You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/auto-deploy-azure-monitoring-agent.md
+27-34Lines changed: 27 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,29 +1,22 @@
1
1
---
2
-
title: Deploy the Azure Monitor agent with auto provisioning
3
-
description: Learn how to deploy the Azure Monitor agent on your Azure, multicloud, and on-premises servers with auto provisioning to support Microsoft Defender for Cloud protections.
2
+
title: Deploy the Azure Monitor Agent with auto provisioning
3
+
description: Learn how to deploy the Azure Monitor Agent on your Azure, multicloud, and on-premises servers with auto provisioning to support Microsoft Defender for Cloud protections.
4
4
author: bmansheim
5
5
ms.author: benmansheim
6
6
ms.topic: how-to
7
7
ms.date: 08/03/2022
8
8
ms.custom: template-how-to
9
9
---
10
10
11
-
# Auto provision the Azure Monitor agent to protect your servers with Microsoft Defender for Cloud
11
+
# Auto provision the Azure Monitor Agent to protect your servers with Microsoft Defender for Cloud
12
12
13
-
To make sure that your server resources are secure, Microsoft Defender for Cloud uses agents installed on your servers to send information about your servers to Microsoft Defender for Cloud for analysis. You can use auto provisioning to quietly deploy the Azure Monitor agent on your servers.
13
+
To make sure that your server resources are secure, Microsoft Defender for Cloud uses agents installed on your servers to send information about your servers to Microsoft Defender for Cloud for analysis. You can use auto provisioning to quietly deploy the Azure Monitor Agent on your servers.
14
14
15
15
In this article, we're going to show you how to use auto provisioning to deploy the agent so that you can protect your servers.
| Relevant Defender plan: | - For [Endpoint protection assessment](endpoint-protection-recommendations-technical.md): [Security posture management (CSPM)](overview-page.md) (Free and enabled by default)<br>- For [Adaptive application controls](adaptive-application-controls.md): [Defender for Servers Plan 2](defender-for-servers-introduction.md)<br>- For [File Integrity Monitoring](file-integrity-monitoring-overview.md): [Defender for Servers Plan 2](defender-for-servers-introduction.md)<br>- For [Fileless attack detection](defender-for-servers-introduction.md#plan-features): [Defender for Servers Plan 2](defender-for-servers-introduction.md)|
- Make sure the Defender plans that you want Azure Monitor agent to support are enabled:
31
+
- Make sure the Defender plans that you want the Azure Monitor Agent to support are enabled:
39
32
-[Enable Defender for Servers Plan 2 on Azure and on-premises VMs](enable-enhanced-security.md)
40
33
-[Enable Defender plans on the subscriptions for your AWS VMs](quickstart-onboard-aws.md)
41
34
-[Enable Defender plans on the subscriptions for your GCP VMs](quickstart-onboard-gcp.md)
42
35
43
-
## Deploy the Azure Monitor agent with auto provisioning
36
+
## Deploy the Azure Monitor Agent with auto provisioning
44
37
45
-
To deploy the Azure Monitor agent with auto provisioning:
38
+
To deploy the Azure Monitor Agent with auto provisioning:
46
39
47
40
1. From Defender for Cloud's menu, open **Environment settings**.
48
41
1. Select the relevant subscription.
49
42
1. Open the **Auto provisioning** page.
50
43
51
-
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/select-auto-provisioning.png" alt-text="Screenshot of the auto provisioning menu item for enabling the Azure Monitor agent.":::
44
+
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/select-auto-provisioning.png" alt-text="Screenshot of the auto provisioning menu item for enabling the Azure Monitor Agent.":::
52
45
53
-
1. Enable deployment of the Azure Monitor agent:
46
+
1. Enable deployment of the Azure Monitor Agent:
54
47
55
-
1. For the **Log Analytics agent/Azure Monitor agent**, select the **On** status.
48
+
1. For the **Log Analytics agent/Azure Monitor Agent**, select the **On** status.
56
49
57
50
In the Configuration column, you can see the enabled agent type. When you enable auto provisioning, Defender for Cloud decides which agent to provision based on your environment. In most cases, the default is the Log Analytics agent.
