This article is contributed. See the original author and article here.
|
We continue to expand the Azure Marketplace ecosystem. For this volume, 75 new offers successfully met the onboarding criteria and went live. See details of the new offers below: |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This article is contributed. See the original author and article here.
We are aware of issues within Azure Monitoring Services and are actively investigating. There is an outage on storage event in UK South which caused multiple services to be impacted.
We are working hard to resolve this issue and apologize for any inconvenience.
-Mohini
This article is contributed. See the original author and article here.
Log Analytics is a great way to query your data and reach insights.
Did you know Log Analytics allows you to easily share your insights and queries with others – right from the UI?
How to?
After composing your query, you can use our copy link menu to choose what you want to share:
You can:
1. Copy a link to the query – A link to the query will be copied to your clipboard, recipients will be able to drill into Log Analytics and run the query you shared with them.
2. Copy query text – your query text and a link to the query will be copied to the clipboard.
3. Copy results – your result set and a link to the query will be copied to your clipboard.
After selecting what you want to share, simply paste it in your favorite tool.
In my example, I used e-mail:
Please note, the recipient of your query must have sufficient permissions and Azure access to run the query.
Receiving a query:
When your recipients receives the query link, all they need to do is click it.
Log Analytics will open in the right context and will run the query:
Summary:
Sharing an insight right from the UI is quick and easy.
Try using it today!
This article is contributed. See the original author and article here.
This installment is part of a broader series to keep you up to date with the latest features in Azure Sentinel. The installments will be bite-sized to enable you to easily digest the new content.
Today we are announcing a new feature in Azure Sentinel that enhances our multi-workspace and multi-tenant capabilities.
As you might know, there are certain occasions where your Azure Sentinel environment is spread across multiple workspaces. There are various reasons for this, like data ownership requirements or multi-tenant/multi-geography setups. For a full explanation of use cases and alternatives, refer to Extend Sentinel across workspaces/tenants.
In these cases, there’s normally the need to have a central place where we can oversee the whole environment. This can be for example a global SOC or in the case of an MSSP, a multi-customer console. This central place can be also used to replicate configuration (analytics rules, workbooks, playbooks,…) and manage all your workspace from a single point, ideally using DevOps processes and tooling. The following diagram describes this setup:
Up to now, customers and partners were able to do many things across workspaces, like hunting, workbooks and incident management.
Today we are happy to present the ability to create Analytics Rules that inspect data stored across multiple workspaces! 
With this new feature you can now create in your Central SOC, an analytics rule that spans across other workspaces, like shown in this picture:
This can also be used in a multi-tenant setup (using Azure Lighthouse) like shown here:
There are some things you need to consider when using this feature:
One of the great things about this feature, is that alerts and incidents created as part of a cross-workspace analytics rule, will also contain all the related entities, even if those entities are not from the workspace where the rule and incident where triggered.
This, for example, will allow analysts to analyze data from all workspaces related to an alert/incident.
Some other features are still not fully functional in the cross-workspace scenario, like full visual investigation or UEBA. These will come in the future.
There are mainly two scenarios where customer and partners can benefit from this new feature:
There are other scenarios where customers and partners should not use cross-workspace rules:
Creating a cross-workspace rule is very easy…the only thing that changes compared to a regular rule is the query itself. In order to span multiple workspaces, you need to include the workspace and union KQL statements, adding tables from other workspaces as needed (remember the limit is 15). For example, a query to find EventID 4625 in two workspaces, would look like this:
workspace('<workspace-A>').SecurityEvent
| union workspace('<workspace-B>').SecurityEvent
| where EventID == '4625'
Remember that you can also leverage KQL functions to create aliases, that make it easier for you to use multiple workspaces. For example, you could create a function named wsAB_SecurityEvent that contains:
workspace('<workspace-A>').SecurityEvent
| union workspace('<workspace-B>').SecurityEvent
After defining this function, you can just use it in your analytics rules like this:
wsAB_SecurityEvent
| where EventID == '4625'
This new feature has special relevance for MSSPs as they normally manage multiple Sentinel environments spread across multiple organizations and tenants.
One of the reasons to use this feature is for example when the MSSP needs to hide the contents of the query from the end customer. In that case, the MSSP can create the query in its own tenant and Sentinel workspace but point at the customer workspace. See more information about protecting MSSPs intellectual property in this blog post.
The recommended approach for this scenario is to create analytics rules that only contain workspaces from a single customer (see diagram below). Mixing customer workspaces into a single analytics rule can lead to confusion and poor manageability.
The analytics rules in this case would contain a KQL query that doesn’t need the union statement, they would be as simple as this:
workspace('customerA_workspace').SecurityEvent
| where EventID == '4625'
We encourage you to leverage this new feature that enhances our cross-workspace capabilities and offers more flexibility in the way you organize your SOC.
Try it out, and let us know what you think!
