Haxoris Wiki

Logging and Defender Gaps

How Logging and Defender Gaps works

Missing diagnostics/activity logs and disabled Microsoft Defender for Cloud plans reduce detection and response capability across Azure resources. Lack of Log Analytics workspaces, short retention, and missing data plane logs (e.g., Key Vault, Storage) create blind spots for investigations.

Logging and Defender Gaps in practice

Check Diagnostic Settings

az monitor diagnostic-settings list --resource <resourceId>
az monitor diagnostic-settings categories list --resource <resourceId>
az monitor log-analytics workspace list -g <rg>

Defender Plans

az security pricing list

How to fix and prevent Logging and Defender Gaps

  1. Enable diagnostics to Log Analytics/Event Hub/Storage with long retention.
  2. Turn on Defender plans for critical resource types (Servers, App Services, Storage, SQL, Key Vault, Containers); configure recommendations/alerts.
  3. Enforce via Azure Policy
    • Require diagnostic settings across resource types; set minimum retention; ensure activity logs export to a central workspace.

Last updated

References