azure-monitor-security

Name: azure-monitor-security
Author: vinayaklatthe

161stars34forks

How to install azure-monitor-security?

vinayaklatthe/microsoft-security-skills/azure-monitor-security

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-monitor-security

Installs into the current project.

Summary

Guidance for the security-side use of Azure Monitor and Log Analytics — designing the workspace strategy that feeds Microsoft Sentinel and Defender for Cloud, choosing analytics vs basic vs auxiliary log tiers, retention and archive, table-level transformations to drop noise pre-

Files · 1

View on GitHub

SKILL.md

1	# Azure Monitor & Log Analytics for Security
2
3	Microsoft Sentinel runs on a Log Analytics workspace. Defender for Cloud, Defender XDR
4	hunting tables, Activity logs, and Diagnostic settings also flow there. The workspace
5	strategy decides whether your security telemetry is **complete, compliant, and
6	affordable** — or two of three.
7
8	This skill covers the security-side decisions in workspace design: tiering, retention,
9	DCRs, RBAC, and cost.
10
11	## When to use
12	Designing or refactoring the Log Analytics workspace(s) that back Sentinel and the
13	broader security telemetry estate.
14
15	Do not use this skill for Sentinel detection authoring
16	(`sentinel-detection-engineering`), App Insights instrumentation
17	(`appinsights-instrumentation`), or non-security observability.
18
19	## Log table tiers — pick per table
20
21	\| Tier \| Query latency \| Retention max \| Use case \|
22	\|---\|---\|---\|---\|
23	\| Analytics \| Sub-second \| 730 days interactive \| Detections, hunting, dashboards \|
24	\| Basic \| Seconds (KQL with limits) \| 30 days interactive + archive \| High-volume "search if needed" logs \|
25	\| Auxiliary \| Slower / async \| 12 months interactive \| Low-touch compliance archive feeds \|
26	\| Archive (any tier) \| Search-job recall \| up to 12 years \| Long-tail evidence, regulatory hold \|
27
28	Microsoft has been re-naming/re-shaping these — verify current naming and pricing in your
29	region before commit.
30
31	## Approach
32
33	1. Workspace topology.
34	- Default: one Sentinel workspace per tenant for security signal — keeps
35	correlation easy.
36	- Regional / sovereign: separate workspaces where data residency or sovereignty
37	requires.
38	- Multi-workspace Sentinel: only when business reasons (M&A boundary, MSSP
39	model) force it. Cross-workspace queries work but add complexity.
40	- Don't split per-team; that fragments correlation.
41
42	2. Use Azure Monitor Agent (AMA) for everything new. The Microsoft Monitoring Agent
43	(MMA / Log Analytics agent) is retired. Migration paths via Defender for Cloud
44	auto-provisioning and Sentinel solutions.
45
46	3. Define DCRs per data class.
47	- One DCR per data source family (Windows security events, Linux Syslog, custom
48	logs).
49	- Use transformKql to drop noisy columns or whole event IDs at ingest. A 30%
50	pre-ingest reduction beats any post-ingest tuning.
51	- Validate transformations against detection KQL — don't drop a column a Sentinel
52	analytic relies on.
53
54	4. Tier per table.
55	- Analytics: SecurityEvent (filtered), SigninLogs, AuditLogs, DeviceLogonEvents
56	(Defender XDR), Sentinel-driven detection sources.
57	- Basic: AzureDiagnostics for chatty resources, NSG flow logs, web server access
58	logs (where you need them only for incident search).
59	- Auxiliary: long-retention compliance feeds (e.g., raw firewall logs for 12
60	months).
61	Tier choice changes ingestion + retention costs significantly.
62
63	5. Retention and archive.
64	- Interactive retention: 90 days default — extend to align with detection lookback
65	windows (often 180–730 days).
66	- Archive (cold) for compliance and IR replay (12-year max for some scenarios).
67	- Search jobs rehydrate archived data when needed.
68
69	6. Cost control.
70	- Commitment tier at the workspace (100 GB/day → 5,000 GB/day) cuts per-GB
71	price ~15–30%.
72	- Identify and cap top sources (DNS, NSG flow, Linux Syslog) — usually 80% of cost.
73	- Daily cap as a guardrail (drops data above cap; alert on hit).
74	- Review monthly: top tables, top resources, ingest trend.
75
76	7. Customer-managed keys (CMK) on the workspace if your data classification
77	requires. Plan for the dedicated cluster requirement and the operational complexity.
78
79	8. RBAC.
80	- Workspace-level: Log Analytics Reader, Log Analytics Contributor.
81	- **Table-level

