Deploy SQL Server on Azure Kubernetes Service cluster via Helm Charts – on a windows client machine!

by Contributed | Jan 4, 2021 | Technology

This article is contributed. See the original author and article here.

A brief snapshot of the conversation that my colleague and I had a couple of weeks ago:

Colleague:  “I am new to Kubernetes and Linux world and was hoping if I could deploy SQL Server using helm chart from my Helm on my windows client and a managed kubernetes cluster service like Azure kubernetes service cluster (AKS)?”

Me:  “Yes, you can!”

Colleague: “Great! Can you share articles or guidance to do that so I could follow those?”

Me: “hmm.. For Helm refer this.. for Kubernetes refer this.. For SQL Server deployment using helm on kubernetes refer this.. “

and that’s when I noticed there wasn’t a single stop end to end guidance. This is what prompted me to write this blog. And I hope this helps anyone who is new to Kubernetes/helm charts or even SQL Server and want to get started with the deployment of SQL Server on Kubernetes.

By the end of this blog, you should have the SQL Server deployed via the helm charts on the managed kubernetes service which in this case is Azure Kubernetes Service (AKS). For more information on Kubernetes, Helm chart please refer to articles mentioned below to get you started.

1. What is Kubernetes ?


2. What is helm chart ?


3. The sample helm chart that we will use for this SQL Server deployment is available here. Please go through the readme file, to understand the files and values that you can chance and customize for your SQL Server deployment.

With the pre-read done, now lets start with deployment.

The follow along plan-

Please deploy an AKS (Azure Kubernetes Service) cluster.  If you do not want to use AKS and want to create your custom kubernetes cluster you could do that as well.

On your windows client system, from where you will connect to the AKS cluster and deploy SQL Server using the helm chart below, the tools that need to be installed on the windows client are:

• 
  

  You first install “az”, you can follow the steps documented here. From the link, download the current version of “az cli” exe and install the exe. If the installation is successful, you can type the command az in command prompt and if it is installed you should see output similar to the image shown below:

  
  

• Once you have the Azure CLI installed the next step is to install chocolatey, which is required to install helm on the windows client. To install chocolatey, follow the chocolatey install documentation. Follow the “Install with cmd.exe” section for a installation via the cmd.exe. Once the installation of the chocolatey is complete to confirm, open cmd.exe and run the command : choco as shown below:

• With chocolatey installed, it is now time to install helm. To install helm, open cmd.exe and run the command: 

  Choco install kubernetes-helm​

         Post the successful installation, when you run helm command in the cmd.exe you should see the output as shown below

• Now it is time to install the “kubectl” tool to interact and work with the kubernetes cluster, to install kubectl in the command prompt run the command

  az aks install-cli

         Post the successful install of “kubectl” you should add the path to “kubectl” as one of the  environment variables. In my case the path to kubectl is at “C:Usersamitkh.azure-kubectl” so I add the path to the environment variable as shown below:

With all the required tools installed on the windows client, we need to merge the context of the AKS cluster with the kubectl, so when we run kubectl or helm commands the operation takes place on that specific AKS cluster. To merge, run the command as described in the connect to aks cluster which is:

az aks get-credentials --resource-group <resourcegroupname> --name <aks clustername>

Once this is done, when you run a kubectl command the execution happens in the context of the aks cluster that we merged our tools with in the above step. An example shown below:

You are now ready to deploy the SQL Server on AKS cluster via the helm chart. You can download the sample helm-chart from this github location. Please go through the readme file to ensure you understand the options that you need or can change as per your requirement and customization.

Once you have the helm chart and all its file download to your windows client, switch to the directory where you have downloaded and after you have done modification to the downloaded helm chart to ensure it is as per your requirement and customization, deploy SQL Server using the command as shown below, you can change the deployment name (“mssql-latest-deploy”) to anything that you’d like.

helm install mssql-latest-deploy . --set ACCEPT_EULA.value=Y --set MSSQL_PID.value=Developer

Here is a example for reference, I have the chart and its files downloaded to the mssql-latest directory and this is how it looks and then I run the helm install command to deploy SQL Server.

