+ \"categoryName\": \"survival-advice\",

+ \"definition\": \"text prompts about survival advice in camping/wilderness situations\",

+ \"sampleBlobUrl\": \"https://<your-azure-storage-url>/example-container/survival-advice.jsonl\"

+ \"text\": \"<Example text to analyze>\",

+ \"categoryName\": \"survival-advice\",

+ \"version\": 1

+ "query": "How much does she currently get paid per hour at the bank?"

+ "domain": "Medical",

+ "task": "Summarization",

+ "text": "Ms Johnson has been in the hospital after experiencing a stroke.",

+ "groundingSources": [

+ "Our patient, Ms. Johnson, presented with persistent fatigue, unexplained weight loss, and frequent night sweats. After a series of tests, she was diagnosed with HodgkinΓÇÖs lymphoma, a type of cancer that affects the lymphatic system. The diagnosis was confirmed through a lymph node biopsy revealing the presence of Reed-Sternberg cells, a characteristic of this disease. She was further staged using PET-CT scans. Her treatment plan includes chemotherapy and possibly radiation therapy, depending on her response to treatment. The medical team remains optimistic about her prognosis given the high cure rate of HodgkinΓÇÖs lymphoma."

+ ],

+ "reasoning": false

+ "ungroundedDetected": true,

+ "ungroundedPercentage": 1,

+ "ungroundedDetails": [

+ {

+ "text": "12/hour."

+ }

+ ]

+{

+ "query": "How much does she currently get paid per hour at the bank?"

+ "ungroundedDetected": true,

+ "ungroundedPercentage": 1,

+ "ungroundedDetails": [

+ {

+ "text": "12/hour.",

+ "offset": {

+ "utf8": 0,

+ "utf16": 0,

+ "codePoint": 0

+ },

+ "length": {

+ "utf8": 8,

+ "utf16": 8,

+ "codePoint": 8

+ },

+ "reason": "None. The premise mentions a pay of \"10/hour\" but does not mention \"12/hour.\" It's neutral. "

+ }

+ ]

+ "text": "to everyone, the best things in life are free. the stars belong to everyone, they gleam there for you and me. the flowers in spring, the robins that sing, the sunbeams that shine"

+* Assign `Cognitive Services User` role to your account to ensure the studio experience. Go to [Azure Portal](https://portal.azure.com/), navigate to your Content Safety resource or Azure AI Services resource, and select **Access Control** in the left navigation bar, then click **+ Add role assignment**, choose the `Cognitive Services User` role and select the memeber of your account that you need to assign this role to, then review and assign. It might take few minutes for the assignment to take effect.

+If your model is overly sensitive to small grammatical changes, like casing or diacritics, you can systematically manipulate your dataset directly in the Language Studio. To use these features, click on the Settings tab on the left toolbar and locate the **Advanced project settings** section.

+First, you can ***Enable data transformation for casing***, which normalizes the casing of utterances when training, testing, and implementing your model. If you've migrated from LUIS, you might recognize that LUIS did this normalization by default. To access this feature via the API, set the `"normalizeCasing"` parameter to `true`. See an example below:

+ Title: Use Language in Azure prompt flow

+description: Learn how to use Azure AI Language in prompt flow.

+# Use Language in Azure prompt flow

+> [!IMPORTANT]

+> Some of the features described in this article might only be available in preview. This preview is provided without a service-level agreement, and we don't recommend it for production workloads. Certain features might not be supported or might have constrained capabilities. For more information, see [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/).

+[Prompt flow in Azure AI Studio](../../../ai-studio/how-to/prompt-flow.md) is a development tool designed to streamline the entire development cycle of AI applications powered by Large Language Models (LLMs). You can explore and quickly start to use and fine-tune various natural language processing capabilities from Azure AI Language, reducing your time to value and deploying solutions with reliable evaluation.

+This tutorial teaches you how to use Language in prompt flow utilizing [Azure AI Studio](https://ai.azure.com).

+## Prerequisites

+- An Azure subscription - <a href="https://azure.microsoft.com/free/cognitive-services" target="_blank">Create one for free</a>.

+- Access granted to Azure OpenAI in the desired Azure subscription.

+ Currently, access to this service is granted only by application. You can apply for access to Azure OpenAI by completing the form at <a href="https://aka.ms/oai/access" target="_blank">https://aka.ms/oai/access</a>. Open an issue on this repo to contact us if you have an issue.

+- You need an Azure AI Studio hub or permissions to create one. Your user role must be **Azure AI Developer**, **Contributor**, or **Owner** on the hub. For more information, see [hubs](../../../ai-studio/concepts/ai-resources.md) and [Azure AI roles](../../../ai-studio/concepts/rbac-ai-studio.md).

+ - If your role is **Contributor** or **Owner**, you can [create a hub in this tutorial](#create-a-project-in-azure-ai-studio).

