L17. Workload Protections: Servers, Containers and Databases

Defender for Servers

Defender for Servers protects Windows and Linux virtual machines across Azure, AWS, GCP, and on-premises (via Azure Arc). Two plans are available:

Plan 1 provides MDE integration at a lower cost. Plan 2 adds agentless scanning and advanced hardening features. Exam tip: Plan 2 includes Just-in-Time (JIT) VM access, which reduces the attack surface by closing management ports (RDP/SSH) until needed. Know how to configure and use JIT.

Just-in-Time VM Access

JIT reduces exposure of management ports:

1. JIT closes management ports (e.g., 3389, 22) on the NSG by default
2. An analyst requests access for a specific port, IP, and time duration
3. JIT opens the port for the requested duration and source IP only
4. Access automatically revokes when the time expires

JIT requests can be approved automatically or require manual approval from a security admin.

Defender for Containers

Defender for Containers protects Kubernetes environments:

Architecture:

• A Defender sensor (DaemonSet) is deployed on each Kubernetes node
• An Azure Policy add-on enforces admission control policies
• Container images are scanned agentlessly in the registry

Exam tip: Defender for Containers uses a DaemonSet sensor on Kubernetes nodes for runtime protection. The Azure Policy add-on handles admission control separately.

Defender for Databases

Multiple database protection plans: Defender for Azure SQL:

• Detects SQL injection attempts
• Identifies anomalous database access patterns
• Alerts on brute force login attempts
• Detects access from unusual locations

Defender for open-source databases:

• Covers PostgreSQL, MySQL, and MariaDB
• Detects anomalous access and brute force attacks

Defender for Cosmos DB:

• Detects SQL injection in Cosmos DB queries
• Identifies anomalous data access patterns
• Alerts on access from suspicious locations

Exam tip: Defender for Azure SQL detects SQL injection at the database level, complementing WAF-level detection at the network layer.

Defender for Storage

Defender for Storage protects Azure Blob, File, and Data Lake:

• Malware scanning: Scans uploaded files for malware (near real-time)
• Sensitive data threat detection: Alerts when sensitive data is accessed anomalously
• Anomalous access detection: Identifies unusual access patterns

Malware scanning can be configured to block malicious uploads or alert-only mode.

Security Alerts

When workload protections detect threats, they generate security alerts with:

• Severity (High, Medium, Low, Informational)
• Kill chain stage mapping (MITRE ATT&CK)
• Affected resource details
• Remediation guidance
• Raw evidence and related entities

Alerts flow into Defender for Cloud and, if connected, into Microsoft Sentinel for correlation with other security data.

Alert Suppression Rules

Create suppression rules to hide known false positive alerts:

• Filter by alert type, resource, IP, or other properties
• Set an expiration date for temporary suppressions
• Suppressed alerts are logged but not displayed in the active queue