After a few minutes, you should see SQL Server deployed and ready to be used as shown below:

Connect to the SQL Server running on AKS:

1. Using any of the familiar SQL Server tools like the SSMS (SQL Server Management Studio) or SQLCMD or ADS (Azure Data Studio), etc. You can connect to the instance of the SQL Server using the External-IP address for the “mssql-latest-deploy” service. In this case it is 20.40.0.145.


2. The sa_password is the value you provide to the Values.sa_password in the values.yaml file in the helm chart.

Changing the tempdb path:

As you would have noticed in the helm chart, we provide a specific location for tempdb files to ensure that the tempdb files are stored in those specific location. Here are the steps you can follow:

1. To change the tempdb location to the specific path you can connect to the SQL Server instance and then run the below T-SQL queries:

-- Get the tempdb specific files
select * from sysaltfiles where dbid=2
--We want to move the tempdb files to this specific location : /var/opt/mssql/tempdb/, ---so here are the commands:
ALTER DATABASE tempdb 
MODIFY FILE (NAME = tempdev, FILENAME = '/var/opt/mssql/tempdb/tempdb.mdf');
GO
ALTER DATABASE tempdb 
MODIFY FILE (NAME = tempdev2, FILENAME = '/var/opt/mssql/tempdb/tempdb2.ndf');
GO
ALTER DATABASE tempdb 
MODIFY FILE (NAME = templog, FILENAME = '/var/opt/mssql/tempdb/templog.ldf');
GO
--check and confirm that the locations for tempdb files are updated
select * from sysaltfiles where dbid=2

     2. Now for the change to take in affect, you will have to restart the SQL Server container and you can do the same using the commands below:

kubectl scale deployment mssql-latest-deploy --replicas=0

         Once you run the above command, wait for the container to be deleted and once it is, run the below command for the new container to be deployed

kubectl scale deployment mssql-latest-deploy --replicas=1

         Here you can now connect to the pod and check the tempdb files are now located to the new location : /var/opt/mssql/tempdb/

Hope you enjoyed it !! Happy learning!!

Amit Khandelwal

Sr. Program Manager 

Azure Sentinel: Using rule templates

by Contributed | Jan 4, 2021 | Technology

This article is contributed. See the original author and article here.

Microsoft’s Azure Sentinel, our Security Incident and Event Management (SIEM) solution, enables you to connect activity data from different sources into a shared workspace. That data ingestion is just the first step in the process though. The power comes from what you can now do with that data, including investigating incident alerts, building your own dashboards with workbooks, responding to threats with security playbooks and hunting for security threats.

Let’s take a look at some of the built-in rule templates that you can activate, to query and alert on that data.

Built-in rule templates
Your active rules and the list of available rule templates can be found in Azure Sentinel under ConfigurationAnalytics:

Azure Sentinel Analytics menu

The rule templates are published by Microsoft and are updated and added to as new events and threats are detected, classified as low, medium or high severity. There are currently just under 200 rule templates covering 38 different data sources, both from Microsoft and third parties.

Some of the rule templates in Azure Sentinel

Examples

There are rule templates to create incidents in Azure Sentinel based on alerts from Azure Security Center, Office 365 Advanced Threat Protection (Preview) and Microsoft Defender Advanced Threat Protection. This helps you build one place to manage and investigate threats across different Microsoft products.

There are individual rules for Microsoft and non-Microsoft products:

There are also rules that combine more than one product, linking events that could indicate a possible incident: 

And there are rules that detect a known threat from different data sources:

Anatomy of a rule template
As well as a severity and a list of the data source/s for this rule, a description tells you why this rule is important and may give you links to other relevant information.

