|
1 | 1 | --- |
2 | | -title: Integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points |
| 2 | +title: Integrate Microsoft Defender's ransomware alerts to protect Azure Backup recovery points |
3 | 3 | description: Learn how to integrate Microsoft Defender for Cloud and Azure Backup using logic app. |
4 | 4 | ms.topic: how-to |
5 | 5 | ms.custom: references_regions |
6 | | -ms.date: 03/13/2024 |
| 6 | +ms.date: 03/25/2025 |
7 | 7 | ms.service: azure-backup |
8 | 8 | author: jyothisuri |
9 | 9 | ms.author: jsuri |
10 | 10 | --- |
11 | 11 |
|
12 | | -# Solution sample to integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points |
| 12 | +# Integrate Microsoft Defender's ransomware alerts to protect Azure Backup recovery points |
13 | 13 |
|
14 | | -This article describes the sample solution that demonstrates how to integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points. Assume there has been a breach on the Virtual Machine that is protected by both Defender and Azure Backup. Defender detects the ransomware, raises an alert which includes details of the activity and suggested recommendations to remediate. As soon as a ransomware signal is detected from Defender, ensuring backups are preserved (i.e., paused from expiring) to minimize the data loss is top of our customers’ mind. |
| 14 | +This article describes how to integrate Microsoft Defender's ransomware alerts to preserve Azure Backup recovery points. Assume there has been a breach on the Virtual Machine that is protected by both Defender and Azure Backup. Defender detects the ransomware, raises an alert which includes details of the activity and suggested recommendations to remediate. As soon as a ransomware signal is detected from Defender, ensuring backups are preserved (i.e., paused from expiring) to minimize the data loss is top of our customers’ mind. |
15 | 15 |
|
16 | 16 | Azure Backup provides several security capabilities to help you protect your backup data. [Soft delete](backup-azure-security-feature-cloud.md), [Immutable vaults](backup-azure-immutable-vault-concept.md), [Multi-User Authorization (MUA)](multi-user-authorization-concept.md) are part of a comprehensive data protection strategy for backup data. Soft delete is enabled by default, with option to make it always-on (irreversible). Soft deleted backup data is retained at no additional cost for *14* days, with option to [extend the duration](backup-azure-enhanced-soft-delete-about.md). Enabling immutability on vaults can protect backup data by blocking any operations that could lead to loss of recovery points. You can configure Multi-user authorization (MUA) for Azure Backup as an additional layer of protection to critical operations on your Recovery Services vaults. By default, critical alert for destructive operation (such as stop protection with delete backup data) is raised and an email is sent to subscription owners, admins, and co-admins. |
17 | 17 |
|
18 | 18 | Microsoft Defender for Cloud (MDC) is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for all of your Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources. Defender for Cloud generates security alerts when threats are identified in your cloud, hybrid, or on-premises environment. It's available when you enable enhanced security features. Each alert provides details of affected resources along with the information you need to quickly investigate the issue and steps to take to remediate an attack. If a malware or a ransomware attacks on an Azure Virtual Machine, Microsoft Defender for Cloud detects suspicious activity and indicators associated with ransomware on an Azure VM and generates a Security Alert. Examples of the Defender for Cloud Alerts that trigger on a Ransomware detection: *Ransomware indicators detected*, *Behavior similar to ransomware detected*, and so on. |
19 | 19 |
|
20 | 20 | >[!Note] |
21 | | -> This sample solution is scoped to Azure Virtual Machines. You can deployed the logic app only at a subscription level, which means all Azure VMs under the subscription can use the logic app to pause expiry of recovery points in the event of a security alert. |
| 21 | +> This solution is scoped to Azure Virtual Machines. You can deployed the logic app only at a subscription level, which means all Azure VMs under the subscription can use the logic app to pause expiry of recovery points in the event of a security alert. |
22 | 22 |
|
23 | | -## Solution details |
| 23 | +## Solution workflow |
24 | 24 |
|
25 | | -This sample solution demonstrates integration of Azure Backup with Microsoft Defender for Cloud (MDC) for detection and response to alerts to accelerate response. Sample illustrates the following three use cases: |
| 25 | +This solution demonstrates integration of Azure Backup with Microsoft Defender for Cloud (MDC) for detection and response to alerts to accelerate response. The disgram illustrates the following three use cases: |
26 | 26 |
|
27 | 27 | - Ability to send email alerts to the Backup Admin. |
28 | 28 | - Security Admin to triage and manually trigger logic app to secure backups. |
|
0 commit comments