Hi,

Need to enable a group of content delivery specialists to be able to tune alerts within Defender XDR.

Is there an Defender RBAC role to cover this or does an Entra ID role need applying?

Regards,

Tim 

​Hi, Need to enable a group of content delivery specialists to be able to tune alerts within Defender XDR.Is there an Defender RBAC role to cover this or does an Entra ID role need applying? Regards, Tim   Read More

​

Introduction

In cloud-native Kubernetes environments, Containers are often treated as immutable resources, meaning they shouldn’t change after deployment. Immutable containers minimize the attack surface because they do not allow modifications during runtime. This limits the potential for attackers to make unauthorized changes, install malware, or create backdoors within a running container.

Container drift refers to unintended or unauthorized manual changes, updates, patches, or other modifications made during its runtime. When containers drift, they may incorporate untested and unverified changes, such as software updates, configuration modifications, or new libraries. These changes can introduce new vulnerabilities that were not present in the original, vetted container image. Drift might introduce changes that grant elevated privileges to processes or users within the container, which can be exploited to gain broader access to the system or network. Changes caused by drift can alter or disable security monitoring tools within the container, making it harder to detect and respond to security incidents promptly.

Microsoft Defender for Containers introduces the binary drift detection feature in public preview, to detect execution of files in a running container drifting from original Container Image which was scanned, tested, and validated. It’s available for the Azure (AKS) V1.29, Amazon (EKS), and Google (GKE) clouds.

Defender for Containers Binary Drift Detection helps organizations:

Early Detection of Breaches: Drift detection serves as an early warning system for potential security breaches. If an attacker compromises a container and makes unauthorized changes, drift detection can immediately alert security teams, enabling them to respond quickly and mitigate the impact.

Monitor for Insider Activity: Drift detection helps mitigate insider threats by monitoring for unauthorized changes that could indicate malicious activity by an insider. This includes unauthorized changes to configurations, deployment scripts, or access controls within containers.

Reduce Human Error: Human error is a common cause of security breaches. Drift detection reduces the risk of human error by ensuring that any unintended changes made by administrators or developers are quickly detected and corrected.

Ensure Compliance with Security Standards: Many regulatory standards require organizations to maintain secure configurations and prevent unauthorized changes. Drift detection helps ensure compliance by continuously monitoring and documenting the state of containers, providing evidence that configurations remain consistent with regulatory requirements.

Prerequisites to enable Binary drift detection:

Defender for Containers plan should be enabled on Azure subscription, AWS Connector, GCP Connector.  For more details refer Configure Microsoft Defender for Containers components – Microsoft Defender for Cloud | Microsoft Learn
Defender sensor must be enabled.

Security Admin or higher permissions on the tenant to create and modify drift policies

Configure Binary Drift Detection

Security Admins can configure drift detection policies at Azure Subscription, AWS Connector or GCP Connector and on Resources at Cluster level, Name space, Pod, or individual container level.

For details on how to configure drift detection Rules, refer : Binary drift detection (preview) – Microsoft Defender for Cloud | Microsoft Learn

Rules are evaluated in ascending order of priority. First rule 1 is evaluated, if it’s a match the evaluation stops.  If no match is found, the next rule is evaluated. If there’s no match for any rule, the out of the box Default binary drift rule with default  Ignore drift detection applies.

Best practices for Drift Detection:

Kubernetes Administrators should ensure that all container images are regularly updated and patched to include the latest security fixes.
Detecting drift at the cluster level helps prevent unauthorized changes that could compromise the security and stability of the entire cluster. For example, an attacker gaining access to the Kubernetes API server might change cluster-wide settings to escalate privileges or disable security features.

In multi-tenant environments, where different teams or customers share the same Kubernetes cluster but operate within their own namespaces, organizations can apply drift detection at namespace level monitoring only the areas of the cluster that are relevant to particular applications or teams.

In development or testing environments, developers might need to make ad-hoc changes to containers to test new features, configurations, or debug issues, without the overhead of redeploying containers. Apply the ruleset only to the specific labelled Kubernetes pods.

