Scribd Logo
Upload

Welcome to Scribd!

  • 138 views

    Microsoft Azure Map

    Uploaded by

    Alan Guilherme
    The document discusses Microsoft's cloud security tools for collecting and analyzing logs from Azure Active Directory, Active Directory, and Microsoft 365 services. It lists the various logs that can be collected including activity, audit, and sign-in logs. It also outlines the APIs that support collecting logs from these Microsoft cloud services and storing them in Log Analytics, Azure Sentinel, or other storage options for security monitoring and analysis.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Microsoft Azure Map

    Uploaded by

    Alan Guilherme
    138 views1 page
    The document discusses Microsoft's cloud security tools for collecting and analyzing logs from Azure Active Directory, Active Directory, and Microsoft 365 services. It lists the various logs that can be collected including activity, audit, and sign-in logs. It also outlines the APIs that support collecting logs from these Microsoft cloud services and storing them in Log Analytics, Azure Sentinel, or other storage options for security monitoring and analysis.

    Original Title

    microsoft-azure-map

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses Microsoft's cloud security tools for collecting and analyzing logs from Azure Active Directory, Active Directory, and Microsoft 365 services. It lists the various logs that can be collected including activity, audit, and sign-in logs. It also outlines the APIs that support collecting logs from these Microsoft cloud services and storing them in Log Analytics, Azure Sentinel, or other storage options for security monitoring and analysis.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    138 views1 page

    Microsoft Azure Map

    Uploaded by

    Alan Guilherme
    The document discusses Microsoft's cloud security tools for collecting and analyzing logs from Azure Active Directory, Active Directory, and Microsoft 365 services. It lists the various logs that can be collected including activity, audit, and sign-in logs. It also outlines the APIs that support collecting logs from these Microsoft cloud services and storing them in Log Analytics, Azure Sentinel, or other storage options for security monitoring and analysis.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 1

    Log collection supported with Logstash

    Activity logs

    Active Directory audit logs

    Active Directory sign-ins logs

    Azure Active Directory Domain Services (AADDS)

    Cloud security posture management (CSPM)

    Microsoft Defender for Cloud (ex


    Event Hub Cloud workload protection (CWP)
    Azure Security Center / ASC)

    Source: https://docs.microsoft.com/en-us/azure/
    security-center/defender-for-cloud-introduction

    Defender for Endpoint (ex Defender ATP / MDATP)

    Defender for Office 365 Exchange Online Protection EOP)

    Defender for Identity (ex Azure Advanced


    Threat Protection / Azure ATP)
    Microsoft 365 Defender

    Defender for Cloud Apps (ex Microsoft


    Cloud App Security / MCAS)

    Source: https://docs.microsoft.com/en-us/microsoft-
    365/security/defender/microsoft-365-defender

    Microsoft Azure
    Log analytics Used for storage by Microsoft Sentinel (SIEM)

    Author: mdecrevoisier
    Date: 2021.12.01
    Office 365 Service Communications API

    Azure Sentinel Management API

    Microsoft Defender for Endpoint API

    Microsoft Defender 365 Streaming API


    (forward to Event Hub or Azure Storage)

    Microsoft Graph API

    Log collection supported with Filebeat


    API
    Azure Active Directory

    Admin

    Exchange Mailbox

    Quarantaine

    SharePoint (includes OneDrive)

    Security & Compliance Center Alerts


    Security and Compliance
    Office 365 Management Activity API
    Office 365 alerts from Cloud App Security

    Defender for Office 365 alerts


    Defender for Office 365
    General Threat Investigation and Response events

    Office 365 automated investigation and


    response (AIR)

    [others]

    Data Loss Protection (DLP)

    You might also like