Detecting vulnerabilities with Defender
Up until now, we have focused much on the use of Microsoft Sentinel to monitor signs of compromise or reconnaissance attacks; however, we want to ensure that it never gets to that point. As mentioned earlier, one of the typical attack vectors is exploiting vulnerabilities to get in.
This means that we need to ensure that we are tracking vulnerabilities in our environment and acting to remediate them when possible. Microsoft Defender provides vulnerability management as part of its features for VMs in addition to other services in Azure.
Defender supports the following workloads and provides the following features:
- Servers: EDR capabilities, just-in-time (JIT) access (for Azure-only resources) and threat protection, asset inventory, and file integrity monitoring. This feature supports servers also managed through Azure Arc.
- Azure App Services: Threat protection.
- Azure databases: Threat protection.
- Azure Storage: Threat...