+ - If your role is **Azure AI Developer**, the hub must already be created.

+- Your subscription needs to be below your [quota limit](../../../ai-studio/how-to/quota.md) to deploy a new flow in this tutorial.

+## Create a project in Azure AI Studio

+Your project is used to organize your work and save state.

+## Using Azure AI Language via the prompt flow gallery

+You can create an Azure AI Language flow by either cloning the samples available in the gallery or creating a flow from scratch. If you already have flow files in local or file share, you can also import the files to create a flow. For the purposes of this tutorial we'll be using the prebuilt **Analyze Conversations** flow.

+To create a prompt flow from the gallery in Azure AI Studio:

+1. Sign in to Azure AI Studio and select your project.

+1. From the collapsible left menu, select Prompt flow.

+1. Select + Create.

+1. Find the **Analyze Conversations** tile in the gallery and select *Clone*.

+1. In the right sidebar, name the folder and click the **Clone** button.

+1. After the process is complete, you'll be taken to the prompt flow wizard. Click **Start Compute Session** in the upper right hand corner to begin. The various parts of the wizard are out lined below:

+ :::image type="content" source="../media/prompt-flow/prompt-flow-wizard.png" alt-text="Screenshot of the prompt flow wizard page with each part of the tool numbered." lightbox="../media/prompt-flow/prompt-flow-wizard.png":::

+ 1. A graph view of your flow.

+ 1. Files in your flow. Click the arrow to expand this section.

+ 1. Azure AI Language tools in the "More tools" dropdown menu, which you can add capabilities that you need for your flow. There are more tools that you can add from LLM, Prompt, and Python menu. This menu is only accessible after the compute session has started.

+ 1. Configure your output.

+ 1. Configure steps (or tools) in the flow.

+ 1. Run, evaluate, and deploy your flow.

+1. Once you've configured everything to your liking, press the run button in the upper right hand corner.

+## Related content

+* [Azure AI Language homepage](https://aka.ms/azure-language)

+* [Azure AI Language product demo videos](https://aka.ms/language-videos)

+* [Explore Azure AI Language in Azure AI Studio](https://aka.ms/AzureAiLanguage)

+| `gpt-4`<br>`gpt-4-32k` | 0613 | **Deprecation:** October 1, 2024 <br> **Retirement:** June 6, 2025 |

+## July 18, 2024

+* Updated `gpt-4` 0613 deprecation date to October 1, 2024 and the retirement date to June 6, 2025.

+| [GPT-4o & GPT-4 Turbo](#gpt-4o-and-gpt-4-turbo) | The latest most capable Azure OpenAI models with multimodal versions, which can accept both text and images as input. |

+GPT-4o integrates text and images in a single model, enabling it to handle multiple data types simultaneously. This multimodal approach enhances accuracy and responsiveness in human-computer interactions. GPT-4o matches GPT-4 Turbo in English text and coding tasks while offering superior performance in non-English languages and vision tasks, setting new benchmarks for AI capabilities.

+### Early access playground

+Existing Azure OpenAI customers can test out the **NEW GPT-4o mini** model in the **Azure OpenAI Studio Early Access Playground (Preview)**.

+To test the latest model:

+> [!NOTE]

+> The GPT-4o mini early access playground is currently only available for resources in **West US3** and **East US**, and is limited to 10 requests every five minutes per subscription. Azure OpenAI content filters are enabled at the default configuration and cannot be modified. GPT-4o mini is a preview model and is currently not available for deployment/direct API access.

+1. Navigate to Azure OpenAI Studio at https://oai.azure.com/ and sign-in with credentials that have access to your OpenAI resources.

+2. Select an Azure OpenAI resource in the **West US3** or **East US** regions. If you don't have a resource in one of these regions you will need to [create a resource](../how-to/create-resource.md).

+3. From the main [Azure OpenAI Studio](https://oai.azure.com/) page select the **Early Access Playground (Preview)** button from under the **Get started** section. (This button will only be visible when a resource in **West US3** or **East US** is selected.)

+4. Now you can start asking the model questions just as you would before in the existing [chat playground](../chatgpt-quickstart.md).

+| `Active Tokens` | Usage |Sum | Total tokens minus cached tokens over a period of time. Applies to PTU and PTU-managed deployments. Use this metric to understand your TPS or TPM based utilization for PTUs and compare to your benchmarks for target TPS or TPM for your scenarios. | `ModelDeploymentName`,`ModelName`,`ModelVersion` |

+### GPT-4o mini preview model available for early access

+GPT-4o mini is the latest model from OpenAI [launched on July 18, 2024](https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/).