Azure Sentinel rule template description

The rule type can be:
Microsoft Security – these rules automatically create Azure Sentinel incidents from alerts generated in other Microsoft security products, in real time.
Scheduled – these run periodically based on the settings you configure and allow you to alter the query logic.
ML Behaviour Analytics – these are based on proprietary Microsoft machine learning algorithms, so you can’t see of change the query logic.
Fusion – this detects multistage attacks by identifying combinations of anomalous behaviors and suspicious activities observed at various stages of the kill chain. By design, these incidents are low-volume, high-fidelity, and high-severity, which is why this detection is turned ON by default. For more information on Fusion incident types, visit Advanced multistage attack detection in Azure Sentinel. 

The tactics icons show what kind of threat this rule is related to:
Credential access, command and control, initial access, impact, defence evasion, collection, persistence, lateral movement, privilege escalation.

You can also see the details of the rule query, written in Kusto Query Language (KQL).

Scheduled rules have a frequency, a rule period and a rule threshold, and may allow event grouping, suppression, the creation of incidents from this alert and alert grouping.

Rule template settings for a scheduled rule

Creating a rule from a rule template
To turn a rule template into an active rule for your environment, you just select the Create rule button. With the wizard, you can then customize any rule settings or the rule logic itself (if appropriate) and you will be warned if you don’t have the required data sources connected.

Choosing your rules

Azure Sentinel gives you a very powerful security capability, but it’s up to you to decide how to apply it to your organization. The built-in rule templates are a great start, or you may also choose to build your own queries. Take a look at the data sources across your environment and what security incident and event monitoring tools and processes you already have in place. What in particular do you need to monitor – network attacks? logins of administrative accounts? events from different systems that may be related?

In addition, the Azure security baseline for Azure Sentinel takes guidance from the Azure Security Benchmark‘s security controls.   

Learn more:

MS Learn – Cloud-native security operations with Azure Sentinel

Docs – Tutorial: Detect threats out of the box

Docs – Tutorial: Create custom analytics rules to detect threats

Docs – Extend Azure Sentinel across workspaces and tenants

Certificate rotation Azure Service Fabric Standalone cluster

by Contributed | Jan 4, 2021 | Technology

This article is contributed. See the original author and article here.

To keep Service Fabric cluster running the old certificate are needed to be replaced with new certificates the below steps can help you rotate the old certificate with new certificates. This article assumes you are running cluster with thumbprint approach. In general the common name approach is recommended for easy certificate management. More information about certificate on Standalone cluster refer to Secure a cluster on Windows by using certificates – Azure Service Fabric | Microsoft Docs

Service Fabric with certificates that aren’t expired (cluster running with near expiry or non-expired certificates) 

Important Note: Before you change below config, you should install all certificate on all nodes i.e. New certificate should be present and acled to Network Service before you start this operation on all nodes.

1. Open the Clusterconfig.json file for editing, and find the following section. If a secondary thumbprint is defined, you need to clean up old Service Fabric certificates before you go any further. i.e. trigger an upgrade to remove secondary certificate section first.  

"security": {
    "metadata":  "The Credential type X509 indicates this cluster is secured using X509 Certificates. 
    The thumbprint format is - d5 ec 42 3b 79 cb e5 07 fd 83 59 3c 56 b9 d5 31 24 25 42 64.",
    "ClusterCredentialType":  "X509",
    "ServerCredentialType":  "X509",
    "CertificateInformation":  {
        "ClusterCertificate":  {
                                   "X509StoreName":  "My",
                                    "Thumbprint": "*Old server thumbprint(Star/SF)*"
                               },
        "ServerCertificate":   {
                                    "X509StoreName":  "My",
 									"Thumbprint": "*Old server thumbprint(Star/SF)*"
                               },
        "ClientCertificateThumbprints":  [
                                   {
                                        "CertificateThumbprint": "*Old client thumbprint*",
                                        "IsAdmin":  true
                                   }
                                         ]
                               }
            },

