- Azure Data Explorer Data Lake
- Microsoft Azure Storage Explorer Download
- Azure Data Lake Storage Explorer
- Azure Data Lake Explorer Software
Ingest data into the Azure Data Explorer. The.ingest into table command can read the data from an Azure Blob or Azure Data Lake Storage and import the data into the cluster. This means it is ingesting the data and stores it locally for a better performance. Authentication is done with Azure SaS Tokens. Azure Data Explorer is an extremely fast big data interactive analytics engine delivering blazing fast queries over billions of records. Upload, download, and manage Azure blobs, files, queues, and tables, as well as Azure Cosmos DB and Azure Data Lake Storage entities. Easily access virtual machine disks, and work with either Azure Resource Manager or classic storage accounts.
This security baseline applies guidance from the Azure Security Benchmark version1.0 to Azure Data Explorer. The Azure Security Benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Azure Security Benchmark and the related guidance applicable to Azure Data Explorer.
Note
Controls not applicable to Azure Data Explorer, or for which the responsibility is Microsoft's, have been excluded. To see how Azure Data Explorer completely maps to the Azure Security Benchmark, see the full Azure Data Explorer security baseline mapping file.
Network Security
For more information, see the Azure Security Benchmark: Network Security.
1.1: Protect Azure resources within virtual networks
Guidance: Azure Data Explorer supports deploying a cluster into a subnet in your virtual network. This capability enables you to enforce network security group (NSG) rules on your Azure Data Explorer cluster traffic, connect your on-premises network to Azure Data Explorer cluster's subnet, and Secure your data connection sources (Event Hub and Event Grid) with service endpoints.
Responsibility: Customer
Azure Security Center monitoring: None
1.2: Monitor and log the configuration and traffic of virtual networks, subnets, and network interfaces
Guidance: Enable network security group (NSG) flow logs and send logs into a Storage Account for traffic audit.
Responsibility: Customer
Azure Security Center monitoring: None
1.4: Deny communications with known-malicious IP addresses
Guidance: Enable Azure DDoS Protection Standard on the virtual network protecting your Azure Data Explorer clusters for protection against DDoS attacks. Use Azure Security Center Integrated Threat Intelligence to deny communications with known malicious or unused Internet IP addresses.
Responsibility: Customer
Azure Security Center monitoring: None
1.5: Record network packets
Guidance: Enable Flow Logs on the network security groups (NSG) being used to protect your Azure Data Explorer cluster, and send logs into a Storage Account for traffic audit.
Responsibility: Customer
Azure Security Center monitoring: None
1.8: Minimize complexity and administrative overhead of network security rules
Guidance: Use Virtual Network Service Tags to define network access controls on Network Security Groups or Azure Firewalls associated with your Azure Data Explorer clusters. You can use service tags in place of specific IP addresses when creating security rules. By specifying the service tag name (e.g., ApiManagement) in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change.
Responsibility: Customer
Azure Security Center monitoring: None
1.9: Maintain standard security configurations for network devices
Guidance: Customer to define and implement standard security configurations for network resources with Azure Policy.
Customer may also use Azure Blueprints to simplify large-scale Azure deployments by packaging key environment artifacts, such as Azure Resource Manager templates, Azure RBAC controls, and Azure Policy assignments, in a single blueprint definition. Easily apply the blueprint to new subscriptions and environments, and fine-tune control and management through versioning.
Responsibility: Customer
Azure Security Center monitoring: None
1.10: Document traffic configuration rules
Guidance: Use tags for network security groups (NSG) and other resources related to network security and traffic flow for your Azure Data Explorer clusters. For individual NSG rules, use the 'Description' field to specify business need and/or duration (etc.) for any rules that allow traffic to/from a network.
Responsibility: Customer
Azure Security Center monitoring: None
1.11: Use automated tools to monitor network resource configurations and detect changes
Guidance: Use Azure Policy to validate (and/or remediate) configuration for network resources.
Responsibility: Customer
Azure Security Center monitoring: None
Logging and Monitoring
For more information, see the Azure Security Benchmark: Logging and Monitoring.
2.2: Configure central security log management
Guidance: Azure Data Explorer uses diagnostic logs for insights on ingestion successes and failures. You can export operation logs to Azure Storage, Event Hub, or Log Analytics to monitor ingestion status.
Responsibility: Customer
Azure Security Center monitoring: None
2.3: Enable audit logging for Azure resources
Guidance: Enable Diagnostic Settings for Azure Data Explorer for access and logging to service specific operations and logging. Azure Activity logs within Azure Monitor, which includes high-level logging about the resource are enabled by default.
