3.3.1. Defender for Cloud Workload Protection Alerts
💡 First Principle: Cloud workload protection plans watch each resource type for the attacks that type attracts: servers for malware and suspicious processes, storage for unusual access and malware uploads, databases for SQL injection and anomalous logins, containers for suspicious runtime behavior, Key Vault for unusual secret access, and the Azure control plane for suspicious management operations. Each plan raises alerts that describe the resource, the activity, and recommended remediation.
Microsoft Defender for Cloud provides these as paid Defender plans, enabled per subscription (or AWS account or Google Cloud project): Defender for Servers (which deploys Defender for Endpoint to protected machines), Storage, Databases (Azure SQL, open-source databases, Cosmos DB), Containers, Key Vault, Resource Manager, App Service, and APIs. Security alerts flow into Defender XDR, where related alerts are correlated into incidents with other signals; for example, a suspicious sign-in followed by unusual Key Vault secret reads becomes one incident.
Investigating a workload alert means reading its details: the affected resource, the activity (with context such as source IP, user or identity, and process), the MITRE tactic, and the alert's take action guidance. That guidance has a consistent structure: inspect resource context (open the resource's logs and activity), mitigate the threat (manual remediation steps such as rotating keys, blocking an IP in a network security group, or stopping a VM), prevent future attacks (related security recommendations), trigger automated response (run a Logic App through workflow automation), and suppress similar alerts for known-benign patterns.
Because Azure resources don't have a universal containment button, response usually combines several moves: revoke or rotate the compromised credential (storage key, SAS token, Key Vault secret), restrict network access, investigate the identity that performed the action with Entra ID logs and the AzureActivity table, and, for servers, use Defender for Endpoint's device response actions (3.4). For multicloud resources the same alert model applies, with the remediation executed in the AWS or Google Cloud console.
⚠️ Exam Trap: "Automatically run a remediation workflow whenever a specific Defender for Cloud alert fires" uses workflow automation with a Logic App in Defender for Cloud (or a Sentinel automation rule and playbook if the alert is in Sentinel), not an alert suppression rule.
Reflection Question: A Defender for Storage alert shows a storage account being accessed from a Tor exit node using a valid shared access signature. What three containment steps would you take, and which log tells you how the attacker obtained the SAS?
