Month: February 2024

It was a total surprise for me… without any warning… just info from: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/linux-whatsnew?view=o365-worldwide July-2023 Build: 101.23062.0010 | Release version: 30.123062.0010.0   Other fixes and improvements From this version, enforcementLevel are in passive mode by default giving admins more control over where they want ‘RTP on’ within their estate This change only applies to fresh MDE deployments, for example, servers where Defender for Endpoint is being deployed for the first time. In update scenarios, servers that have Defender for Endpoint deployed with RTP ON, continue operating with RTP ON even post update to version 101.23062.0010     July-2023 Build: 101.23062.0010 | Release version: 30.123062.0010.0   Available in Defender for Endpoint version 101.10.72 or higher. Default is changed from real_time to passive for Endpoint version 101.23062.0001 or higher.   Passive (passive): Runs the antivirus engine in passive mode. In this: Real-time protection is turned off: Threats are not remediated by Microsoft Defender Antivirus. On-demand scanning is turned on: Still use the scan capabilities on the endpoint. Automatic threat remediation is turned off: No files will be moved and security admin is expected to take required action. Security intelligence updates are turned on: Alerts will be available on security admins tenant. Interesting … Defender for Endpoint / Defender for Servers – Linux – Real-time protection is turned off by default – check if your Linux workload are safe #1Read more

Create Google Organization: GCP Account must be a part of the organization – not a “No Organization”, you can create a new one, but it must be an owner internet domain. You can follow: If you have an organization you can move the existing account to it: https://cloud.google.com/identity/docs/set-up-cloud-identity-admin#migrate-projects-and-billing-accounts-and-set-permissions Activate Terraform API: Just visit in GCP and activate Cloud Resource Manager API: Install Terraform: curl https://apt.releases.hashicorp.com/gpg | gpg –dearmor > hashicorp.gpg sudo install -o root -g root -m 644 hashicorp.gpg /etc/apt/trusted.gpg.d/ sudo apt-add-repository “deb [arch=$(dpkg –print-architecture)] https:// apt.releases.hashicorp.com $(lsb_release -cs) main” sudo apt install terraform terraform –version Prapare GCP to Send data to the Azure Sentinel: mkdir pubsub cd pubsub/ wget https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPInitialAuthenticationSetup/GCPInitialAuthenticationSetup.tf export GOOGLE_PROJECT=angelic-hold-403608 gcloud auth application-default login gcloud config set project angelic-hold-403608 export GOOGLE_APPLICATION_CREDENTIALS=/root/cred.json where cred.json – are json of credentials downloaded from service account: https://console.cloud.google.com/iam-admin/serviceaccounts terraform init terraform apply In case of error: Error: Error creating WorkloadIdentityPoolProvider: googleapi: Error 404: Requested entity was not found. Just retry the terraform apply it is because google API is activated during first time of use. Create App registration in Azure: Log in to Azure and Browse to Identity > Applications > App registrations then select New registration. Only redirect should be composed … GCP Logs To Azure Sentinel #1Read more

Azure Reservations helps you save money with 1- or 3-year plans for many products. The pledge allows you to get a discount on the resources you use. Reservations can significantly reduce resource costs by up to 72% compared to pay-as-you-go pricing. Reservations provide a billing discount and do not impact the runtime state of your resources. The booking discount will be automatically applied to the matching inventory once the booking is purchased. You can pay for your reservation in advance or in monthly installments. The total booking cost for prepaid and monthly installments is the same, and there are no additional charges for choosing monthly payments. In short, we say that we need a given resource, e.g. a virtual machine, for 3 years and we undertake to maintain it for 3 years, or rather we undertake to pay for 3 years for which we receive a discount. At this point, there are different strategies for selecting a reservation, the two most important ones are: What will happen if we choose the wrong reservation? Or do we no longer need a reservation? It depends on your cloud provider…. If you pay millions for subscriptions, there will be no problem with any … Mistakes happen – even in Cloud – unwanted reservations / Błędy się zdarzają – nawet w Cloud – niechciane rezerwacjeRead more