Azure Security Center

Azure Security Center
Name	Azure Security Center
Developer	Microsoft
Released	01 December 2015
Operating system	Cloud-based
Genre	Cloud security, SIEM, SOAR
License	SaaS

Azure Security Center. It is a unified infrastructure security management system provided by Microsoft for workloads running in Azure, on-premises, and in other cloud platforms. The service strengthens the security posture of data centers and provides advanced threat protection across hybrid workloads. It leverages the Microsoft Intelligent Security Graph to deliver intelligent security analytics and threat intelligence.

Overview

Launched in late 2015, the service was developed by Microsoft as a core component of its cloud security strategy. It functions as a CSPM and CWPP for resources in Azure, AWS, and GCP. The platform integrates with various Microsoft Security products, including Microsoft Defender for Cloud, to provide a comprehensive defense. Its architecture is built upon the global security intelligence from the Microsoft Intelligent Security Graph.

Features and capabilities

Core functionalities include continuous assessment of security settings against benchmarks from the CIS and NIST. It provides vulnerability assessment for virtual machines and container registries, often utilizing integrated tools from Qualys. The service offers just-in-time VM access and adaptive application controls to reduce attack surfaces. Furthermore, it features file integrity monitoring and leverages Azure Policy for regulatory compliance enforcement.

Integration with Azure services

The service natively integrates with foundational Azure services like Azure Virtual Machines, Azure App Service, and Azure SQL Database. It connects seamlessly with Azure Sentinel for SIEM and SOAR capabilities. For identity security, it works with Azure Active Directory and Microsoft Defender for Identity. Log data is typically aggregated and analyzed using Azure Monitor and Log Analytics.

Pricing and tiers

The service is offered in two main tiers: Free and Standard. The Free tier provides basic security policy and assessment features. The Standard tier, which is charged per resource per hour, unlocks advanced capabilities like threat detection and vulnerability scanning. Pricing can be explored via the Microsoft Azure pricing calculator, and usage may be covered under certain Enterprise Agreements.

Security posture management

This involves continuous monitoring and hardening of resources using Secure Score, a metric that measures alignment with security recommendations. Recommendations are powered by the Azure Security Benchmark and compliance is tracked against standards like ISO/IEC 27001, SOC 2, and the PCI DSS. Automation of responses is achieved through integration with Azure Logic Apps and Power Automate.

Threat protection and alerts

The system generates intelligent security alerts by analyzing data from integrated solutions like Microsoft Defender for Endpoint and Microsoft Defender for Servers. It detects threats such as brute force attempts, cryptojacking, and suspicious process executions. Alerts are prioritized using Microsoft Threat Intelligence and can trigger automated playbooks in Azure Sentinel. Fusion kill-chain analysis is employed to correlate disparate alerts into incident stories.

Category:Microsoft Azure Category:Cloud security Category:Microsoft security technology