+From OpenAI:

+*"GPT-4o mini surpasses GPT-3.5 Turbo and other small models on academic benchmarks across both textual intelligence and multimodal reasoning, and supports the same range of languages as GPT-4o. It also demonstrates strong performance in function calling, which can enable developers to build applications that fetch data or take actions with external systems, and improved long-context performance compared to GPT-3.5 Turbo."*

+To start testing out the model today in Azure OpenAI, see the [**Azure OpenAI Studio early access playground**](./concepts/models.md#early-access-playground).

+ Title: "Part 1: Build a RAG-based copilot with the prompt flow SDK"

+description: Learn how to build a RAG-based copilot using the prompt flow SDK. This tutorial is part 1 of a 2-part tutorial.

+#customer intent: As a developer, I want to learn how to use the prompt flow SDK so that I can build a RAG-based copilot.

+# Tutorial: Part 1 - Build a RAG-based copilot with the prompt flow SDK

+In this [Azure AI Studio](https://ai.azure.com) tutorial, you use the prompt flow SDK (and other libraries) to build, configure, evaluate, and deploy a copilot for your retail company called Contoso Trek. Your retail company specializes in outdoor camping gear and clothing. The copilot should answer questions about your products and services. For example, the copilot can answer questions such as "which tent is the most waterproof?" or "what is the best sleeping bag for cold weather?".

+This tutorial is part one of a two-part tutorial.

+> [!TIP]

+> This tutorial is based on code in the sample repo for a [copilot application that implements RAG](https://github.com/Azure-Samples/rag-data-openai-python-promptflow).

+This part one shows you how to enhance a basic chat application by adding retrieval augmented generation (RAG) to ground the responses in your custom data.

+In this part one, you learn how to:

+> [!div class="checklist"]

+> - [Deploy an embedding model](#deploy-an-embedding-model)

+> - [Create an Azure AI Search index](#create-an-azure-ai-search-index)

+> - [Develop custom RAG code](#develop-custom-rag-code)

+> - [Use prompt flow to test your copilot](#use-prompt-flow-to-test-your-copilot)

+## Prerequisites

+- You need to complete the [Build a custom chat app in Python using the prompt flow SDK quickstart](../quickstarts/get-started-code.md) to set up your environment.

+ > [!IMPORTANT]

+ > This tutorial builds on the code and environment you set up in the quickstart.

+- You need a local copy of product data. The [Azure-Samples/rag-data-openai-python-promptflow repository on GitHub](https://github.com/Azure-Samples/rag-data-openai-python-promptflow/) contains sample retail product information that's relevant for this tutorial scenario. Clone the repository or [download the example Contoso Trek retail product data in a ZIP file](https://github.com/Azure-Samples/rag-data-openai-python-promptflow/raw/main/tutorial/data.zip) to your local machine.

+- You must have the necessary permissions to add role assignments in your Azure subscription. Granting permissions by role assignment is only allowed by the **Owner** of the specific Azure resources. You might need to ask your IT admin for help with completing the [assign access](#configure-access-for-the-azure-ai-search-service) section.

+## Application code structure

+Create a folder called **rag-tutorial** on your local machine. This tutorial series walks through creation of the contents of each file. If you complete the tutorial series, your folder structure looks like this:

+```text

+rag-tutorial/

+Γöé .env

+Γöé build_index.py

+Γöé deploy.py

+Γöé evaluate.py

+Γöé eval_dataset.jsonl

+| invoke-local.py

+Γöé

+Γö£ΓöÇΓöÇΓöÇcopilot_flow

+Γöé ΓööΓöÇΓöÇΓöÇ chat.prompty

+| ΓööΓöÇΓöÇΓöÇ copilot.py

+| ΓööΓöÇΓöÇΓöÇ Dockerfile

+Γöé ΓööΓöÇΓöÇΓöÇ flow.flex.yaml

+Γöé ΓööΓöÇΓöÇΓöÇ input_with_chat_history.json

+Γöé ΓööΓöÇΓöÇΓöÇ queryIntent.prompty

+Γöé ΓööΓöÇΓöÇΓöÇ requirements.txt

+Γöé

+Γö£ΓöÇΓöÇΓöÇdata

+| ΓööΓöÇΓöÇΓöÇ product-info/

+| ΓööΓöÇΓöÇΓöÇ [Your own data or sample data as described in the prerequisites.]

+```

+The implementation in this tutorial uses prompt flow's flex flow, which is the code-first approach to implementing flows. You specify an entry function (which will be defined in **copilot.py**), and then use prompt flow's testing, evaluation, and tracing capabilities for your flow. This flow is in code and doesn't have a DAG (Directed Acyclic Graph) or other visual component. Learn more about how to develop a flex flow in the [prompt flow documentation on GitHub](https://microsoft.github.io/promptflow/how-to-guides/develop-a-flex-flow/https://docsupdatetracker.net/index.html).

+## Set initial environment variables

+There's a collection of environment variables used across the different code snippets. Let's set them now.

