You're reading from Windows Ransomware Detection and Protection Securing Windows endpoints, the cloud, and infrastructure using Microsoft Intune, Sentinel, and Defender

Product type Paperback

Published in Mar 2023

Publisher Packt

ISBN-13 9781803246345

Length 290 pages

Edition 1st Edition

Languages

Rust

Tools

Azure

Concepts

Cybersecurity

Author (1):

Marius Sandbu

View More author details

Table of Contents (16) Chapters

Preface

1. Part 1:Ransomware Basics

2. Chapter 1: Ransomware Attack Vectors and the Threat Landscape FREE CHAPTER

3. Chapter 2: Building a Secure Foundation

4. Part 2:Protect and Detect

5. Chapter 3: Security Monitoring Using Microsoft Sentinel and Defender

6. Chapter 4: Ransomware Countermeasures – Windows Endpoints, Identity, and SaaS

7. Chapter 5: Ransomware Countermeasures – Microsoft Azure Workloads

8. Chapter 6: Ransomware Countermeasures – Networking and Zero-Trust Access

9. Chapter 7: Protecting Information Using Azure Information Protection and Data Protection

10. Part 3:Assume Breach

11. Chapter 8: Ransomware Forensics

12. Chapter 9: Monitoring the Threat Landscape

13. Chapter 10: Best Practices for Protecting Windows from Ransomware Attacks

14. Index

Why subscribe?

15. Other Books You May Enjoy

Collecting logs and data sources

Data collection from VMs is done by installing an agent that is supported by both Linux and Windows. Within Azure, there are different agents that you should be aware of:

Azure Monitor Agent
Azure Log Analytics agent (this is known as the legacy agent and will be deprecated after August 2024)

At the time of authoring this book, some features are not supported in Azure Monitor Agent, such as integration into Microsoft Defender for Servers with EDR capabilities. While Azure Monitor Agent supports DCRs, the Log Analytics agent does not. There are also some differences in terms of supported operating systems: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview#supported-operating-systems.

You can view the full list of feature differences between the different agents here: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview. It should be noted that Azure Monitor Agent is eventually going...

The rest of the chapter is locked

You're reading from Windows Ransomware Detection and Protection Securing Windows endpoints, the cloud, and infrastructure using Microsoft Intune, Sentinel, and Defender

Table of Contents (16) Chapters

Collecting logs and data sources

Authors (1)

Personalised recommendations for you

You're reading from Windows Ransomware Detection and Protection Securing Windows endpoints, the cloud, and infrastructure using Microsoft Intune, Sentinel, and Defender

Table of Contents (16) Chapters

Collecting logs and data sources

Unlock this book and the full library FREE for 7 days

Authors (1)

Personalised recommendations for you