Responsibility: Customer
Azure Security Center monitoring: None
2.5: Configure security log storage retention
Guidance: Within Azure Monitor, set your Log Analytics Workspace retention period according to your organization's compliance regulations. Use Azure Storage Accounts for long-term/archival storage.
Responsibility: Customer
Azure Security Center monitoring: None
2.6: Monitor and review logs
Guidance: Analyze and monitor logs for anomalous behaviors and regularly review results. After enabling Diagnostic Settings for Azure Data Explorer, use Azure Monitor's Log Analytics Workspace to review logs and perform queries on log data.
Responsibility: Customer
Azure Security Center monitoring: None
Identity and Access Control
For more information, see the Azure Security Benchmark: Identity and Access Control.
3.1: Maintain an inventory of administrative accounts
Guidance: In Azure Data Explorer, security roles define which security principals (users and applications) have permissions to operate on a secured resource such as a database or a table, and what operations are permitted. You can leverage Kusto query to list principles in the admin role for the Azure Data Explorer clusters and databases.
Responsibility: Customer
Azure Security Center monitoring: None
3.2: Change default passwords where applicable
Guidance: Azure Active Directory (Azure AD) does not have the concept of default passwords. Other Azure resources requiring a password forces a password to be created with complexity requirements and a minimum password length, which differs depending on the service. You are responsible for third-party applications and marketplace services that may use default passwords.
Responsibility: Customer
Azure Security Center monitoring: None
3.3: Use dedicated administrative accounts
Guidance: Customer to create standard operating procedures around the use of dedicated administrative accounts. Use Azure Security Center Identity and Access Management to monitor the number of administrative accounts.
Customers can also enable a Just-In-Time / Just-Enough-Access by using Azure Active Directory (Azure AD) Privileged Identity Management Privileged Roles for Microsoft Services, and Azure ARM.
Responsibility: Customer
Azure Security Center monitoring: None
3.4: Use Azure Active Directory single sign-on (SSO)
Guidance: Wherever possible, customer to use SSO with Azure Active Directory (Azure AD) rather than configuring individual stand-alone credentials per-service. Use Azure Security Center Identity and Access Management recommendations.
Responsibility: Customer
Azure Security Center monitoring: None
3.5: Use multi-factor authentication for all Azure Active Directory-based access
Guidance: Enable Azure Active Directory (Azure AD) multifactor authentication and follow Azure Security Center Identity and Access Management recommendations.
Responsibility: Customer
Azure Security Center monitoring: None
3.6: Use secure, Azure-managed workstations for administrative tasks
Guidance: Use PAWs (privileged access workstations) with multifactor authentication) configured to log into and configure Azure resources.
Responsibility: Customer
Azure Security Center monitoring: None
3.7: Log and alert on suspicious activities from administrative accounts
Guidance: Use Azure Active Directory (Azure AD) security reports for generation of logs and alerts when suspicious or unsafe activity occurs in the environment. Use Azure Security Center to monitor identity and access activity
Responsibility: Customer
Azure Security Center monitoring: None
3.8: Manage Azure resources from only approved locations
Guidance: Customer to use Conditional Access named locations to allow access from only specific logical groupings of IP address ranges or countries/regions.
Responsibility: Customer
Azure Security Center monitoring: None
3.9: Use Azure Active Directory
Guidance: Azure Active Directory (Azure AD) is the preferred method for authenticating to Azure Data Explorer. Azure AD supports a number of authentication scenarios:
- User authentication (interactive logon): Used to authenticate human principals.
- Application authentication (non-interactive logon): Used to authenticate services and applications that have to run/authenticate with no human user being present.
For more information, see the following references:
Responsibility: Customer
Azure Security Center monitoring: None
3.10: Regularly review and reconcile user access
Guidance: Azure Active Directory (Azure AD) provides logs to help discover stale accounts. In addition, use Azure Identity Access Reviews to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right Users have continued access.
Responsibility: Customer
Azure Security Center monitoring: None
3.11: Monitor attempts to access deactivated credentials
Guidance: You may use Azure Active Directory (Azure AD) Sign in Activity, Audit and Risk Event log sources for monitoring which allows you to integrate with any Security Information and Event Management (SIEM) / Monitoring tool.
You can streamline this process by creating Diagnostic Settings for Azure AD user accounts, sending the audit logs and sign-in logs to a Log Analytics Workspace. Customer to configure desired Alerts within Log Analytics Workspace.
