Implementing Azure Defender for Storage
Read, write, and delete requests to the Blob and Files services are logged by the storage service as resource logs. Azure Defender for Storage can ingest these logs and analyze them for suspicious events. Without a service like this, analyzing these logs requires security expertise and a significant amount of time.
When Azure Defender for Storage detects unusual and potentially harmful events, it raises an alert in Security Center for us to investigate and remediate threats. We will cover Security Center in a later chapter:
Figure 10.52 – Enabling Azure Defender for Storage
Azure Defender for Storage can be enabled from the Security blade of a storage account resource in the Azure portal or from the pricing and settings blade in Security Center (Figure 10.52). This can also be enabled at scale using Azure policy.
Cleaning up resources
In the Azure portal, delete the azuresec-c10-rg resource group...