2.  Replace that section in the file with following section.

"security":  {
    "metadata":  "The Credential type X509 indicates this cluster is secured using X509 Certificates. 
    The thumbprint format is - d5 ec 42 3b 79 cb e5 07 fd 83 59 3c 56 b9 d5 31 24 25 42 64.",
    "ClusterCredentialType":  "X509",
    "ServerCredentialType":  "X509",
    "CertificateInformation":  {
        "ClusterCertificate":  {
                                   "X509StoreName":  "My",
                                    "Thumbprint": "*New server thumbprint(Star/SF)*",
                                    "ThumbprintSecondary": "Old server thumbprint(Star/SF)"
                               },
        "ServerCertificate":   {
                                    "X509StoreName":  "My",
 									"Thumbprint": "*New server thumbprint(Star/SF)*",
                                    "ThumbprintSecondary": "Old server thumbprint(Star/SF)"
                               },
        "ClientCertificateThumbprints":  [
                                   {
                                        "CertificateThumbprint": "*Old client thumbprint*",
                                        "IsAdmin":  false
                                   },
                                   {
                                        "CertificateThumbprint": "*New client thumbprint*",
                                        "IsAdmin":  true
                                   }
                                         ]
                               }
            },

{
"name": "myclustername",
"clusterConfigurationVersion": "2.0.0",

# Connect to the Service Fabric cluster
Connect-ServiceFabricCluster

# Get path of ClusterConfig.json for following command
# Note that after running the following command, you need to manually cancel using the red button (Stop Operation) in Windows PowerShell ISE or Ctrl+C in Windows PowerShell, otherwise you will receive the following notification, "Start-ServiceFabricClusterConfigurationUpgrade : Operation timed out.". Be aware that the upgrade will proceed.
Start-ServiceFabricClusterConfigurationUpgrade -ClusterConfigPath ClusterConfig.json

# To monitor the status of the upgrade, run the following 
Get-ServiceFabricClusterUpgrade

Azure Defender for IoT Raw-Data and ICS MITRE ATT&CK Matrix Mapping via Azure Sentinel

by Contributed | Jan 3, 2021 | Technology

This article is contributed. See the original author and article here.

Overview

Happy New Year everyone!

Thanks to @amitsheps (Azure Defender for IoT Senior Program Manager) and @paulrob (Azure Defender for IoT Global Black Belt) for the brainstorming, contributing, reviewing and proof reading! 

To enable rapid detection and response for attacks that cross IT/OT boundaries, Azure Defender is deeply integrated with Azure Sentinel—Microsoft’s cloud-native SIEM/SOAR platform. As a SaaS-based solution, Azure Sentinel delivers reduced complexity, built-in scalability, lower total cost of ownership (TCO), and continuous threat intelligence and software updates. It also provides built-in IoT/OT security capabilities, including:

• Deep integration with Azure Defender for IoT: Azure Sentinel provides rich contextual information about specialized OT devices and behaviors detected by Azure Defender—enabling your SOC teams to correlate and detect modern kill-chains that move laterally across IT/OT boundaries.


• IoT/OT-specific SOAR playbooks: Sample playbooks enable automated actions to swiftly remediate IoT/OT threats.


• IoT/OT-specific threat intelligence: In addition to the trillions of signals collected daily, Azure Sentinel now incorporates IoT/OT-specific threat intelligence provided by Section 52, our specialized security research team focused on IoT/OT malware, campaigns, and adversaries.

Using the Azure Sentinel Out-of-the box Azure Defender for IoT data connector (tagged as: “Azure Security Center for IoT (Preview)“), you will be able to easily pull Defender for IoT alerts to Azure Sentinel for further correlation, aggregation, investigations & detections. For more details please visit Connect your data from Defender for IoT to Azure Sentinel (preview)

Here’s an example of correlating OT alerts in Azure Sentinel:

Use Case

SOC requirements is to ingest Azure Defender for IoT “Raw-Data” to Azure Sentinel and build set of analytics rules for further correlation activities & detections covering the entire MITRE ATT&CK ICS matrix and further use cases, Achieving full coverage of the IoT and ICS threats described in the ATT&CK for ICS framework not only positions you to protect your networks against the threats that exist today, it also prepares you for the new ones that will, inevitably, appear in the future.