+1. You created an **.env** file with the following environment variables via the [Build a custom chat app in Python using the prompt flow SDK quickstart](../quickstarts/get-started-code.md). If you haven't already, create an **.env** file in your **rag-tutorial** folder with the following environment variables:

+ ```

+ AZURE_OPENAI_ENDPOINT=endpoint_value

+ AZURE_OPENAI_DEPLOYMENT_NAME=chat_model_deployment_name

+ AZURE_OPENAI_API_VERSION=api_version

+ ```

+1. Copy the **.env** file into your **rag-tutorial** folder.

+1. In the **.env** file enter more environment variables for the copilot application:

+ - **AZURE_SUBSCRIPTION_ID**: Your Azure subscription ID

+ - **AZURE_RESOURCE_GROUP**: Your Azure resource group

+ - **AZUREAI_PROJECT_NAME**: Your Azure AI Studio project name

+ - **AZURE_OPENAI_CONNECTION_NAME**: Use the same **AIServices** or **Azure OpenAI** connection that you used [to deploy the chat model](../quickstarts/get-started-playground.md#deploy-a-chat-model).

+You can find the subscription ID, resource group name, and project name from your project view in AI Studio.

+1. In [AI Studio](https://ai.azure.com), go to your project and select **Settings** from the left pane.

+1. In the **Project details** section, you can find the **Subscription ID** and **Resource group**.

+1. In the **Project settings** section, you can find the **Project name**.

+By now, you should have the following environment variables in your *.env* file:

+```env

+AZURE_OPENAI_ENDPOINT=endpoint_value

+AZURE_OPENAI_DEPLOYMENT_NAME=chat_model_deployment_name

+AZURE_OPENAI_API_VERSION=api_version

+AZURE_SUBSCRIPTION_ID=<your subscription id>

+AZURE_RESOURCE_GROUP=<your resource group>

+AZUREAI_PROJECT_NAME=<your project name>

+AZURE_OPENAI_CONNECTION_NAME=<your AIServices or Azure OpenAI connection name>

+```

+## Deploy an embedding model

+For the RAG capability, we need to be able to embed the search query to search the Azure AI Search index we create.

+1. Deploy an Azure OpenAI embedding model. Follow the [deploy Azure OpenAI models guide](../how-to/deploy-models-openai.md) and deploy the **text-embedding-ada-002** model. Use the same **AIServices** or **Azure OpenAI** connection that you used [to deploy the chat model](../quickstarts/get-started-playground.md#deploy-a-chat-model).

+2. Add embedding model environment variables in your *.env* file. For the *AZURE_OPENAI_EMBEDDING_DEPLOYMENT* value, enter the name of the embedding model that you deployed.

+ ```env

+ AZURE_OPENAI_EMBEDDING_DEPLOYMENT=embedding_model_deployment_name

+ ```

+## Create an Azure AI Search index

+The goal with this RAG-based application is to ground the model responses in your custom data. You use an Azure AI Search index that stores vectorized data from the embeddings model. The search index is used to retrieve relevant documents based on the user's question.

+You need an Azure AI Search service and connection in order to create a search index.

+> [!NOTE]

+> Creating an Azure AI Search service and subsequent search indexes has associated costs. You can see details about pricing and pricing tiers for the Azure AI Search service on the creation page, to confirm cost before creating the resource.

+### Create an Azure AI Search service

+If you already have an Azure AI Search service in the same location as your project, you can skip to the [next section](#create-an-azure-ai-search-connection).

+Otherwise, you can create an Azure AI Search service using the [Azure portal](https://portal.azure.com) or the Azure CLI (which you installed previously for the [quickstart](../quickstarts/get-started-code.md)).

+> [!IMPORTANT]

+> Use the same location as your project for the Azure AI Search service. Find your project's location in the top-right project picker of the Azure AI Studio in the project view.

+## [Portal](#tab/azure-portal)

+1. Go to the [Azure portal](https://portal.azure.com).

+1. [Create an Azure AI Search service](https://portal.azure.com/#create/Microsoft.Search) in the Azure portal.

+1. Select your resource group and instance details. You can see details about pricing and pricing tiers on this page.

+1. Continue through the wizard and select **Review + assign** to create the resource.

+1. Confirm the details of your Azure AI Search service, including estimated cost.

+## [Azure CLI](#tab/cli)

+1. Open a terminal on your local machine.

+1. Type `az` and then enter to verify that the Azure CLI tool is installed. If it's installed, a help menu with `az` commands appears. If you get an error, make sure you followed the [steps for installing the Azure CLI in the quickstart](../quickstarts/get-started-code.md#install-the-azure-cli-and-login).

+1. Follow the steps to create an Azure AI Search service using the [`az search service create`](../../search/search-manage-azure-cli.md#create-or-delete-a-service) command.

