Meet a recent Microsoft Learn Student Ambassador graduate: Riya Mistry

by Contributed | Jun 14, 2021 | Technology

This article is contributed. See the original author and article here.

This series highlights Microsoft Learn Student Ambassadors who achieved the Gold milestone and have recently graduated from university. Each blog features a different student and highlights their accomplishments, their experience with the Student Ambassadors community, and what they’re up to now. 

Today we’d like to introduce Riya Mistry, who is from India and recently graduated from the Dharmsinh Desai Institute of Technology.  

Responses have been edited for clarity and length.  

When you became a Student Ambassador in 2019 in your third year of college, did you have any specific goals you wanted to reach, like attain a skill or work on a particular quality? What were they, and did being a Student Ambassador help you achieve them? How has being in the community impacted you in general? 

Since the idea of global tech communities was not well known in my local college communities, my main goal was to first get familiar with the learning, growth, and opportunities provided by the Student Ambassadors community and then help to expand the reach of it to my college and people around me.  The main technology that I was passionate about initially was cloud computing, and joining this community helped me greatly in terms of learning about Azure.  I now even have the certification in it, so I was able to achieve that goal. Also, in general, being a member of this community helped me gain more confidence to speak up in public, which I had feared the most.  

What were some of the accomplishments that you’re proudest of and why?  

There are many accomplishments, but the one I am most proud about was the day when it was announced that I had reached the Gold milestone [editor’s note: this is the highest level one can attain as a Student Ambassador].  After joining this community and then getting to know about the different milestones, I never thought I would be able to reach the Gold one. Apparently, my hard work and passion for the community caught the attention of the program’s Community Program Managers, who recommended that I be promoted to the status of Gold Ambassador.

 
The second accomplishment is the event which I hosted, “Introduction to Apache Spark”. It was approximately a 1.5hr event and had the highest number of attendees out of events organized in my institution, even in the lockdown; attendees showed keen interest in learning until the very end. It felt like a huge accomplishment that I had helped people to get familiar with something new. 

What do you have planned after graduation?  What’s next for you?  

I have joined as a Software Engineer Intern at Crest Data Systems, a leading provider of custom solutions in the areas of data analytics, cybersecurity, ITOps/AIOps, DevOps, and cloud. I help them with security analytics and automation projects to detect real-time threats using cloud technology.  In my free time, I do a little bit of coding and give back to the community by conducting sessions and helping others new in the Student Ambassadors program to get familiar with what is required.  

If you could redo your time in the Student Ambassador community, is there anything you would have done differently?   

I am mostly satisfied with the time and opportunities I had being in the program, so I don’t think I would redo anything, although I do feel if something can be changed, I might have joined the community a little bit earlier, in my 2nd year of college. 

If you were to describe the community to a student who is considering joining, what would you say to convince them to join? 

If you love to be around a community of like-minded people, if you love new technology and like to explore each and every new thing you hear, then this is the best place you can join. Come be a part of the most diverse community where you will learn communication, management, marketing–and don’t forget–technical skills. It’s the best experience someone could wish for as a student. 

And what advice would you give to new Student Ambassadors? 

My advice to new Student Ambassadors is to keep learning new things, talk to folks, ask questions if you have any. There are plenty of people here to help you out in the community. And most importantly, be active in the program, as opportunities are innumerable each and every day. Organize your first event, take part in Hackathons, and contribute to your best to give back to the community.  

Do you have a motto in life, a guiding principle that drives you? 

My motto for life is “Every expert was once a beginner”. That helps me learn and explore new things without having the fear of failure.  

Lastly, on a lighter note, can you share a random fun fact about yourself that few people are aware of? 

Apart from technology, I enjoy cooking and trying different cuisines and creating my own version of it. Also anything is delicious when cheese is added to it! Bit of a cheese lover. 

Thank you, Riya, and good luck to you in all your future endeavors! 

New transactable offers from Soft Flow, jtwo solutions, and CloudCheckr in Azure Marketplace

by Contributed | Jun 14, 2021 | Technology

This article is contributed. See the original author and article here.

Microsoft partners like Soft Flow, jtwo solutions, and CloudCheckr deliver transact-capable offers, which allow you to purchase directly from Azure Marketplace. Learn about these offers below: Soft Flow Managed Service Backup: In this offer, Soft Flow will set up and manage Microsoft Azure Site Recovery and Azure Backup to ensure your company’s workloads replicate on physical and virtual machines, especially during outages. Soft Flow engineers and consultants will make sure your data is always safe, available, and recoverable. cloudstep: cloudstep from jtwo solutions provides cloud cost modeling and financial analysis, enabling chief financial officers and IT managers to answer such key questions as “How much would this application cost to deliver?” and “How would it compare to other options?” Seize the benefits of the cloud while avoiding the pitfalls of overspending. CloudCheckr CMx for Multi-Cloud Governance: CloudCheckr CMx delivers total visibility in Azure and other public clouds, making complex cloud infrastructure easy to manage and govern. Customizable dashboard alerts and reporting help you take control of your Azure or multi-cloud infrastructure and scale with confidence.