58
51
59
-
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/turn-on-azure-monitor-agent-auto-provision.png" alt-text="Screenshot of the auto provisioning page for enabling the Azure Monitor agent." lightbox="media/auto-deploy-azure-monitoring-agent/turn-on-azure-monitor-agent-auto-provision.png":::
52
+
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/turn-on-azure-monitor-agent-auto-provision.png" alt-text="Screenshot of the auto provisioning page for enabling the Azure Monitor Agent." lightbox="media/auto-deploy-azure-monitoring-agent/turn-on-azure-monitor-agent-auto-provision.png":::
60
53
61
-
1. For the **Log Analytics agent/Azure Monitor agent**, select **Edit configuration**.
54
+
1. For the **Log Analytics agent/Azure Monitor Agent**, select **Edit configuration**.
62
55
63
-
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/configure-azure-monitor-agent-auto-provision.png " alt-text="Screenshot of editing the Azure Monitor agent configuration." lightbox="media/auto-deploy-azure-monitoring-agent/configure-azure-monitor-agent-auto-provision.png":::
56
+
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/configure-azure-monitor-agent-auto-provision.png " alt-text="Screenshot of editing the Azure Monitor Agent configuration." lightbox="media/auto-deploy-azure-monitoring-agent/configure-azure-monitor-agent-auto-provision.png":::
64
57
65
58
1. For the Auto-provisioning configuration agent type, select **Azure Monitor Agent**.
66
59
67
-
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/select-azure-monitor-agent-auto-provision.png" alt-text="Screenshot of selecting the Azure Monitor agent." lightbox="media/auto-deploy-azure-monitoring-agent/select-azure-monitor-agent-auto-provision.png":::
60
+
:::image type="content" source="./media/auto-deploy-azure-monitoring-agent/select-azure-monitor-agent-auto-provision.png" alt-text="Screenshot of selecting the Azure Monitor Agent." lightbox="media/auto-deploy-azure-monitoring-agent/select-azure-monitor-agent-auto-provision.png":::
68
61
69
62
By default:
70
63
71
-
- The Azure Monitor agent is installed on all existing machines in the subscription that don't already have it installed, and on all new machines created in the subscription.
64
+
- The Azure Monitor Agent is installed on all existing machines in the subscription that don't already have it installed, and on all new machines created in the subscription.
72
65
- The Log Analytics agent isn't uninstalled from machines that already have it installed. You can [leave the Log Analytics agent](#impact-of-running-with-both-the-log-analytics-and-azure-monitor-agents) on the machine, or you can manually [remove the Log Analytics agent](/azure/azure-monitor/agents/azure-monitor-agent-migration.md) if you don't require it for other protections.
73
66
- The agent sends data to the default workspace for the subscription. You can also [configure a custom workspace](#configure-custom-destination-log-analytics-workspace) to send data to.
74
67
- You can't enable [collection of additional security events](#additional-security-events-collection).
75
68
76
-
## Impact of running with both the Log Analytics and Azure Monitor agents
69
+
## Impact of running with both the Log Analytics and Azure Monitor Agents
77
70
78
-
You can run both the Log Analytics and Azure Monitor agents on the same machine, but you should be aware of these considerations:
71
+
You can run both the Log Analytics and Azure Monitor Agents on the same machine, but you should be aware of these considerations:
79
72
80
73
- Certain recommendations or alerts are reported by both agents and appear twice in Defender for Cloud.
81
74
- Each machine is billed once in Defender for Cloud, but make sure you track billing of other services connected to the Log Analytics and Azure Monitor, such as the Log Analytics workspace data ingestion.
82
75
- Both agents have performance impact on the machine.
83
76
84
77
When you enable auto provisioning, Defender for Cloud decides which agent to provision. In most cases, the default is the Log Analytics agent.
85
78
86
-
Learn more about [migrating to the Azure Monitor agent](/azure/azure-monitor/agents/azure-monitor-agent-migration.md).
79
+
Learn more about [migrating to the Azure Monitor Agent](/azure/azure-monitor/agents/azure-monitor-agent-migration.md).
When you install the Azure Monitor agent with auto-provisioning, you can define the destination workspace of the installed extensions. By default, the destination is the “default workspace” that Defender for Cloud creates for each region in the subscription: `defaultWorkspace-<subscriptionId>-<regionShortName>`. Defender for Cloud automatically configures the data collection rules, workspace solution, and additional extensions for that workspace.
