Design and implement appropriate metrics and queries for security

Define and Instrument Security Metrics

Key Telemetry Sources

Azure provides several services that generate security data, and knowing which ones to watch is the first step in building good monitoring. Azure Key Vault tracks who accesses your secrets and keys, which matters because leaked credentials cause many breaches. Azure Policy watches your resources and flags any that don't meet your security rules, such as storage accounts allowing public access. Microsoft Defender for Cloud scans your environment for threats and sends alerts when it finds suspicious activity, like unusual login attempts or malware. Azure Monitor Logs collects the raw data from all these services into one place where you can search and analyze it. Together, these sources give you a complete picture of your security posture.

Configuring Metrics and Queries

Once you know where the data comes from, you need tools to make sense of it. Log Analytics Workspace acts as a central repository that gathers logs from all your Azure resources so you can query them together. The Kusto Query Language (KQL) lets you write queries that sift through millions of log entries to find security issues, such as failed login attempts from foreign IP addresses. You can combine KQL with Log Analytics to build interactive dashboards that update in real time as new data arrives. Alerts work alongside queries to notify you immediately when something suspicious happens, rather than waiting for you to check the dashboard.

Visualizing Security Data

Dashboards turn raw data into something you can act on quickly. Azure Dashboards let you combine charts, graphs, and log queries into a single view that shows your security health at a glance. Workbooks go further by letting you add explanatory text alongside your metrics, which helps team members understand what they're looking at without needing deep technical knowledge. Setting up alerts through Azure Monitor ensures that critical issues reach the right people fast, whether through email, SMS, or integration with incident management tools. The goal is to have a clear picture of your security state without requiring constant manual checking.

Best Practices

Effective security monitoring requires ongoing attention and the right tools. Enable threat detection on all critical services—Microsoft Defender for SQL watches database queries for patterns that suggest attacks. Review security recommendations from Microsoft Defender for Cloud regularly, because they reflect the latest threat intelligence and Azure best practices. Use metric dimensions to add context; for example, tracking total failed logins matters, but knowing which user accounts fail most often tells you whether a specific account is compromised. These practices help you detect threats faster and prove to auditors that you maintain proper security controls.