Crafting an IoT/ICS security approach capable of this requires a combination of capabilities: you need full visibility into your assets, proactive risk management to address vulnerabilities that could be exploited by adversaries, and M2M analytics to provide continuous network security monitoring.

In January 2020 MITRE has addressed the gap with the ATT&CK for ICS Framework. Cataloging the unique adversary tactics adversary use against facing IoT/ICS environments. The framework consists of eleven tactics that threat actors use to attack an ICS environment, which are then broken down into specific techniques. Ultimately, this database describes every stage of an ICS attack from initial compromise to ultimate impacts.

The 11 tactics described above are listed across the top column in the table on. Beneath each column header are techniques used by attackers to perform the respective tactic. The techniques listed are not necessarily unique to any one specific tactic:

The techniques that Azure Defender for IoT detects immediately are in green boxes. The
techniques that Azure Defender for IoT can detect after the initial compromise or where Azure Defender for IoT can detect via integration and correlation with other security technologies, such as Azure Sentinel, are in tan boxes, for more details please click here:

Architecture

Looking for Microsoft Defender for Endpoint PowerBI connected application that pull both Azure Defender for IoT Raw-Data & Microsoft Defender for Endpoint via APIs here’s the architecture and guidance, also a sample MDE_AD4IoT_PowerBI_Sample.pbit template uploaded to github (ensure amending the Sensor URL and Authorization key values):

Implementation

• Log in to the Azure Defender for IoT central manager console, System Settings > Access Tokens


• Select Generate new token, describe the purpose of the new token and select


• Copy the token, save it and select finish

• Go to Azure Sentinel > Playbooks


• Create a new Playbook and follow the below gif / step-by-step guide, the code being uploaded to github repo as well:
  
  
  
  • Add a “Recurrence” step and set the following field, below is an example to trigger the Playbook once a daily basis:
    
    
    
    • Interval: 1
    
    
    • Frequency: Day
    
    
    
    
  
  
  • Initialize a variable for the Azure Defender for IoT Sensor Access Token (Authorization Key):
    
    
    
    
    • Name: AuthorizationKey
    
    
    • Type: String
    
    
    • Value: X1X0XXX5XXXXXbXXX0XXX
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT Alerts data:
    
    
    
    • HTTP – Get-DefenderForIoT-Alerts:
      
      
      
      • Method: GET
      
      
      • URI: https://<Defender_for_IoT_Sensor>/api/v1/alerts 
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Add For each control to iterate Azure Defender for IoT Alerts items:
    
    
    
    • Select an output from previous steps: @body(‘HTTP_-_Get-DefenderForIoT-Alerts’)
    
    
    • Send the data (Alerts) to Azure Sentinel Log analytics workspace via a custom log tables:
      
      
      
      • JSON Request body: @{items(‘For_each_-_Alerts’)}
      
      
      • Custom Log Name: AD4IOT_Alerts
      
      
      
      
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT Devices data:
    
    
    
    • HTTP – Get-DefenderForIoT-Devices:
      
      
      
      • Method: GET
      
      
      • URI: https://<Defender_for_IoT_Sensor>/api/v1/devices
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Add For each control to iterate Azure Defender for IoT Devices items:
    
    
    
    • Select an output from previous steps: @body(‘HTTP_Get-DefenderForIoT-Devices’)
    
    
    • Send the data (Devices) to Azure Sentinel Log analytics workspace via a custom log tables:
      
      
      
      • JSON Request body: @{items(‘For_each_-_Devices’)}
      
      
      • Custom Log Name: AD4IOT_Devices
      
      
      
      
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT CVEs data:
    
    
    
    • HTTP – Get-DefenderForIoT-CVEs:
      
      
      
