Navigating Microsoft Defender for Cloud

This chapter explores Microsoft Defender for Cloud, covering its components and functionalities while emphasizing the importance of integration within the Microsoft ecosystem. It discusses the complexities of security analytics in Azure environments, focusing on behavior analysis, anomaly detection, and the challenges of managing access permissions. The conversation highlights strategies for mitigating insider threats and enhancing detection mechanisms, underscoring the need for robust permission management to protect against stealthy attacks.

Transcript

chevron_right

Play full episode

chevron_right

Transcript

Episode notes

In this episode, Ashish sits down with Christian Philipov, Principal Security Consultant at WithSecure, to explore the stealth tactics threat actors are using in Azure and why many of these go undetected.

Christian breaks down the lesser-known APIs like Ibiza and PIM, how Microsoft Graph differs from legacy APIs, and what this means for defenders.