Responsibility: Customer
Lg flatron w1934s driver windows 10. Azure Security Center monitoring: None
3.12: Alert on account sign-in behavior deviation
Guidance: Use Azure Active Directory (Azure AD) Risk Detections and Identity Protection feature to configure automated responses to detected suspicious actions related to user identities. Additionally, you can ingest data into Azure Sentinel for further investigation.
Responsibility: Customer
Azure Security Center monitoring: None
3.13: Provide Microsoft with access to relevant customer data during support scenarios
Guidance: In support scenarios where Microsoft needs to access customer data, Customer Lockbox provides an interface for customers to review and approve or reject customer data access requests.
Responsibility: Customer
Azure Security Center monitoring: None
Data Protection
For more information, see the Azure Security Benchmark: Data Protection.
4.1: Maintain an inventory of sensitive Information
Guidance: Use tags to assist in tracking Azure resources that store or process sensitive information.
Responsibility: Customer
Azure Security Center monitoring: None
4.2: Isolate systems storing or processing sensitive information
Guidance: Implement separate subscriptions and/or management groups for development, test, and production. Azure Data Explorer clusters should be separated from other resources by virtual network/subnet, tagged appropriately, and secured within a network security group (NSG) or Azure Firewall. Azure Data Explorer clusters storing or processing sensitive data should be sufficiently isolated.
Responsibility: Customer
Azure Security Center monitoring: None
4.4: Encrypt all sensitive information in transit
Guidance: Azure Data Explorer cluster negotiates TLS 1.2 by default. Ensure that any clients connecting to your Azure resources are able to negotiate TLS 1.2 or greater.
Responsibility: Shared
Azure Security Center monitoring: None
4.5: Use an active discovery tool to identify sensitive data
Guidance: Data identification, classification, and loss prevention features are not yet available for Azure Data Explorer. Implement third-party solution if required for compliance purposes.
For the underlying platform which is managed by Microsoft, Microsoft treats all customer content as sensitive and goes to great lengths to guard against customer data loss and exposure. To ensure customer data within Azure remains secure, Microsoft has implemented and maintains a suite of robust data protection controls and capabilities.
Responsibility: Customer
Azure Security Center monitoring: None
4.6: Use Role-based access control to control access to resources
Guidance: Azure Data Explorer enables you to control access to databases and tables, using an Azure role-based access control (RBAC) model. Under this model, principals (users, groups, and apps) are mapped to roles. Principals can access resources according to the roles they're assigned.
Responsibility: Customer
Azure Security Center monitoring: None
4.8: Encrypt sensitive information at rest
Guidance: Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. It provides volume encryption for the OS and data disks of your cluster virtual machines. It also integrates with Azure Key Vault which allows us to control and manage the disk encryption keys and secrets, and ensure all data on the VM disks is encrypted at rest while in Azure Storage.
Responsibility: Customer
Azure Security Center monitoring: None
4.9: Log and alert on changes to critical Azure resources
Guidance: Use Azure Monitor with the Azure Activity Log to create alerts for when resource-level changes take place on your Azure Data Explorer clusters.
Responsibility: Customer
Azure Security Center monitoring: None
Vulnerability Management
For more information, see the Azure Security Benchmark: Vulnerability Management.
5.5: Use a risk-rating process to prioritize the remediation of discovered vulnerabilities
Guidance: Use the default risk ratings (Secure Score) provided by Azure Security Center.
Responsibility: Customer
Azure Security Center monitoring: None
Inventory and Asset Management
For more information, see the Azure Security Benchmark: Inventory and Asset Management.
6.1: Use automated asset discovery solution
Guidance: Use Azure Resource Graph to query and discover all resources in your subscriptions. Ensure appropriate (read) permissions in your tenant and enumerate all Azure subscriptions as well as resources within your subscriptions.
Although classic Azure resources may be discovered via Resource Graph, it is highly recommended to create and use Azure Resource Manager resources going forward.
Responsibility: Customer
Azure Security Center monitoring: None
6.2: Maintain asset metadata
Guidance: Apply tags to Azure resources giving metadata to logically organize them into a taxonomy.
Responsibility: Customer
Azure Security Center monitoring: None
6.3: Delete unauthorized Azure resources
Guidance: You may use appropriate naming conventions, tagging, management groups, or separate subscriptions, where appropriate, to organize and track assets. You may use Azure Resource Graph to reconcile inventory on a regular basis and ensure unauthorized resources are deleted from the subscription in a timely manner.