Monitoring Microsoft Security Posture in Azure Sentinel

by Contributed | Jun 14, 2021 | Technology

This article is contributed. See the original author and article here.

Overview

Thanks to @Matt_Lowe (Program Manager – Azure Sentinel) and @BenjiSec  (Program Manager – Azure Sentinel) for the technical brainstorming, contribution, implementation and proof reading! 

Microsoft Secure score is a security analytics solution that gives you visibility into your security portfolio and how to improve it. Azure Sentinel is a SaaS Security Information and Event Management solution providing visibility and management of the threats in an environment.  The following blog shows how you can leverage Azure Sentinel to gain visibility into Microsoft Secure Score alongside other security data.  

Requirements & Use Cases

SOC team want to pull and ingest Microsoft Secure Score data, recommendations, profiles, Azure Defender , Microsoft 365, Microsoft Defender for Endpoint, and Microsoft Cloud App Security data to Azure Sentinel for further investigation, compliance and hygiene security purpose to have a consolidated unified security posture view in addition to the following use cases:

• Monitor, track and report on their organization configuration baseline and score in downstream reporting tools.


• Integrate the data into compliance or cybersecurity insurance applications.


• Integrate Secure Score data to drive a hybrid or multi-cloud framework for security analytics.

Microsoft Secure Score

Microsoft Secure Score helps organizations:

• Report on the current state of the organization’s security posture.


• Improve their security posture by providing discoverability, visibility, guidance, and control.


• Compare with benchmarks and establish key performance indicators (KPIs).

To help you find the information you need more quickly, Microsoft improvement actions are organized into groups:

• Identity (Azure Active Directory accounts, roles, Microsoft Defender for Identity)


• Device (Microsoft Defender for Endpoint)


• Apps (email and cloud apps, including Office 365 & Microsoft Cloud App Security)

In the Microsoft Secure Score overview page (under the Microsoft 365 Security Portal), view how points are split between these groups and what points are available. You can also get an all-up view of the total score, historical trend of your secure score with benchmark comparisons, and prioritized improvement actions that can be taken to improve your score:

You’re given points for the following actions:

• Configuring recommended security features


• Doing security-related tasks


• Addressing the improvement action with a third-party application or software, or an alternate mitigation

The following are scores you can add to your view of your overall score to give you a fuller picture of your overall score:

• Planned score: Show projected score when planned actions are completed


• Current license score: Show score that can be achieved with your current Microsoft license


• Achievable score: Show score that can be achieved with your Microsoft licenses and current risk acceptance

Your score is updated in real time to reflect the information presented in the visualizations and improvement action pages. Secure Score also syncs daily to receive system data about your achieved points for each action.

For more details, please visit Assess your security posture with Microsoft Secure Score & Microsoft Secure Score

Implementing Secure Score data into Azure Sentinel

The Security API in Microsoft Graph makes it easy to connect with Microsoft Secure Score in the Intelligent Security Graph. It allows you to more readily realize and enrich the value of these solutions.

Acquiring the Secure Score data from the API requires you to setup a few pre-requisites:

• 1st, you should choose your consumption model. If you plan to have a non-user-interactive application to retrieve data from the API, you should opt for the Service-To-Service Authentication model, If your application will require an administrator to provide their logon credentials each time you pull data from the API, you should opt for the user OAuth model. Reference information about this model is located here. If you are a CSP application developer partner you can also find information here.


• 2nd, you will need to register your application in Azure Active Directory in order to call the API. You need to grant the SecurityEvents.Read.All and SecurityEvents.ReadWrite.All permission scopes. 

Below is the list of Secure Score exposed APIs:

Step(1): Register an App 

Create and register Azure AD App to handle the authentication and authorization to collect the Secure Score data from the Graph API and Microsoft Defender for Endpoint API. Here are the steps – navigate to the Azure Active Directory blade of your Azure portal and follow the steps below: 

1. Click on ‘App Registrations’  


2. Select ‘New Registration’  


3. Give it a name and click Register.  


4. Click ‘API Permissions’ blade.  


5. Click ‘Add a Permission’.  


6. Click ‘Microsoft Graph’.  


7. Click ‘Application Permissions’.  


8. Search for ‘SecurityEvents’, Check SecurityEvents.Read.All  and SecurityEvents.ReadWrite.All and ‘Click ‘Add permissions’.  


9. Click ‘grant admin consent’. 


10. Click ‘Certificates and Secrets’.  


11. Click ‘New Client Secret’  


12. Enter a description, select ‘never’. Click ‘Add’.  


13. Note– Click copy next to the new secret and store it somewhere temporarily. You cannot come back to get the secret once you leave the blade.  