+### Create an Azure AI Search connection

+If you already have an Azure AI Search connection in your project, you can skip to [configure access for the Azure AI Search service](#configure-access-for-the-azure-ai-search-service). Only use an existing connection if it's in the same location as your project.

+In the Azure AI Studio, check for an Azure AI Search connected resource.

+1. In [AI Studio](https://ai.azure.com), go to your project and select **Settings** from the left pane.

+1. In the **Connected resources** section, look to see if you have a connection of type Azure AI Search.

+1. If you have an Azure AI Search connection, verify that it is in the same location as your project. If so, you can skip ahead to [configure access for the Azure AI Search service](#configure-access-for-the-azure-ai-search-service).

+1. Otherwise, select **New connection** and then **Azure AI Search**.

+1. Find your Azure AI Search service in the options and select **Add connection**.

+1. Continue through the wizard to create the connection. For more information about adding connections, see [this how-to guide](../how-to/connections-add.md#create-a-new-connection).

+### Configure access for the Azure AI Search service

+We recommend using [Microsoft Entra ID](/entra/fundamentals/whatis) instead of using API keys. In order to use this authentication, you need to set the right access controls and assign the right roles for your Azure AI Search service.

+> [!WARNING]

+> You can use role-based access control locally because you run `az login` later in this tutorial. But when you deploy your app in [part 2 of the tutorial](./copilot-sdk-evaluate-deploy.md), the deployment is authenticated using API keys from your Azure AI Search service. Support for Microsoft Entra ID authentication of the deployment is coming soon.

+To enable role-based access control for your Azure AI Search service, follow these steps:

+1. On your Azure AI Search service in the [Azure portal](https://portal.azure.com), select **Settings > Keys** from the left pane.

+1. Select **Both** to ensure that API keys and role-based access control are both enabled for your Azure AI Search service.

+ :::image type="content" source="../media/tutorials/develop-rag-copilot-sdk/search-access-control.png" alt-text="Screenshot shows API Access control setting.":::

+You or your administrator needs to grant your user identity the **Search Index Data Contributor** and **Search Service Contributor** roles on your Azure AI Search service. These roles enable you to call the Azure AI Search service using your user identity.

+> [!NOTE]

+> These steps are similar to how you assigned a role for your user identity to use the Azure OpenAI Service in the [quickstart](../quickstarts/get-started-code.md).

+In the Azure portal, follow these steps to assign the **Search Index Data Contributor** role to your Azure AI Search service:

+1. Select your Azure AI Search service in the [Azure portal](https://portal.azure.com).

+1. From the left page in the Azure portal, select **Access control (IAM)** > **+ Add** > **Add role assignment**.

+1. Search for the **Search Index Data Contributor** role and then select it. Then select **Next**.

+1. Select **User, group, or service principal**. Then select **Select members**.

+1. In the **Select members** pane that opens, search for the name of the user that you want to add the role assignment for. Select the user and then select **Select**.

+1. Continue through the wizard and select **Review + assign** to add the role assignment.

+Repeat the previous steps to add the **Search Service Contributor** role.

+> [!IMPORTANT]

+> After you assign these roles, run `az login` in your console to ensure the changes propagate in your development environment. This also ensures that you can use your user identity locally to authenticate with the Azure AI Search service.

+### Set search environment variables

+You need to set environment variables for the Azure AI Search service and connection in your **.env** file.

+1. In [AI Studio](https://ai.azure.com), go to your project and select **Settings** from the left pane.

+1. In the **Connected resources** section, select the link for the Azure AI Search service that you created previously.

+1. Copy the **Target** URL for `<your Azure Search endpoint>`.

+1. Copy the name at the top for `<your Azure Search connection name>`.

+ :::image type="content" source="../media/tutorials/develop-rag-copilot-sdk/search-settings.png" alt-text="Screenshot shows endpoint and connection names.":::

+1. Add these environment variables to your **.env** file:

+ ```env

+ AZURE_SEARCH_ENDPOINT=<your Azure Search endpoint>

+ AZURE_SEARCH_CONNECTION_NAME=<your Azure Search connection name>

+ ```

+### Create the search index

+If you don't have an Azure AI Search index already created, we walk through how to create one. If you already have an index to use, you can skip to the [set the search environment variables](#set-search-environment-variables) section. The search index is created on the Azure AI Search service that was either created or referenced in the previous step.

+1. Use your own data or [download the example Contoso Trek retail product data in a ZIP file](https://github.com/Azure-Samples/rag-data-openai-python-promptflow/raw/main/tutorial/data.zip) to your local machine. Unzip the file into your **rag-tutorial** folder. This data is a collection of markdown files that represent product information. The data is structured in a way that is easy to ingest into a search index. You build a search index from this data.