This article is contributed. See the original author and article here.
Fluid Framework is now open source! It is built from the ground up for low latency collaboration and synchronization. Checkout the docs and playground examples our team helped put together!
Follow Us on Twitter @azureadvocates to stay up to date with all our activity!
Content Round Up
Fluid Storybook.js Integration – Phase 1
Dan Wahlin
Azure Stack Hub Partner Solutions Series – Eversource
Thomas Maurer
Together with the Azure Stack Hub team, we are starting a journey to explore the ways our customers and partners use, deploy, manage, and build solutions on the Azure Stack Hub platform. Together with the Tiberiu Radu (Azure Stack Hub PM @rctibi) and myself (Azure Cloud Advocate @ThomasMaurer), we created a new Azure Stack Hub Partner solution video series to show how our customers and partners use Azure Stack Hub in their Hybrid Cloud environment. In this series, as we will meet customers that are deploying Azure Stack Hub for their own internal departments, partners that run managed services on behalf of their customers, and a wide range of in-between as we look at how our various partners are using Azure Stack Hub to bring the power of the cloud on-premises.
How I Built a Resume API w/ JavaScript and Azure Functions [Community]
Lucie Simeckova
Been inspired by the Cloud Resume Challenge by Forest Brazeal to build more stuff in the cloud. I wanted to build something simple to continue my Cloud journey. I decided to build an open-source REST API for my JSON-based standard format resume. I’m using JavaScript and Azure Functions. Also, this would be a great challenge for newbies getting into Azure functions, a hands-on micro project to get started with Azure Functions.
Notify about YouTube comments with Azure Functions
Lucie Simeckova
In this article, we’ll use Azure Functions and a couple of third-party APIs to create a JavaScript serverless application to send notification emails when new comments are added in any video from a YouTube channel.
Creating a baby boy chatbot name finder with no servers to worry about
Lucie Simeckova
Serverless services are your great ally when dealing with an evolving architecture. Mo will show you how a strategic, tactically motivated evolution journey could look like. To build nothing less and utterly grand such as a baby boy name generator for puzzled parents. We’ll talk about SAAS vs serverless as well, which is a fine but distinct line.
RFM NAV Customer Classification with Python and Azure Functions
Lucie Simeckova
The main goal of this article is to show you how you could modernize your old fashion NAV on-premises ERP, giving some of the Cloud power out there, using the Serverless Azure Functions Architecture. We will create an Azure Function that would act as an API Rest endpoint to classify customer based on their RFM score so we can integrate this information into the customer e-commerce. We will use SQL to add the RFM classification login and Python to create the Azure Function.
Medical Image Classification using Azure Functions and Cognitive Services
Lucie Simeckova
Azure Functions with PowerShell: Swiss army knife for Ops [Community]
Lucie Simeckova
Nowadays, infrastructure tasks have reached a new level with the help of devs tools (like control version system) but, operations teams take all of the advantages of ‘new world’? Serverless computing enables ways to build and create applications without concern about managing the infrastructure.
Handle Cosmos Cassandra API Rate Limiting for Go apps
Abhishek Gupta
Azure Cosmos DB is a resource governed system that allows you to execute a certain number of operations per second based on the provisioned throughput you have configured. If clients exceed that limit and consume more request units than what was provisioned, it leads to rate limiting of subsequent requests and exceptions being thrown – they are also referred to as 429 errors.
Blog/ Project Bicep Sneak Peek
Justin Yoo
This post discusses how Bicep, the ARM template DSL, looks like and how we can leverage it for ARM template authoring.
Why Every Developer Should Become a Writer
Lucas Santos
Azure Stack Hub Partner Solutions Series – Eversource
Thomas Maurer
Together with the Azure Stack Hub team, we are starting a journey to explore the ways our customers and partners use, deploy, manage, and build solutions on the Azure Stack Hub platform. Together with the Tiberiu Radu (Azure Stack Hub PM @rctibi) and myself (Azure Cloud Advocate @ThomasMaurer), we created a new Azure Stack Hub Partner solution video series to show how our customers and partners use Azure Stack Hub in their Hybrid Cloud environment. In this series, as we will meet customers that are deploying Azure Stack Hub for their own internal departments, partners that run managed services on behalf of their customers, and a wide range of in-between as we look at how our various partners are using Azure Stack Hub to bring the power of the cloud on-premises.
Surface Duo Dev: Do One Better with Dual Screens!
Nitya Narasimhan
Surface Duo Dev: Learning Resources For Beginners
Nitya Narasimhan
Azure Automatic VM guest OS patching
Thomas Maurer
Microsoft 365 Developer Podcast – Fluid
Dan Wahlin
An introduction to service mesh with Linkerd
Lucas Santos
Xamarin Podcast Ep 77: Surface Duo, Android Startup Times, and Xamarin.Essentials
Matt Soucoup
Recent Comments