DFIR Investigations – Logs in Azure

In the previous chapter, we discussed responding to incidents in Amazon Web Services (AWS). This chapter will focus on responding to incidents in Microsoft Azure, the second most popular cloud computing product. One critical aspect of incident response in Azure is analyzing log data from different Azure services. In this chapter, we will explore the various log sources available in Azure, how to acquire them, and best practices for analyzing this data to detect, contain, and resolve security incidents in Azure. By understanding the tools and techniques available for incident response in Azure, incident response professionals can better protect and respond to an organization’s cloud infrastructure in the context of a security incident.

Following a similar pattern to AWS, understanding which logs within Azure are available by default versus what defenders and investigators may have to enable is critical to cloud forensics. This chapter...

Azure Log Analytics

Azure Log Analytics is a cloud-based service offered by Azure that allows organizations to collect, analyze, and gain insights from their log and operational data. It provides a centralized platform for monitoring, troubleshooting, and detecting anomalies across various cloud and on-premises environments. With Azure Log Analytics, organizations can gain visibility into their systems and applications, enabling them to make informed decisions and take proactive action to maintain optimal performance and security.

Azure Log Analytics can be considered the equivalent of AWS CloudTrail (discussed in Chapter 4) when it comes to collecting and analyzing logs from various Azure services. By collecting logs from these services, organizations can gain insights into their performance, availability, and security. It provides a unified platform for monitoring and troubleshooting Azure resources.

Azure Log Analytics is of paramount importance as it serves as the backbone...

Azure Virtual Networks

A virtual network is very similar to the traditional network that you would operate and stand up in your own organization’s data center. Similar to how networking allows your organization’s assets and resources to communicate with each other, Azure’s Virtual Network service allows you to build a network for your Azure resources and services to communicate with each other, the public internet, or any of an organization’s on-premise networks and resources.

Similar to AWS’s VPC, when you create a virtual machine resource in Azure, you can create an Azure Virtual Network or use an existing one (if it has been created already). Your virtual network is just like any other entity managed by Azure (known as an Azure Resource), such as a virtual machine, data store, database, or any other service we had previously discussed in Chapter 3.

For demonstration purposes and the purpose of this section, we have a created virtual network...

Azure Virtual Machines log analysis

We discussed Azure Virtual Machines in Chapter 3. In Azure, VMs are widely used to deploy and run various applications and services. To ensure the security and stability of these VMs, incident responders and administrators must analyze the logs generated by the VMs. These logs provide valuable insights into the system’s activities, performance, security incidents, and potential vulnerabilities. In this section, we will explore the different log sources within Azure that incident responders can analyze for effective VM log analysis.

• Azure Log Analytics: Azure Log Analytics is a powerful tool that centralizes log data from various sources, including Azure VMs. It provides a comprehensive log management solution and offers advanced querying and visualization capabilities. By integrating Azure VMs with Log Analytics, incident responders can collect and analyze logs from multiple VMs in a unified manner. The logs that are collected can...

Microsoft Sentinel

Microsoft Sentinel is a powerful cloud-native SIEM solution offered by Azure. It enables organizations to detect, investigate, and respond to security threats by collecting, analyzing, and visualizing vast amounts of security data from various sources in real time.

A SIEM is a comprehensive software solution that combines security information management (SIM) and security event management (SEM) capabilities. It serves as a central hub for ingesting and correlating logs and events from diverse sources, providing a unified view of an organization’s security landscape.

During a security incident, incident responders can leverage Microsoft Sentinel’s advanced features to effectively respond and mitigate threats. Here are specific ways incident responders can utilize Microsoft Sentinel:

• Log collection and integration: Microsoft Sentinel supports the ingestion of data from a wide range of sources, including Azure services, on-premises infrastructure...

Summary

This chapter delved into the crucial role of log analysis in incident response within the Azure environment. It emphasized the significance of understanding the available log sources in Azure, how to obtain them, and best practices for analyzing the data to effectively detect, contain, and resolve security incidents. By familiarizing incident response professionals with the tools and techniques specific to Azure, they can enhance their ability to safeguard and respond to security incidents in a cloud infrastructure context.

This chapter highlighted the importance of differentiating between default log availability and the need to enable certain logs, drawing parallels to AWS. Then, it outlined the diverse logs provided by essential Azure services and products, as previously discussed in Chapter 3, and examined their utilization for investigative purposes. In particular, this chapter explored Azure Log Analytics, Azure Virtual Network flow logs, Azure Storage, Azure Virtual...

Further reading

To learn more about the topics that were covered in this chapter, take a look at the following resources:

• Azure Monitor: https://learn.microsoft.com/en-us/azure/virtual-machines/monitor-vm
• Microsoft Defender for Cloud: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction
• Log Analytics: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial
• NSG flow logs: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview
• Azure Virtual Networks: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview
• Traffic Analytics: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics
• Microsoft Defender for Endpoint: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide
• Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel...