Microsoft's cloud computing platform offering compute, storage, networking, and a comprehensive suite of security services. For SOC teams, Azure provides activity logs, security signals, and integrations with Sentinel and Defender for cloud workload monitoring.
What is Microsoft Azure?
Microsoft Azure is Microsoft's cloud computing platform, offering a broad portfolio of infrastructure, platform, and software services used by enterprises worldwide. From a security operations perspective, Azure generates extensive telemetry through its native security services: Azure Monitor captures platform-level metrics and logs, Microsoft Defender for Cloud provides vulnerability assessments and security recommendations across Azure workloads, and Azure Active Directory logs record every authentication event, conditional access evaluation, and directory change. For SOC teams, Azure's activity logs are a critical data source for detecting unauthorized resource creation, privilege escalation within the cloud environment, and lateral movement between cloud services. The tight integration between Azure's native security tools and Microsoft Sentinel makes it a natural anchor for organizations building a Microsoft-centric security stack.
How does Microsoft Azure work with Qevlar?
Qevlar integrates with Microsoft Azure to ingest activity logs and security signals during cloud-focused investigations. When an alert involves suspicious Azure resource activity, unusual service principal behavior, or an anomalous authentication pattern, Qevlar can query Azure logs directly to reconstruct the sequence of events and determine the impact.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is Microsoft Azure?
Microsoft Azure is Microsoft's cloud platform. For security teams it produces extensive telemetry through Azure Monitor, Microsoft Defender for Cloud and Azure activity logs — a critical source for detecting unauthorized resource creation, privilege escalation and lateral movement in the cloud.
What can you do with Microsoft Azure in Qevlar?
Qevlar can ingest Azure activity logs and security signals to investigate cloud alerts automatically, querying the logs to reconstruct the sequence of events behind suspicious resource activity or anomalous service-principal behavior.
Does Qevlar work with the broader Microsoft security stack?
Yes. Qevlar correlates Azure signals with Microsoft Defender, Entra ID and Sentinel data, giving cross-domain context for Microsoft-centric environments.
Can Qevlar determine the impact of an Azure incident?
Yes. By following the activity logs and correlating with identity and workload data, Qevlar establishes what was affected and whether the activity represents a genuine threat.
Other integrations
.avif)
