Summary

In this chapter, we learned how we can configure cloud-based services such as Microsoft Sentinel and Defender to provide security and threat monitoring for our environment.

We learned how to onboard a machine to Azure using the Azure Arc agent and configure extensions to provide log collection.

We also learned how to configure Log Analytics with Sentinel, configure log collection, and build analytics rules to trigger an incident based on certain events.

Then, we looked at how we can automate deployment using tools such as PowerShell and Terraform. Lastly, we looked at how Microsoft Defender can provide vulnerability and threat protection against our environment.

In the next chapter, we will focus more on ransomware countermeasures for endpoints, identity, and SaaS-based services.