During scheduled maintenance windows, organizations might need to apply emergency patches or make quick operational changes directly to running containers to address critical security vulnerabilities or fix urgent issues. In this scenario, modify the rule action to Ignore Drift detection to avoid false positives.
Allow list for processes – Organizations might define specific processes like monitoring agents, logging agents to be exempt from drift detection to avoid false positives.

Test / Simulate a binary drift alert

To test the binary drift feature and generate alerts (only in situations you defined in the binary drift policy that you’d like to get an alerts) you can execute any binary process in the container (not part of the original image). You can also use this script to create binary drift scenario:
kubectl run ubuntu-pod –image=ubuntu –restart=Never — /bin/bash -c “cp /bin/echo /bin/echod; /bin/echod This is a binary drift execution”

Below you can observe the drift detection alert generated in a threat scenario:

Click on Open Logs to further examine the activities performed on this resource around the time of the alert. The attempt to list the Cluster admin credentials succeeded.

The alert also indicates there are 42 more alerts on the affected resource

This incident indicates that suspicious activity has been detected on the Kubernetes cluster. Multiple alerts from different Defender for Cloud plans have been triggered on the same cluster, which increases the fidelity of malicious activity. The suspicious activity might indicate that a threat actor has gained unauthorized access to your environment and is attempting to compromise it.

Advanced Hunting with XDR

Security teams can now access Defender for Cloud alerts and incidents within the Microsoft Defender portal, get the complete picture of an attack, including suspicious and malicious events that happen in their cloud environment, through immediate correlations of alerts and incidents.

By combining drift detection data with other security event information, SOC teams can build a more comprehensive understanding of potential incidents. A multi-stage incident involving multiple alerts can be observed in the XDR portal.

The alert evidence pane shows there has been suspicious activity with “ubuntu-pod”

The SOC team can further investigate the commands executed on the affected pod, and the user who executed the commands using the below query:

CloudAuditEvents

| where Timestamp > ago(1d)

| where DataSource == “Azure Kubernetes Service”

| where OperationName == “create”

| where RawEventData.ObjectRef.resource == “pods” and RawEventData.ResponseStatus.code == 101 

| where RawEventData.ObjectRef.namespace == “kube-system”

| where RawEventData.ObjectRef.subresource == “exec”

| where RawEventData.ResponseStatus.code == 101

| extend RequestURI = tostring(RawEventData.RequestURI)

| extend PodName = tostring(RawEventData.ObjectRef.name)

| extend PodNamespace = tostring(RawEventData.ObjectRef.namespace)

| extend Username = tostring(RawEventData.User.username)

| where PodName == “ubuntu-pod”

| extend Commands =  extract_all(@”command=([^&]*)”, RequestURI)

| extend ParsedCommand = url_decode(strcat_array(Commands, ” “))

| project Timestamp, AzureResourceId , OperationName, IPAddress, UserAgent, PodName, PodNamespace,  Username, ParsedCommand

For more information on how to Investigate suspicious Kubernetes (Kubeaudit) control plane activities in XDR advanced hunting refer: Kubeaudit events in advanced hunting – Microsoft Defender for Cloud | Microsoft Learn

SOC team can assign incidents from the Manage incident pane for mitigating the attack

Kubernetes Cluster administrators can configure automated workflows to handle common drift scenarios, such as reverting unauthorized changes, notifying relevant teams, or trigger response actions automatically.

Additional Resources

You can also use the resources below to learn more about these capabilities:

Binary drift detection in Defender for Containers  (Video)
Binary drift detection (preview) – Microsoft Defender for Cloud | Microsoft Learn
Kubeaudit events in advanced hunting – Microsoft Defender for Cloud | Microsoft Learn
Container security architecture – Microsoft Defender for Cloud | Microsoft Learn

Reviewers

Eyal Gur, Principal Product Manager, Defender for Cloud

​Microsoft Tech Community – Latest Blogs –Read More 

Data Analytics 

Analytics can transform raw data into an extensive collection of information that categorizes data to identify and analyze behavioral data

and patterns. Data analytics consists of converting raw data into actionable insights.  

Although having data analytics competencies may be required for some job and optional for others, it makes all data related work easier. If you are a data scientist, for example, a quick and informative analysis could give you an idea related to preprocessing and to the modeling algorithm. 

Data analytics has several benefits for different segments such as: 

Organization: By examining historical data and recognizing trends, businesses can gain a better understanding of their customers, market conditions and products. Analytics has capacity to help with informed decision-making leading to cost effectiveness. 

Developers:  data analytics help in getting insights into how to develop the business. 

Product: data analytics may help in product design and feature development. 

Previously, data analytics was a complex task. However, thanks to technological advancement, new tools were developed to support accessibility and its comprehension by, many people across all teams despite their technical backgrounds. One of these tools is Power BI developed  by Microsoft.     

Power BI for Data Analysis 

Power BI is an exceptional tool for quickly pulling actionable insights from data. It allows you to build visuals (as well as specifying new measure metrics) for your data in reports and dashboards which could be shared to gather insights at a high level to get more detailed information. We have: 

Power BI Desktop: Desktop is a complete data analysis and report creation tool that is used to connect to, transform, visualize, and analyze data.  

Power BI service: a cloud-based service, or software as a service (SaaS). Teams and organizations should use it because it facilitates report editing and collaboration. You can connect to data sources in the Power BI service, too, but modeling is limited. 

In this blog, we are going to work with Power BI Desktop: Download Power BI Desktop  

The data can be downloaded from: Financial Data or imported directly from Power BI Desktop available samples. 

Analyzing data has been always correlated with statistics that show distribution or helps in detecting outliers, for example. Exploring the statistical summary gives you a high-level view of the available data, where you can remarque clusters, discover patterns on behavioral data, calculate data averages, min, max and more. Based on this need, Power BI has many functions that guide in conducting a statistical analysis, such as Data Analysis Expressions (DAX) functions and visuals (histograms and bell curves…).  

The list below presents some types of visualizations: 

Histograms    can be used to depict the frequency distribution of variables in a dataset. For example, we use the column chart visual to present a histogram that determines the sum of sales per country. 

    2. Charts   Bar or column chart visual in Power BI relates two data points: a measure and a dimension. It only visualizes a single data point and to compare discrete or categorical variables in a graphical format. 

Histograms and bell curves (distribution charts) are the most common way to display statistics about the semantic models. In Power BI, you can represent a histogram with one of the bar or column chart visuals and represent a bell curve with an area chart visual, as illustrated in the following image.  

       3. Statistical functions| Data Analysis Expressions (DAX): calculate values related to statistical distributions and probability, such as standard deviation (StdevP) and max (Max) (  statistical_functions and function-aggregates) 
 TOPN: one of the most known DAX functions. It returns the top N rows of a specified table(dataset). The Top N analysis is a great way to present data that might be important, such as the top 10 selling products, top 3 employees in an organization, or top 1 dangerous contamination. On the other hand, it may present the bottom N items in a list such as the worst sellers. It depends on your perspective and business requirements. In this example, we visualized respectively the top 10 countries by sales and top 10 countries by discounts 

Also, you can apply a new customized filter in the Filter section. In this example, we visualized the countries with Sum of Gross Sales (Variable) greater than (Operation) 25M (threshold). 

Outliers Identification with Power BI Visuals 

We define an outlier as a type of anomaly in the data, something unexpected or surprising, based on historical averages or previous normal results. It is important to identify outliers to isolate data points that significantly differ from other data points to not bias the future model and insights. Then, we need to take action to investigate the reasons for the presence of those outliers. The results of this analysis can make a significant impact on business decision making. 

Let’s consider our scenario, where we are analyzing units sold by country. The countries that stand out in terms of units sold are the ones we want to take note of. 