      • Method: GET
      
      
      • URI: https://<Defender_for_IoT_Sensor>/api/v1/devices/cves
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Add For each control to iterate Azure Defender for IoT CVEs items:
    
    
    
    • Select an output from previous steps: @body(‘HTTP_Get-DefenderForIoT_-_CVEs’)
    
    
    • Send the data (CVEs) to Azure Sentinel Log analytics workspace via a custom log tables:
      
      
      
      • JSON Request body: @{items(‘For_each_-_CVE’)}
      
      
      • Custom Log Name: AD4IOT_CVE
      
      
      
      
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT Events data:
    
    
    
    • HTTP – Get-DefenderForIoT-Events:
      
      
      
      • Method: GET
      
      
      • URI: https://w<Defender_for_IoT_Sensor>/api/v1/events
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Add For each control to iterate Azure Defender for IoT Events items:
    
    
    
    • Select an output from previous steps: @body(‘HTTP_Get-DefenderForIoT_-_Events’)
    
    
    • Send the data (Events) to Azure Sentinel Log analytics workspace via a custom log tables:
      
      
      
      • JSON Request body: @{items(‘For_each_-_Events’)}
      
      
      • Custom Log Name: AD4IOT_Events
      
      
      
      
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT Vulnerable Devices data:
    
    
    
    • HTTP – Get-DefenderForIoT-Vulnerable Devices:
      
      
      
      • Method: GET
      
      
      • URI: https://<Defender_for_IoT_Sensor>/api/v1/reports/vulnerabilities/devices 
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Add For each control to iterate Azure Defender for IoT Vulnerable Devices items:
    
    
    
    • Select an output from previous steps: @body(‘HTTP_-_Get-DefenderForIoT_-_Vulnerable_Devices’)
    
    
    • Send the data (Vulnerable Devices) to Azure Sentinel Log analytics workspace via a custom log tables:
      
      
      
      • JSON Request body: @{items(‘For_each_-_Vulnerable_Devices’)}
      
      
      • Custom Log Name: AD4IOT_Vulnerable_Devices
      
      
      
      
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT Operational Vulnerabilities data:
    
    
    
    • HTTP – Get-DefenderForIoT-Operational Vulnerabilities:
      
      
      
      • Method: GET
      
      
      • URI: https://<Defender_for_IoT_Sensor>/api/v1/reports/vulnerabilities/operational
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Set an HTTP endpoints to Get Azure Defender for IoT Security Vulnerabilities data:
    
    
    
    • HTTP – Get-DefenderForIoT-Security Vulnerabilities:
      
      
      
      • Method: GET
      
      
      • URI: https://<Defender_for_IoT_Sensor>/api/v1/reports/vulnerabilities/security
      
      
      • Headers:
        
        
        
        • Key: Authorization, Value: @variables(‘AuthorizationKey’)
        
        
        • Key: Content-Type, Value: application/json
        
        
        
        
      
      
      
      
    
    
    
    
  
  
  • Add For each control to iterate Azure Defender for IoT Vulnerable Security Vulnerabilities items:
    
    
    
    • Select an output from previous steps: @body(‘HTTP_-_Get-DefenderForIoT_-_Vulnerable_Devices’)
    
    
    • Send the data (Security Vulnerabilities) to Azure Sentinel Log analytics workspace via a custom log tables:
      
      
      
      • JSON Request body: @{body(‘HTTP_-_Get-DefenderForIoT-_Security_Vulnerabilities’)}
      
      
      • Custom Log Name: AD4IOT_Security_Vulnerabilities
      
      
      
      
    
    
    
    
  
  
  
  

Notes & Consideration

• In case if there is any technical requirement of not allowing using Azure Defender for IoT in the cloud and require to run On-premises, you can rely on local Logic App gateway for API calls for outbound traffic instead of inbound, for more details Install on-premises data gateway for Azure Logic Apps


• You can easily build a parser at the connector’s flow with the required and needed attributed / fields based on your schema / payload before the ingestion process, also you can create custom Azure Functions once the data being ingested to Azure Sentinel