+1. The prompt flow RAG package allows you to ingest the markdown files, locally create a search index, and register it in the cloud project. Install the prompt flow RAG package:

+ ```bash

+ pip install promptflow-rag

+ ```

+1. Upgrade the *azure-ai-ml* package to the latest version. Run the following command in your terminal:

+ ```bash

+ pip install azure-ai-ml -U

+ ```

+1. Create the **build_index.py** file in your **rag-tutorial** folder.

+1. Copy and paste the following code into your **build_index.py** file.

+ :::code language="python" source="~/rag-data-openai-python-promptflow-main/tutorial/build_index.py":::

+ - Set the `index_name` variable to the name of the index you want.

+ - As needed, you can update the `path_to_data` variable to the path where your data files are stored.

+ > [!IMPORTANT]

+ > By default the code sample expects the application code structure as described [previously in this tutorial](#application-code-structure). The `data` folder should be at the same level as your **build_index.py** and the downloaded `product-info` folder with md files within it.

+1. From your console, run the code to build your index locally and register it to the cloud project:

+ ```bash

+ python build_index.py

+ ```

+1. Once the script is run, you can view your newly created index in the **Indexes** page of your Azure AI Studio project. For more information, see [How to build and consume vector indexes in Azure AI Studio](../how-to/index-add.md).

+1. If you run the script again with the same index name, it creates a new version of the same index.

+### Set the search index environment variable

+Once you have the index name you want to use (either by creating a new one, or referencing an existing one), add it to your **.env** file, like this:

+```env

+AZUREAI_SEARCH_INDEX_NAME=<index-name>

+```

+## Develop custom RAG code

+Next you create custom code to add retrieval augmented generation (RAG) capabilities to a basic chat application. In the quickstart, you created **chat.py** and **chat.prompty** files. Here you expand on that code to include RAG capabilities.

+The copilot with RAG implements the following general logic:

+1. Generate a search query based on user query intent and any chat history

+1. Use an embedding model to embed the query

+1. Retrieve relevant documents from the search index, given the query

+1. Pass the relevant context to the Azure OpenAI chat completion model

+1. Return the response from the Azure OpenAI model

+### The copilot implementation logic

+The copilot implementation logic is in the **copilot.py** file. This file contains the core logic for the RAG-based copilot.

+1. Create a folder named **copilot_flow** in the **rag-tutorial** folder.

+1. Then create a file called **copilot.py** in the **copilot_flow** folder.

+1. Add the following code to the **copilot.py** file:

+ :::code language="python" source="~/rag-data-openai-python-promptflow-main/tutorial/copilot_flow/copilot.py":::

+The **copilot.py** file contains two key functions: `get_documents()` and `get_chat_response()`.

+Notice these two functions have the `@trace` decorator, which allows you to see the prompt flow tracing logs of each function call inputs and outputs. `@trace` is an alternative and extended approach to the way the [quickstart](../quickstarts/get-started-code.md) showed tracing capabilities.

+The `get_documents()` function is the core of the RAG logic.

+1. Takes in the search query and number of documents to retrieve.

+1. Embeds the search query using an embedding model.

+1. Queries the Azure Search index to retrieve the documents relevant to the query.

+1. Returns the context of the documents.

+

+The `get_chat_response()` function builds from the previous logic in your **chat.py** file:

+1. Takes in the `chat_input` and any `chat_history`.

+1. Constructs the search query based on `chat_input` intent and `chat_history`.

+1. Calls `get_documents()` to retrieve the relevant docs.

+1. Calls the chat completion model with context to get a grounded response to the query.

+1. Returns the reply and context. We set a typed dictionary as the return object for our `get_chat_response()` function. You can choose how your code returns the response to best fit your use case.

+The `get_chat_response()` function uses two `Prompty` files to make the necessary Large Language Model (LLM) calls, which we cover next.

+### Prompt template for chat

+The **chat.prompty** file is simple, and similar to the **chat.prompty** in the [quickstart](../quickstarts/get-started-code.md). The system prompt is updated to reflect our product and the prompt templates includes document context.

+1. Add the file **chat.prompty** in the **copilot_flow** directory. The file represents the call to the chat completion model, with the system prompt, chat history, and document context provided.

+1. Add this code to the **chat.prompty** file:

+ :::code language="yaml" source="~/rag-data-openai-python-promptflow-main/tutorial/copilot_flow/chat.prompty":::

+### Prompt template for chat history

+Because we're implementing a RAG-based application, there's some extra logic required for retrieving relevant documents not only for the current user query, but also taking into account chat history. Without this extra logic, your LLM call would account for chat history. But you wouldn't retrieve the right documents for that context, so you wouldn't get the expected response.

+For instance, if the user asks the question "is it waterproof?", we need the system to look at the chat history to determine what the word "it" refers to, and include that context into the search query to embed. This way, we retrieve the right documents for "it" (perhaps the Alpine Explorer Tent) and its "cost."