Responsibility: Customer
Azure Security Center monitoring: None
6.4: Define and maintain inventory of approved Azure resources
Guidance: You will need to create an inventory of approved Azure resources and approved software for compute resources as per your organizational needs.
Responsibility: Customer
Azure Security Center monitoring: None
6.5: Monitor for unapproved Azure resources
Guidance: You may use Azure policies to put restrictions on the type of resources that can be created in customer subscriptions using the following built-in policy definitions:
Not allowed resource types
Allowed resource types
You will be able to monitor the policy-generated events using the Activity logs which can be monitored using Azure Monitor.
In addition, you may use the Azure Resource Graph to query/discover resources within the subscriptions.
Responsibility: Customer
Azure Security Center monitoring: None
6.9: Use only approved Azure services
Guidance: You may use Azure policies to put restrictions on the type of resources that can be created in customer subscription(s) using the following built-in policy definitions:
Not allowed resource types
Allowed resource types
For more information, see the following references:
Responsibility: Customer
Azure Security Center monitoring: None
6.11: Limit users' ability to interact with Azure Resource Manager
Guidance: Use the Azure Conditional Access to limit users' ability to interact with Azure Resource Manager by configuring 'Block access' for the 'Microsoft Azure Management' App. This will prevent the creation and changes to resources within your Azure subscriptions.
Responsibility: Customer
Azure Security Center monitoring: None
Secure Configuration
For more information, see the Azure Security Benchmark: Secure Configuration.
7.1: Establish secure configurations for all Azure resources
Guidance: Use Azure Policy aliases to create custom policies to audit or enforce the configuration of your Azure resources. You may also use built-in Azure Policy definitions.
Also, Azure Resource Manager has the ability to export the template in JavaScript Object Notation (JSON), which should be reviewed to ensure that the configurations meet or exceed the security requirements for your organization.
You can also use recommendations from Azure Security Center as a secure configuration baseline for your Azure resources.
Responsibility: Customer
Azure Security Center monitoring: None
7.3: Maintain secure Azure resource configurations
Guidance: Use Azure policy [deny] and [deploy if not exist] to enforce secure settings across your Azure resources. You may use solutions such as Change Tracking, Policy compliance dashboard or a custom solution to easily identify security changes in your environment.
Responsibility: Customer
Azure Security Center monitoring: None
7.5: Securely store configuration of Azure resources
Guidance: Use Azure Repos to securely store and manage your code like custom Azure policies, Azure Resource Manager templates, Desired State Configuration scripts etc. To access the resources you manage in Azure DevOps, you can grant or deny permissions to specific users, built-in security groups, or groups defined in Azure Active Directory (Azure AD) if integrated with Azure DevOps, or Active Directory if integrated with TFS.
Responsibility: Customer
Azure Security Center monitoring: None
7.7: Deploy configuration management tools for Azure resources
Guidance: Define and implement standard security configurations for Azure resources using Azure Policy. Use Azure Policy aliases to create custom policies to audit or enforce the network configuration of your Azure resources. You may also make use of built-in policy definitions related to your specific resources. Additionally, you may use Azure Automation to deploy configuration changes.
Responsibility: Customer
Azure Security Center monitoring: None
7.9: Implement automated configuration monitoring for Azure resources
Guidance: Use Azure Policy aliases to create custom policies to alert, audit, and enforce system configurations. Use Azure policy [audit], [deny], and [deploy if not exist] to automatically enforce configurations for your Azure resources.
Responsibility: Customer
Azure Security Center monitoring: None
7.12: Manage identities securely and automatically
Guidance: Use Managed Identities to provide Azure services with an automatically managed identity in Azure Active Directory (Azure AD). Managed Identities allows you to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.
Responsibility: Customer
Azure Security Center monitoring: None
7.13: Eliminate unintended credential exposure
Guidance: Implement Credential Scanner to identify credentials within code. Credential Scanner will also encourage moving discovered credentials to more secure locations such as Azure Key Vault.
Responsibility: Customer
Azure Security Center monitoring: None
Malware Defense
For more information, see the Azure Security Benchmark: Malware Defense.
8.2: Pre-scan files to be uploaded to non-compute Azure resources
Guidance: Microsoft anti-malware is enabled on the underlying host that supports Azure services (for example, Azure Data Explorer), however it does not run on customer content.
Pre-scan any content being uploaded to non-compute Azure resources, such as Azure Data Explorer, Data Lake Storage, Blob Storage, Azure Database for PostgreSQL, etc. Microsoft cannot access your data in these instances.
