity)
35+
36+
- Join our [Tech Community](https://aka.ms/SecurityTechCommunity)
37+
38+
- Learn more about [Microsoft Security](https://msft.it/6002T9HQY)
39+
40+
## Next steps
41+
42+
> [!div class="nextstepaction"]
43+
> [New AWS Connector in Microsoft Defender for Cloud](episode-one.md)

0 commit comments

Comments
 (0)