+Instead of passing only the user's query to be embedded, we need to generate a new search query that takes into account any chat history. We use another `Prompty` (which is another LLM call) with specific prompting to interpret the user query **intent** given chat history, and construct a search query that has the necessary context.

+1. Create the file **queryIntent.prompty** in the **copilot_flow** folder.

+1. Enter this code for specific details about the prompt format and few-shot examples.

+ :::code language="yaml" source="~/rag-data-openai-python-promptflow-main/tutorial/copilot_flow/queryIntent.prompty":::

+The simple system message in our **queryIntent.prompty** file achieves the minimum required for the RAG solution to work with chat history.

+### Configure required packages

+Create the file **requirements.txt** in the **copilot_flow** folder. Add this content:

+These are the packages required for the flow to run locally and in a deployed environment.

+### Use flex flow

+As previously mentioned, this implementation uses prompt flow's flex flow, which is the code-first approach to implementing flows. You specify an entry function (which is defined in **copilot.py**). Learn more at [Develop a flex flow](https://microsoft.github.io/promptflow/how-to-guides/develop-a-flex-flow/https://docsupdatetracker.net/index.html).

+This yaml specifies the entry function, which is the `get_chat_response` function defined in `copilot.py`. It also specifies the requirements the flow needs to run.

+Create the file **flow.flex.yaml** in the **copilot_flow** folder. Add this content:

+## Use prompt flow to test your copilot

+Use prompt flow's testing capability to see how your copilot performs as expected on sample inputs. By using your **flow.flex.yaml** file, you can use prompt flow to test with your specified inputs.

+Run the flow using this prompt flow command:

+```bash

+pf flow test --flow ./copilot_flow --inputs chat_input="how much do the Trailwalker shoes cost?"

+```

+Alternatively, you can run the flow interactively with the `--ui` flag.

+```bash

+pf flow test --flow ./copilot_flow --ui

+```

+When you use `--ui`, the interactive sample chat experience opens a window in your local browser.

+- The first time you run with the `--ui` flag, you need to manually select your chat inputs and outputs from the options. The first time you create this session, select the **Chat input/output field config** settings, then start chatting.

+- The next time you run with the `--ui` flag, the session will remember your settings.

+When you're finished with your interactive session, enter **Ctrl + C** in the terminal window to stop the server.

+### Test with chat history

+In general, prompt flow and `Prompty` support chat history. If you test with the `--ui` flag in the locally served front end, prompt flow manages your chat history. If you test without the `--ui`, you can specify an inputs file that includes chat history.

+Because our application implements RAG, we had to add [extra logic to handle chat history](#prompt-template-for-chat-history) in the **queryIntent.prompty** file.

+To test with chat history, create a file called **input_with_chat_history.json** in the **copilot_flow** folder, and paste in this content:

+To test with this file, run:

+```bash

+pf flow test --flow ./copilot_flow --inputs ./copilot_flow/input_with_chat_history.json

+```

+The expected output is something like: "The Alpine Explorer Tent is priced at $350."

+This system is able to interpret the intent of the query "how much does it cost?" to know that "it" refers to the Alpine Explorer Tent, which was the latest context in the chat history. Then the system constructs a search query for the price of the Alpine Explorer Tent to retrieve the relevant documents for the Alpine Explorer Tent's cost, and we get the response.

+If you navigate to the trace from this flow run, you see this in action. The local traces link shows in the console output before the result of the flow test run.

+## Clean up resources

+To avoid incurring unnecessary Azure costs, you should delete the resources you created in this tutorial if they're no longer needed. To manage resources, you can use the [Azure portal](https://portal.azure.com?azure-portal=true).

+But don't delete them yet, if you want to deploy your copilot to Azure in [the next part of this tutorial series](copilot-sdk-evaluate-deploy.md).

+## Next step

+> [!div class="nextstepaction"]

+> [Evaluate and deploy your copilot to Azure](copilot-sdk-evaluate-deploy.md)

+ Title: "Part 2: Evaluate and deploy copilot with the prompt flow SDK"

+description: Evaluate and deploy a RAG-based copilot with the prompt flow SDK. This tutorial is part 2 of a two-part tutorial.

+#customer intent: As a developer, I want to learn how to use the prompt flow SDK so that I can evaluate and deploy a copilot.

+# Tutorial: Part 2 - Evaluate and deploy a RAG-based copilot with the prompt flow SDK

+In this [Azure AI Studio](https://ai.azure.com) tutorial, you use the prompt flow SDK (and other libraries) to evaluate and deploy the copilot you built in [Part 1 of the tutorial series](copilot-sdk-build-rag.md).

+This tutorial is part two of a two-part tutorial.

+> [!TIP]

+> This tutorial is based on code in the sample repo for a [copilot application that implements RAG](https://github.com/Azure-Samples/rag-data-openai-python-promptflow).

