13.2 Defender Cloud Workload Protection (CWP) Plans

8.2 Defender Cloud Workload Protection (CWP) Plans

While Cloud Security Posture Management (CSPM) focuses on proactive configuration hardening, Cloud Workload Protection (CWP) plans deliver real-time threat detection, behavioral protection, vulnerability management, and automated incident responses across compute, data, storage, and service control planes.

---

Defender CWP Plans Deep Dive

Microsoft Defender for Cloud offers specialized CWP plans tailored to specific resource types across cloud workloads.

1. Defender for Servers (Plan 1 vs. Plan 2)

Defender for Servers provides endpoint detection and threat protection for Windows and Linux virtual machines in Azure, AWS, GCP, and on-premises via Azure Arc.

Key Server Protection Mechanisms

• Just-In-Time (JIT) VM Access: Restricts management ports (such as RDP 3389 and SSH 22) by configuring Network Security Group (NSG) rules to deny access by default. When an administrator requests access, Defender for Cloud opens the NSG port exclusively for the requester's IP address for a limited duration (e.g., 3 hours).
• File Integrity Monitoring (FIM): Tracks real-time changes to Windows system files, registry keys, application binaries, and Linux configuration files (/etc/, /usr/bin/) to detect unauthorized tampering or persistence mechanisms.

2. Defender for Containers

Provides threat protection for Azure Kubernetes Service (AKS), Amazon EKS, Google GKE, and unmanaged Kubernetes clusters:

• Architecture: Combines agentless control plane audit log analysis with an eBPF-based daemonset agent (Defender agent) running on Kubernetes worker nodes.
• Image Vulnerability Scanning: Automatically scans container images uploaded to Azure Container Registry (ACR) for known vulnerabilities (CVEs), OS package defects, and language package flaws before deployment.
• Runtime Threat Detection: Monitors Kubernetes API server audit logs and container process execution to detect cluster exposure, privilege escalation, suspicious container creation, and reverse shell connections.

3. Defender for Storage

Protects Azure Blob Storage, Azure Files, and Azure Data Lake Storage environments:

• Malware Scanning on Upload: Near-real-time streaming analysis of uploaded blobs using integrated Microsoft Defender Antivirus engine. Detects and isolates uploaded malware, ransomware payloads, or malicious scripts.
• Sensitive Data Discovery Scanning: Scans blob storage for exposed sensitive data types (financial records, PII, credentials) to evaluate exposure risk.
• Activity Threat Detection: Analyzes storage telemetry for anomalous access patterns, suspicious anonymous access, mass data exfiltration attempts, or unauthorized access from known malicious IP addresses.

4. Defender for Key Vault

Monitors management plane and data plane operations across Azure Key Vault instances:

• Detects unauthorized access attempts to secrets, certificates, and encryption keys.
• Identifies unusual volume requests, compromised identity access, or secret extraction attempts initiated from TOR exit nodes or suspicious IP ranges.

5. Defender for SQL & Resource Manager

• Defender for SQL: Provides vulnerability assessments and Advanced Threat Protection (ATP) across Azure SQL Database, Managed Instances, and SQL Servers on Azure VMs/Arc. Detects SQL injection attacks, anomalous database queries, and credential abuse.
• Defender for Resource Manager: Monitors Azure Resource Manager (ARM) control plane calls to detect malicious administrative activity (such as bulk resource deletions, unauthorized role assignments, or malicious script execution via Custom Script Extensions).

---

Security Alerts Triage & MITRE ATT&CK Mapping

When a threat is detected by a CWP plan, Defender for Cloud generates a Security Alert. Security alerts are classified by severity to assist SOC triage:

• High: High-confidence indications of active compromise or malicious code execution (e.g., ransomware execution, active Mimikatz credential dumping).
• Medium: Suspicious activity that may indicate unauthorized access or reconnaissance (e.g., unusual PowerShell execution, abnormal Key Vault retrieval).
• Low: Low-confidence alerts or suspicious baseline shifts that require investigation.
• Informational: Contextual security events logged for operational awareness.

Alerts are mapped to the MITRE ATT&CK framework matrix (Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Impact) to help analysts trace threat progression.

---

Alert Suppression Rules

To prevent SOC alert fatigue, administrators configure Alert Suppression Rules to dismiss known false positives or authorized administrative routines automatically.

Suppression Rule Configuration Parameters

• Matching Criteria: Filter by Alert Name, Resource Group, Specific Entities (IP address, account name, process path), or Environment Scope.
• Suppression State: Automatically sets the matching alert status to Dismissed upon generation.
• Reason & Justification: Specifies why the suppression exists (e.g., Authorized Penetration Testing, Expected Administrative Maintenance Script).
• Expiration Window: Rules can be configured with an automated expiration date to enforce periodic re-evaluation.

---

Workflow Automation & Continuous Export

Defender for Cloud integrates with external automation platforms and SIEM tools via Continuous Export and Workflow Automation:

1. Continuous Export: Streamlessly streams security alerts and security recommendations in real time to:
   • Azure Event Hubs: For ingestion into external third-party SIEM platforms (such as Splunk, IBM QRadar, or ArcSight).
   • Log Analytics Workspace: For long-term querying and custom reporting using Kusto Query Language (KQL).
2. Workflow Automation: Automatically triggers Azure Logic Apps playbooks when specific security alerts or recommendation state changes occur, facilitating instant automated remediation.