Security Monitoring for Azure Container Apps

Implement Diagnostic Settings and Alerting for Container Apps

Diagnostic Settings for Logs and Metrics

Azure Container Apps need a way to send runtime data to centralized services so that you can analyze activity and spot problems. Diagnostic settings control which logs and metrics leave the container environment and where they go. You enable a diagnostic setting on a Container App resource and choose one or more destinations:

• Log Analytics workspaces – for interactive querying with Kusto Query Language (KQL) and long-term trend analysis.
• Event Hubs – for streaming data to external SIEM tools or custom processing pipelines.
• Storage Accounts – for cheap, long-term archival of logs and metrics when you do not need real-time querying.

Collecting both logs (error messages, request details, configuration changes) and metrics (CPU, memory, request count) gives you a complete picture. Logs help you investigate what happened during an incident, while metrics help you detect resource exhaustion or scaling anomalies. The diagnostic setting defines a pipeline: data flows from the Container App to the chosen sink, where it becomes available for monitoring and alerting.

Vulnerability Assessments with Azure Defender for Containers

Azure Defender for Containers adds a security layer that scans container images and monitors running containers. The service performs two types of vulnerability assessment:

• Image scanning – detects missing patches, outdated libraries, and known CVEs in the container image before deployment and after each new build.
• Runtime monitoring – watches running containers for suspicious process activity, unexpected network connections, or privilege escalation attempts.

When integrated with Azure Defender, you get continuous visibility into the security posture of every container. A scan report shows each vulnerability, its severity, and remediation guidance. You can prioritize fixes based on risk and block vulnerable images from being deployed. At runtime, Defender generates security alerts when it detects behavior that deviates from a baseline, such as a container spawning a shell or connecting to a known malicious IP. These alerts feed into the same monitoring pipeline you set up with diagnostic settings.

Custom Alert Rules for Anomalous Behavior

Once logs and metrics arrive in Log Analytics or Event Hubs, you need rules that turn raw data into actionable signals. Azure Monitor and Azure Sentinel allow you to define custom alert rules that trigger when certain conditions are met. Common rule sources include:

• Log Analytics query results – detect error patterns, repeated authentication failures, configuration changes, or unauthorized access attempts.
• Metric thresholds – fire an alert when CPU spikes above 90%, memory usage exceeds a limit, or container restarts happen more than a defined number of times per hour.
• Sentinel analytics rules – combine events from multiple data sources (container logs, Azure Activity logs, network logs) to hunt for sophisticated attacks.

Each alert rule can invoke an automated response, such as sending a notification, running a Logic App that scales down compromised containers, or executing a runbook that isolates the affected app. The combination of diagnostic settings and alert rules ensures that timely alerts are generated for both performance and security incidents.

Continuous Monitoring and Response

By combining diagnostic settings, Azure Defender for Containers, and custom alert rules, you build a layered monitoring system that covers the full lifecycle of a containerized application. Data flows from the container to centralized storage, vulnerability scans run continuously, and behavioral rules detect anomalies in real time. Automated responses then contain threats before they escalate. This approach keeps container workloads compliant, secure, and resilient against both known vulnerabilities and emerging attack patterns.