Azure Security Center

Monitoring service that provides threat protection across all services
- both in Azure, and on-premises.
Gives security recommendations based on your configurations, resources, and networks.
- Part of https://www.cisecurity.org/cis-benchmarks/
Automatic security assessments through continuous monitoring to identify potential vulnerabilities before they can be exploited.
Just-in-time access control for ports through Azure Defender
Analyzes & identifies identify potential inbound attacks
- then helps to investigate threats and any post-breach activity that might have occurred.
Control apps
- Only the apps you validate are allowed to execute.
- Uses machine learning to detect and block malware from being installed on services
Helps with compliance through continous assesments & recommendations.

Tiers

Formerly known as Azure security center standard edition
Provides a full suite of security-related services including
- continuous monitoring
- threat detection
- just-in-time access control for ports
$15 per node per month, 30-day free trial available
❗ To upgrade to the Standard tier, you must be assigned the role of Subscription Owner, Subscription Contributor, or Security Admin.

Review the first indication of an event investigation.
E.g. you can use the Security Center dashboard to review the initial verification that a high-priority security alert was raised.

Perform the initial assessment to obtain more information about the suspicious activity.
E.g. obtain more information about the security alert.

Conduct a technical investigation and identify containment, mitigation, and workaround strategies.
E.g., follow the remediation steps described by Security Center in that particular security alert.

Set of controls that are recommended for resources within that specified subscription or resource group
You can reduce the chances of a significant security event by configuring a security policy

Based on security policies for potential vulnerabilities.
Guide you through the process of configuring the needed security controls.
E.g. if you have workloads that do not require the Azure SQL Database Transparent Data Encryption (TDE) policy, turn off the policy at the subscription level and enable it only in the resources groups where SQL TDE is required.