People who liked this also viewed

6 picks

Type

azure-monitor-security

161stars34forks

View on GitHub

How to install azure-monitor-security?

vinayaklatthe/microsoft-security-skills/azure-monitor-security

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-monitor-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Monitor & Log Analytics for Security
2
3	Microsoft Sentinel runs on a Log Analytics workspace. Defender for Cloud, Defender XDR
4	hunting tables, Activity logs, and Diagnostic settings also flow there. The workspace
5	strategy decides whether your security telemetry is **complete, compliant, and
6	affordable** — or two of three.
7
8	This skill covers the security-side decisions in workspace design: tiering, retention,
9	DCRs, RBAC, and cost.
10
11	## When to use
12	Designing or refactoring the Log Analytics workspace(s) that back Sentinel and the
13	broader security telemetry estate.
14
15	Do not use this skill for Sentinel detection authoring
16	(`sentinel-detection-engineering`), App Insights instrumentation
17	(`appinsights-instrumentation`), or non-security observability.
18
19	## Log table tiers — pick per table
20
21	\| Tier \| Query latency \| Retention max \| Use case \|
22	\|---\|---\|---\|---\|
23	\| Analytics \| Sub-second \| 730 days interactive \| Detections, hunting, dashboards \|
24	\| Basic \| Seconds (KQL with limits) \| 30 days interactive + archive \| High-volume "search if needed" logs \|
25	\| Auxiliary \| Slower / async \| 12 months interactive \| Low-touch compliance archive feeds \|
26	\| Archive (any tier) \| Search-job recall \| up to 12 years \| Long-tail evidence, regulatory hold \|
27
28	Microsoft has been re-naming/re-shaping these — verify current naming and pricing in your
29	region before commit.
30
31	## Approach
32
33	1. Workspace topology.
34	- Default: one Sentinel workspace per tenant for security signal — keeps
35	correlation easy.
36	- Regional / sovereign: separate workspaces where data residency or sovereignty
37	requires.
38	- Multi-workspace Sentinel: only when business reasons (M&A boundary, MSSP
39	model) force it. Cross-workspace queries work but add complexity.
40	- Don't split per-team; that fragments correlation.
41
42	2. Use Azure Monitor Agent (AMA) for everything new. The Microsoft Monitoring Agent
43	(MMA / Log Analytics agent) is retired. Migration paths via Defender for Cloud
44	auto-provisioning and Sentinel solutions.
45
46	3. Define DCRs per data class.
47	- One DCR per data source family (Windows security events, Linux Syslog, custom
48	logs).
49	- Use transformKql to drop noisy columns or whole event IDs at ingest. A 30%
50	pre-ingest reduction beats any post-ingest tuning.
51	- Validate transformations against detection KQL — don't drop a column a Sentinel
52	analytic relies on.
53
54	4. Tier per table.
55	- Analytics: SecurityEvent (filtered), SigninLogs, AuditLogs, DeviceLogonEvents
56	(Defender XDR), Sentinel-driven detection sources.
57	- Basic: AzureDiagnostics for chatty resources, NSG flow logs, web server access
58	logs (where you need them only for incident search).
59	- Auxiliary: long-retention compliance feeds (e.g., raw firewall logs for 12
60	months).
61	Tier choice changes ingestion + retention costs significantly.
62
63	5. Retention and archive.
64	- Interactive retention: 90 days default — extend to align with detection lookback
65	windows (often 180–730 days).
66	- Archive (cold) for compliance and IR replay (12-year max for some scenarios).
67	- Search jobs rehydrate archived data when needed.
68
69	6. Cost control.
70	- Commitment tier at the workspace (100 GB/day → 5,000 GB/day) cuts per-GB
71	price ~15–30%.
72	- Identify and cap top sources (DNS, NSG flow, Linux Syslog) — usually 80% of cost.
73	- Daily cap as a guardrail (drops data above cap; alert on hit).
74	- Review monthly: top tables, top resources, ingest trend.
75
76	7. Customer-managed keys (CMK) on the workspace if your data classification
77	requires. Plan for the dedicated cluster requirement and the operational complexity.
78
79	8. RBAC.
80	- Workspace-level: Log Analytics Reader, Log Analytics Contributor.
81	- **Table-level

People who liked this also viewed

6 picks

Type