To that point, Power BI allows you to identify outliers in your data. The process involves: 

Segmenting data into two groups: the outlier data | normal data 

Use calculated columns to identify outliers à results would be static until à refresh the data.  
Solution: use a visualization or DAX function. These methods will ensure that your results are dynamic. 

After identifying outliers, you can use slicers or filters to highlight them.  

Add a legend to your visuals so that the outliers can be identified among the other data. 
Dive deeper into the reasons for outlier’s presence to gain more insights.  
For example, in our case sum of units sold and discounts by country. Why has the sum of units sold in the country been different from others? What are the reasons behind the difference? Was there any inflation or economic perturbation during a specific period in this country? Why, despite discounts, was the sum of units sold not important? What is the specificity that may impact the value of the units sold? 
We can also use a DAX function to add information related to variance.

Clustering Techniques in Power BI

Clustering is used to identify groups of similar objects in datasets with two or more variable quantities. It outputs a segment (cluster) of data that is like each other but dissimilar to the rest of the data.  

The Power BI clustering feature allows you to analyze your semantic model to identify similarities and dissimilarities in the attribute values, and then it separates the data that has similarities into a subset of the data. These subsets of data are referred to as clusters. 

In our example, we look for patterns in our financial data, such as sales overview. We segmented the countries into clusters according to their similarities: Sum of units sold by segment.

Start by adding the scatter chart visualization to the report.
Add the required fields to the visual. In this example: sum of units sold field to the x-axis, the sum of sales Sales field to the y-axis and Segment to the Legend field. The following image shows clusters in the scatter chart, so it is difficult to discern any natural groups. Here we plot sum of units sold and sum of sales by segment. 
 

Time Series Analysis with Power BI 

For as long as we have been recording data, time has been a crucial factor. In time series analysis, time is a significant variable of the data. Times series analysis helps us study our inputs and learn how we progress within it :right_arrow: Dynamic data.

Time series analysis often involves visuals like Gantt charts, project planning, and stock movement semantic models. In Power BI, you can use visuals to view how the data is progressing over time, which in turn allows you to make observations like whether any significant occurrences affected your data. 

Suitable visualizations in Power BI for Time Series analysis: line chart, area chart, or scatter chart because they are particularly useful for representing cumulative data over time and can be customized to highlight specific aspects of the time series. 

Additionally, Microsoft AppSource has an animation custom visual called Play Axis that works like a dynamic slicer and is a compelling way to display time trends and patterns in your data without user interaction. In our example we: 

Add a scatter visual to the report page to show the sales data by product during the months. 


Import the animation custom visual from Appsource to use with the visuals.  
Visualizations pane  :right_arrow: Get more visuals icon :right_arrow: Get more visuals.  
On the Power BI Visuals  window :right_arrow: search Play axis :right_arrow: Add Play Axis (Dynamic Slicer) visual.
 


Select the field Quarter (e.g., Month) that you want to use as the slicer in the Play Axis animation. 
Animation controls become available on the visual. An animation will be displayed such showing in our examples: 

Analyze Feature in Power BI 

The Analyze  feature provides you with additional analysis that is generated by Power BI for a selected data point. This feature is useful to discover the insights provided by PowerBI that you may miss. It may be considered as a starting point for analyzing why your data distribution looks the way that it does. 

Instead of exploring the data manually, you can use the Analyze feature to get fast, automated, insightful analysis of your data. To use the Analyze  feature:  

Click a data point on the visual à hover over the Analyze option to display two further options depending on the data point selected: 

Explain the increase: when your focus is on understanding the reasons behind a change in a specific metric. This is especially relevant when a single data point has changed noticeably, and you want to know why. for exploring reasons behind specific changes in data points 
Find where the distribution is different: when your focus is on comparing how data is distributed across different categories or groups. This is more about understanding differences in patterns or behaviors across subsets of your data, rather than focusing on a single change for analyzing and comparing distributions across categories or groups. In our example where we analyze sum of sales by country:

If you find any of the provided analysis useful, you can add it to your report so that other users can view it. Here, we found that segment analysis is useful, because it demonstrated the sum of sales of government per country. 

