Azure

Start here

• Ingest Azure Activity Logs into Sentinel: Collect the control-plane events before you need to investigate.
• Check Log Analytics ingestion delay: See when records actually became available to query.
• Limit Azure Arc management capabilities: Review what Azure permissions can do on your connected servers.

In this section

• Check Log Analytics ingestion delay
  Compare event and ingestion timestamps to see how long records take to reach Log Analytics.
• Enable Azure cost anomaly alerts
  Set up free cost anomaly alerts to help catch unexpected Azure spending.
• Enable Defender for Servers Plan 1 on selected machines
  Use resource-level Defender for Servers Plan 1 and built-in Azure Policy for selected machines.
• Ingest Azure Activity Logs into Sentinel
  Collect Azure Activity Logs in Sentinel and check which tables have ingestion charges.
• Limit Azure Arc management capabilities
  Use monitor mode and local extension controls to limit what Azure Arc can do on your servers.
• Look up Azure service IP ranges
  Retrieve Azure service tag address ranges with PowerShell for outbound filtering.