14. Copy the client Id from the application properties and store it.  


15. Copy the tenant Id from the main Azure Active Directory blade and store it.  


16. Now we need to add permissions connected to Microsoft Defender for Endpoint:
    
    
    
    1. Click on +Add a permission and click on APIs my organization use. Search for WindowsDefenderATP and select it. Select Application permissions and then search and select Score.Read.All and click on Add permission 
    
    
    2. Click on +Add a permission and click on APIs my organization use. Search for WindowsDefenderATP and select it. Select Application permissions and then search and select SecurityRecommendation.Read.All and click on Add permission 
    
    
    3. Click on +Add a permission and click on APIs my organization use. Search for WindowsDefenderATP and select it. Select Application permissions and then search and select Vulnerability.Read.All and click on Add permission 
    
    
    
    

Next, go to Azure portal (portal.azure.com) and get your Log Analytics Workspace ID & Key. Search for Log Analytics workspaces, and open workspace on which you have Sentinel connected to. Click on Agents management from left menu and copy Workspace ID and Primary key. 

Additionally, we need to make sure that our Microsoft Cloud Application Security data connector is on and that we are ingesting Shadow IT data (Cloud Discovery Logs). If MCAS data connector isn’t enabled, please follow this instructions – Connect Cloud App Security data to Azure Sentinel | Microsoft Docs. 

Step(2): Deploy Microsoft Security Posture Connector – Playbook 

The M365 Security Posture connector template will deploy an Azure Logic App that is configured to ingest data from the different M365 Defender products to highlight the statuses of entities within the environment. The connector calls upon HTTP API to gather this data from the different products, with the products being:

• Microsoft Defender for Endpoint


• Microsoft 365 Defender

Azure Defender and Microsoft Cloud App Security data will be referenced in the related workbook via the built-in connectors and data ingestion channels.

The connector will be fetching logs such as:

• MDE Secure Score


• MDE Exposure Score


• MDE Recommendations


• MDE Vulnerabilities


• M365 Secure Score

The workbook will also be referencing data from Azure Security Center and Microsoft Cloud App Security such as:

• ASC Secure Score


• ASC Recommendations and Regulatory Compliance


• MCAS ShadowIT

Option (1):

1. Click on the “Deploy to Azure” button (Showing below)


2. Once in the Azure Portal, select the Subscription and Resource Group that Azure Sentinel is under.


3. Enter the details that are required for the Playbook.


4. Click “Review and Create”.


5. Click “Create”.


6. Within a minute or two, the template should deploy and the Playbook should appear within the Azure Sentinel environment.

Option (2):

1. Enter the template within the GitHub folder.


2. In the top right corner, select Raw.


3. Copy the raw text within the template.


4. Go to the Azure Portal.


5. Within the search bar at the top, type “Deploy” and select “Deploy a custom template”.


6. Select “build my own template in the editor”.


7. Within the template space, paste the text copied from GitHub.


8. Select the Subscription and Resource Group that Azure Sentinel is under.


9. Enter the details that are required for the Playbook.


10. Click “Review and Create”.


11. Click “Create”.


12. Within a minute or two, the template should deploy and the Playbook should appear within the Azure Sentinel environment.

Step(3): Deploy Microsoft Security Posture Workbook

Purpose of this Workbook is to show different Microsoft Secure Scores at one place with the information about possible vulnerabilities and recommendations how to improve secure score. We will be covering Azure Security Center, Microsoft 365, Microsoft Defender for Endpoint, and Microsoft Cloud App Security data. 

We need to ingest the data from Microsoft 365 Security about secure scores and exposure score, as well as the list of controls, vulnerabilities, and recommendations. 

Now we can create a new workbook and update the json (M365SecurityPosture.json – workbook json code uploaded to Azure Sentinel official github repo), go to Sentinel environment and click on Workbooks and click on +Add workbook. Click on Edit and choose Advanced editor , then Enter the name of you Workbook (ex. Microsoft Security Posture) and click on Save:

Notes & Consideration

• You can customize the parsers at the connector’s flow with the required and needed attributed / fields based on your schema / payload before the ingestion process, also you can create custom Azure Functions once the data being ingested to Azure Sentinel


• Azure Function can be used to create the custom connector as well


• Couple of points to be considered while using Logic Apps:
  
  
  
  • Cost (standard / enterprise connectors)
  
  
  • Considerations & Configurations
  
  
  • Non standard schema
  
  
  • Rewriting rules
  
  
  
  

Get started today!

We encourage you to try it now!

You can also contribute new connectors, workbooks, analytics and more in Azure Sentinel. Get started now by joining the Azure Sentinel Threat Hunters GitHub community.