3. Research Red Team tools that hackers and pentesters commonly use and compare those tools to the defender tools available from Microsoft:
4. Do the same for a list of BlueTeam tools and compare to those available from Microsoft:
5. Use the above 2 tables (and whatever else you can dream up) to identify gaps in your security defenses and to educate you on Microsoft tools that may be of value.
If you’re using the Microsoft AMA agent, you’re likely familiar with Data Collection Rules.
This tip is specifically for AMA agents installed on linux servers for the purpose of collecting syslog data.
It’s pretty easy to create 2 or more DCRs that overlap in their logic and result in collecting duplicate data. A common example is to get duplicate syslog data showing up in both the Syslog and CommonSecurityLog tables.
It can be difficult to read through all of your DCRs to find the duplicate configuration.
One approach to fixing this issue is to login to your server where the AMA agent is installed and look at the json files under:
/etc/opt/microsoft/azuremonitoragent/config-cache/configchunks/
Each json file represents a single Data Collection Rule. Here’s an example. Pay attention to the value following “agentConfigurations/dcr-<some alphanumeric>”
You’ll need that value to trace back to the DCR configuration in the Azure portal.
Now go to the Azure Portal and open the Resource Graph Explorer:
Run this query to get a list of your DCRs and their associated “dcr-xxx” values:
resources
| where type == 'microsoft.insights/datacollectionrules'
|extend immutableId = properties.immutableId
|project name, immutableIdOnce you’ve identified a DCR you can simply delete it and after a few minutes you will see the .json file disappear from your AMA’s /configchunks/ directory.
Restarting the AMA agent might speed up the process of the json file being removed:
systemctl restart azuremonitoragent
or:
cd /var/lib/waagent/Microsoft.Azure.Monitor.AzureMonitorLinuxAgent-<agent version>
./shim.sh -disable
./shim.sh -enable
ls /etc/opt/microsoft/azuremonitoragent/config-cache/configchunks/*.json
Simple-Security 