What to Explore Next? 

AI and Power BI 

Power BI includes several specialized visuals that provide a considerable interactive experience for report consumers. Often, these specialized visuals are called AI visuals.  

Why?   

Because Power BI uses machine learning (ML) to discover and display insights from data. These visuals provide a simple way to deliver an interactive experience to your report. 

For further reading, the three main AI visuals are: 

Key influencers   

Decomposition tree  

Q&A   

References: 

Benefits-of-data-analytics.  

What is Clustering?.  

How-To-create-Distribution-Chart-Bell-chart-in-Power-BI  

Grouping-and-binning-PowerBI  

PowerBI Service vs Desktop  
 

​Microsoft Tech Community – Latest Blogs –Read More 

The updated version of SCSM has the ability to connect to an external app registration for SMTP. I’ve created the registration per Microsoft documentation and the event viewer comes back with unknown user although inbound emails are flowing in. The email address is a GCC tenant.

​The updated version of SCSM has the ability to connect to an external app registration for SMTP. I’ve created the registration per Microsoft documentation and the event viewer comes back with unknown user although inbound emails are flowing in. The email address is a GCC tenant.  Read More

​

As title, at the end i prefer to use back chrome for friendly user purpose, see u after another 10 years or 20 years? Even internet explorer is easier to use compare to edge

​As title, at the end i prefer to use back chrome for friendly user purpose, see u after another 10 years or 20 years? Even internet explorer is easier to use compare to edge  Read More

​

Hi all,

We have a security recommendation to Change service executable path to a common protected location, e.g., move the service/app to C:Program Files. 

The service/app in question was installed by a vendor on a different drive letter, and to move it per the above recommendation will cost (a lot of) time and money for them to do. 

Are there any alternatives to this, such as hardening/strengthening the current file/folder path?

​Hi all, We have a security recommendation to Change service executable path to a common protected location, e.g., move the service/app to C:Program Files.  The service/app in question was installed by a vendor on a different drive letter, and to move it per the above recommendation will cost (a lot of) time and money for them to do.  Are there any alternatives to this, such as hardening/strengthening the current file/folder path?  Read More

​

I am a project manager for an organization of about 230 people, we have about 40-50 projects in flight at anyone time, these are internal projects.  However, as we grow we are developing our PMO team for portfolio management and project governance.  I have been tasked with building this out and creating a dashboard.  

We utilize TEAMS heavily for this which works quite well, however, we can’t get the dashboards and reporting we want out of planner/tasks/project in TEAMs.  I’ve been looking into “Project Web App” or “PWA” aka Project Online and utilizing the Microsoft Project Online Desktop.  I like the desktop and PWA options but I am struggling to get it setup properly and figuring out how to visually show the Gantt chart view with tasks in TEAMS, having this integration is important but the version available isn’t robust enough for our needs, thought PWA and the linked desktop version are.

I’m looking to find an organization I can contract with to develop this for us or some better resources I can use and work with my IT department.

​I am a project manager for an organization of about 230 people, we have about 40-50 projects in flight at anyone time, these are internal projects.  However, as we grow we are developing our PMO team for portfolio management and project governance.  I have been tasked with building this out and creating a dashboard.   We utilize TEAMS heavily for this which works quite well, however, we can’t get the dashboards and reporting we want out of planner/tasks/project in TEAMs.  I’ve been looking into “Project Web App” or “PWA” aka Project Online and utilizing the Microsoft Project Online Desktop.  I like the desktop and PWA options but I am struggling to get it setup properly and figuring out how to visually show the Gantt chart view with tasks in TEAMS, having this integration is important but the version available isn’t robust enough for our needs, thought PWA and the linked desktop version are. I’m looking to find an organization I can contract with to develop this for us or some better resources I can use and work with my IT department.  Read More

​