85
+
When you install the Azure Monitor Agent with auto-provisioning, you can define the destination workspace of the installed extensions. By default, the destination is the “default workspace” that Defender for Cloud creates for each region in the subscription: `defaultWorkspace-<subscriptionId>-<regionShortName>`. Defender for Cloud automatically configures the data collection rules, workspace solution, and additional extensions for that workspace.
93
86
94
87
If you configure a custom Log Analytics workspace:
95
88
96
89
- Defender for Cloud only configures the data collection rules and additional extensions for the custom workspace. You'll have to configure the workspace solution on the custom workspace.
97
-
- Machines with Log Analytics agent that report to a Log Analytics workspace with the security solution are billed even when the Defender for Servers plan isn't enabled. Machines with the Azure Monitor agent are billed only when the plan is enabled on the subscription. The security solution is still required on the workspace to work with the plans features and to be eligible for the 500-MB benefit.
90
+
- Machines with Log Analytics agent that report to a Log Analytics workspace with the security solution are billed even when the Defender for Servers plan isn't enabled. Machines with the Azure Monitor Agent are billed only when the plan is enabled on the subscription. The security solution is still required on the workspace to work with the plans features and to be eligible for the 500-MB benefit.
98
91
99
-
To configure a custom destination workspace for the Azure Monitor agent:
92
+
To configure a custom destination workspace for the Azure Monitor Agent:
100
93
101
94
1. From Defender for Cloud's menu, open **Environment settings**.
102
95
1. Select the relevant subscription.
103
96
1. Open the **Auto provisioning** page.
104
-
1. For the **Log Analytics agent/Azure Monitor agent**, select **Edit configuration**.
97
+
1. For the **Log Analytics agent/Azure Monitor Agent**, select **Edit configuration**.
105
98
1. Select **Custom workspace**, and select the workspace that you want to send data to.
106
99
107
100
### Log analytics workspace solutions
108
101
109
-
The Azure Monitor agent requires Log analytics workspace solutions. These solutions are automatically installed when you auto-provision the Azure Monitor agent with the default workspace.
102
+
The Azure Monitor Agent requires Log analytics workspace solutions. These solutions are automatically installed when you auto-provision the Azure Monitor Agent with the default workspace.
110
103
111
104
The required [Log Analytics workspace solutions](/azure/azure-monitor/insights/solutions.md) for the data that you're collecting are:
112
105
@@ -115,7 +108,7 @@ The required [Log Analytics workspace solutions](/azure/azure-monitor/insights/s
115
108
116
109
### Additional extensions for Defender for Cloud
117
110
118
-
The Azure Monitor agent requires additional extensions. These extensions are automatically installed when you auto-provision the Azure Monitor agent:
111
+
The Azure Monitor Agent requires additional extensions. These extensions are automatically installed when you auto-provision the Azure Monitor Agent:
119
112
120
113
- For fileless attack detection: ASA extension
121
114
- For endpoint protection recommendations and fileless attack detection: ASA extension
@@ -124,13 +117,13 @@ The Azure Monitor agent requires additional extensions. These extensions are aut
124
117
125
118
When you auto-provision the Log Analytics agent in Defender for Cloud, you can choose to collect additional security events to the workspace. When you auto-provision the Log Analytics agent in Defender for Cloud, the option to collect additional security events to the workspace isn't available. Defender for Cloud doesn't rely on these security events, but they can be helpful for investigations through Microsoft Sentinel.
126
119
127
-
If you want to collect security events when you auto-provision the Azure Monitor agent, you can create a [Data Collection Rule](/azure-monitor/essentials/data-collection-rule-overview.md) to collect the required events.
120
+
If you want to collect security events when you auto-provision the Azure Monitor Agent, you can create a [Data Collection Rule](/azure-monitor/essentials/data-collection-rule-overview.md) to collect the required events.
128
121
129
122
Like for Log Analytics workspaces, Defender for Cloud users are eligible for [500-MB of free data](enhanced-security-features-overview.md#faq---pricing-and-billing) daily on defined data types that include security events.
130
123
131
124
## Next steps
132
125
133
-
Now that you enabled the Azure Monitor agent, check out the features that are supported by the agent:
126
+
Now that you enabled the Azure Monitor Agent, check out the features that are supported by the agent:
0 commit comments