Responsibility: Customer
Azure Security Center monitoring: None
Data Recovery
For more information, see the Azure Security Benchmark: Data Recovery.
9.1: Ensure regular automated back-ups
Guidance: The data in your Microsoft Azure storage account used by your Azure Data Explorer cluster is always replicated to ensure durability and high availability. Azure Storage copies your data so that it is protected from planned and unplanned events, including transient hardware failures, network or power outages, and massive natural disasters. You can choose to replicate your data within the same data center, across zonal data centers within the same region, or across geographically separated regions.
Responsibility: Customer
Azure Security Center monitoring: None
9.2: Perform complete system backups and backup any customer-managed keys
Guidance: Azure Data Explorer encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can supply customer-managed keys to use for data encryption. Customer-managed keys must be stored in an Azure Key Vault.
Responsibility: Customer
Azure Security Center monitoring: None
9.3: Validate all backups including customer-managed keys
Guidance: Periodically test data restoration of your Azure Key Vault secrets.
Responsibility: Customer
Azure Security Center monitoring: None
9.4: Ensure protection of backups and customer-managed keys
Guidance: Enable Soft-Delete in Key Vault to protect keys against accidental or malicious deletion. You can also enable purge protection so that if a vault or an object in the deleted state, it cannot be purged until the retention period has passed.
Responsibility: Customer
Azure Security Center monitoring: None
Incident Response
For more information, see the Azure Security Benchmark: Incident Response.
10.1: Create an incident response guide
Guidance: Build out an incident response guide for your organization. Ensure that there are written incident response plans that define all roles of personnel as well as phases of incident handling/management from detection to post-incident review.
Responsibility: Customer
Azure Security Center monitoring: None
10.2: Create an incident scoring and prioritization procedure
Guidance: Security Center assigns a severity to each alert to help you prioritize which alerts should be investigated first. The severity is based on how confident Security Center is in the finding or the analytics used to issue the alert as well as the confidence level that there was malicious intent behind the activity that led to the alert.
Additionally, clearly mark subscriptions (for ex. production, non-prod) using tags and create a naming system to clearly identify and categorize Azure resources, especially those processing sensitive data. It is your responsibility to prioritize the remediation of alerts based on the criticality of the Azure resources and environment where the incident occurred.
Responsibility: Customer
Azure Security Center monitoring: None
10.3: Test security response procedures
Guidance: Conduct exercises to test your systems’ incident response capabilities on a regular cadence to help protect your Azure resources. Identify weak points and gaps and revise plan as needed.
Responsibility: Customer
Azure Security Center monitoring: None
Azure Data Explorer Data Lake
10.4: Provide security incident contact details and configure alert notifications for security incidents
Guidance: Security incident contact information will be used by Microsoft to contact you if the Microsoft Security Response Center (MSRC) discovers that your data has been accessed by an unlawful or unauthorized party. Review incidents after the fact to ensure that issues are resolved.
Responsibility: Customer
Azure Security Center monitoring: None
10.5: Incorporate security alerts into your incident response system
Guidance: Export your Azure Security Center alerts and recommendations using the Continuous Export feature to help identify risks to Azure resources. Continuous Export allows you to export alerts and recommendations either manually or in an ongoing, continuous fashion. You may use the Azure Security Center data connector to stream the alerts to Azure Sentinel.
Responsibility: Customer
Azure Security Center monitoring: None
10.6: Automate the response to security alerts
Guidance: Use the Workflow Automation feature in Azure Security Center to automatically trigger responses via 'Logic Apps' on security alerts and recommendations to protect your Azure resources.
Responsibility: Customer
Azure Security Center monitoring: None
Penetration Tests and Red Team Exercises
Microsoft Azure Storage Explorer Download
For more information, see the Azure Security Benchmark: Penetration Tests and Red Team Exercises.
11.1: Conduct regular penetration testing of your Azure resources and ensure remediation of all critical security findings
Guidance: Follow the Microsoft Cloud Penetration Testing Rules of Engagement to ensure your penetration tests are not in violation of Microsoft policies. Use Microsoft's strategy and execution of Red Teaming and live site penetration testing against Microsoft-managed cloud infrastructure, services, and applications.
Responsibility: Shared
Azure Data Lake Storage Explorer
Azure Security Center monitoring: None
Next steps
Azure Data Lake Explorer Software
- See the Azure Security Benchmark V2 overview
- Learn more about Azure security baselines