• You can build your own detection and analytics rules / use cases leveraging the raw data and mapping to ICS MITRE ATT&CK,  a couple of custom analytics rules will be ready to use at github, stay tuned


• For more details about Microsoft Defender for Endpoint (MDE) PowerBI connected application integration, check out MDE – Create custom reports using Power BI and also Migrate the old Power BI App to Microsoft Defender ATP Power BI templates blog post by @Thorsten Henking as we referenced it in creating the custom PowerBI template


• Couple of points to be considered while using Logic Apps:
  
  
  
  • Cost (standard / enterprise connectors)
  
  
  • Considerations & Configurations
  
  
  • Non standard schema
  
  
  • Rewriting rules
  
  
  
  

Get started today!

We encourage you to try it now!

You can also contribute new connectors, workbooks, analytics and more in Azure Sentinel. Get started now by joining the Azure Sentinel Threat Hunters GitHub community.

Friday Five: Project Bicep, PerfInsights, More!

by Contributed | Jan 1, 2021 | Technology

This article is contributed. See the original author and article here.

Putting Project ‘Bicep’​ 0.2 to the test, a WVD deployment use case

Freek Berson is an Infrastructure specialist at Wortell, a system integrator company based in the Netherlands. Here he focuses on End User Computing and related technologies, mostly on the Microsoft platform. He is also a managing consultant at rdsgurus.com. He maintains his personal blog at themicrosoftplatform.net where he writes articles related to Remote Desktop Services, Azure and other Microsoft technologies. An MVP since 2011, Freek is also an active moderator on TechNet Forum and contributor to Microsoft TechNet Wiki. He speaks at conferences including BriForum, E2EVC and ExpertsLive. Join his RDS Group on Linked-In here. Follow him on Twitter @fberson

Deploying Azure Stack HCI Cluster with Windows Admin Center

James van den Berg has been working in ICT with Microsoft Technology since 1987. He works for the largest educational institution in the Netherlands as an ICT Specialist, managing datacenters for students. He’s proud to have been a Cloud and Datacenter Management since 2011, and a Microsoft Azure Advisor for the community since February this year. In July 2013, James started his own ICT consultancy firm called HybridCloud4You, which is all about transforming datacenters with Microsoft Hybrid Cloud, Azure, AzureStack, Containers, and Analytics like Microsoft OMS Hybrid IT Management. Follow him on Twitter @JamesvandenBerg and on his blog here.

PerfInsights self-help diagnostics tool in Azure Troubleshooting and reporting

Robert Smit is a EMEA Cloud Solution Architect at Insight.de and is a current Microsoft MVP Cloud and Datacenter as of 2009. Robert has over 20 years experience in IT with experience in the educational, health-care and finance industries. Robert’s past IT experience in the trenches of IT gives him the knowledge and insight that allows him to communicate effectively with IT professionals. Follow him on Twitter at @clusterMVP

Teams Real Simple with Pictures: Block Call Me within Teams Meetings

Chris Hoard is a Microsoft Certified Trainer Regional Lead (MCT RL), Educator (MCEd) and Teams MVP. With over 10 years of cloud computing experience, he is currently building an education practice for Vuzion (Tier 2 UK CSP). His focus areas are Microsoft Teams, Microsoft 365 and entry-level Azure. Follow Chris on Twitter at @Microsoft365Pro and check out his blog here.

C#.NET: HOW TO CONVERT LIST TO DATATABLE DATA TYPE

Asma Khalid is an Entrepreneur, ISV, Product Manager, Full Stack .Net Expert, Community Speaker, Contributor, and Aspiring YouTuber. Asma counts more than 7 years of hands-on experience in Leading, Developing & Managing IT related projects and products as an IT industry professional. Asma is the first woman from Pakistan to receive the MVP award three times, and the first to receive C-sharp corner online developer community MVP award four times. See her blog here.