+In this part two, you learn how to:

+> [!div class="checklist"]

+> - [Evaluate the quality of copilot responses](#evaluate-the-quality-of-copilot-responses)

+> - [Deploy the copilot to Azure](#deploy-the-copilot-to-azure)

+> - [Verify the deployment](#verify-the-deployment)

+## Prerequisites

+- You must complete [part 1 of the tutorial series](copilot-sdk-build-rag.md) to build the copilot application.

+- You must have the necessary permissions to add role assignments in your Azure subscription. Granting permissions by role assignment is only allowed by the **Owner** of the specific Azure resources. You might need to ask your IT admin for help with completing the [assign access](#assign-access-for-the-endpoint) section.

+## Evaluate the quality of copilot responses

+Now that you know your copilot responds well to your queries, including with chat history, it's time to evaluate how it does across a few different metrics and more data.

+You use the prompt flow evaluator with an evaluation dataset and the `get_chat_response()` target function, then assess the evaluation results.

+Once you run an evaluation, you can then make improvements to your logic, like improving your system prompt, and observing how the copilot responses change and improve.

+### Set your evaluation model

+Choose the evaluation model you want to use. It can be the same as the chat model you deployed before. If you want a different model for evaluation, you need to deploy it, or specify it if it already exists. For example, you might be using gpt-35-turbo for your chat completions, but want to use gpt-4 for evaluation since it might perform better.

+Add your evaluation model name in your **.env** file:

+```env

+AZURE_OPENAI_EVALUATION_DEPLOYMENT=<your evaluation model deployment name>

+```

+### Create evaluation dataset

+Use the following evaluation dataset, which contains example questions and expected answers (truth).

+1. Create a file called **eval_dataset.jsonl** in your **rag-tutorial** folder. See the [application code structure](copilot-sdk-build-rag.md#application-code-structure) for reference.

+1. Paste this dataset into the file:

+ :::code language="jsonl" source="~/rag-data-openai-python-promptflow-main/tutorial/eval_dataset.jsonl":::

+### Evaluate with prompt flow evaluators

+Now define an evaluation script that will:

+- Import the `evaluate` function and evaluators from the Prompt flow `evals` package.

+- Load the sample `.jsonl` dataset.

+- Generate a target function wrapper around our copilot logic.

+- Run the evaluation, which takes the target function, and merges the evaluation dataset with the responses from the copilot.

+- Generate a set of GPT-assisted metrics (Relevance, Groundedness, and Coherence) to evaluate the quality of the copilot responses.

+- Output the results locally, and logs the results to the cloud project.

+The script allows you to review the results locally, by outputting the results in the command line, and to a json file.

+The script also logs the evaluation results to the cloud project so that you can compare evaluation runs in the UI.

+1. Create a file called **evaluate.py** in your **rag-tutorial** folder.

+1. Add the following code. Update the `dataset_path` and `evaluation_name` to fit your use case.

+ :::code language="python" source="~/rag-data-openai-python-promptflow-main/tutorial/evaluate.py":::

+The main function at the end allows you to view the evaluation result locally, and gives you a link to the evaluation results in AI Studio.

+### Run the evaluation script

+1. From your console, sign in to your Azure account with the Azure CLI:

+ ```bash

+ az login

+ ```

+1. Install the required package:

+ ```bash

+ pip install promptflow-evals

+ ```

+1. Now run the evaluation script:

+ ```bash

+ python evaluate.py

+ ```

+For more information about using the prompt flow SDK for evaluation, see [Evaluate with the prompt flow SDK](../how-to/develop/flow-evaluate-sdk.md).

+### Interpret the evaluation output

+In the console output, you see for each question an answer and the summarized metrics in this nice table format. (You might see different columns in your output.)

+```txt

+'--Summarized Metrics--'

+{'coherence.gpt_coherence': 4.3076923076923075,

+ 'groundedness.gpt_groundedness': 4.384615384615385,

+ 'relevance.gpt_relevance': 4.384615384615385}

+'--Tabular Result--'

+ question ... gpt_coherence

+0 Which tent is the most waterproof? ... 5

+1 Which camping table holds the most weight? ... 5

+2 How much does TrailWalker Hiking Shoes cost? ... 5

+3 What is the proper care for trailwalker hiking... ... 5

+4 What brand is the TrailMaster tent? ... 1

+5 How do I carry the TrailMaster tent around? ... 5

+6 What is the floor area for Floor Area? ... 3

+7 What is the material for TrailBlaze Hiking Pants ... 5

+8 What color do the TrailBlaze Hiking Pants come ... 5

+9 Can the warranty for TrailBlaze pants be trans... ... 3

+10 How long are the TrailBlaze pants under warren... ... 5

+11 What is the material for PowerBurner Camping S... ... 5

+12 Is France in Europe? ... 1

+```

+The script writes the full evaluation results to `./eval_results.jsonl`.

+And there's a link in the console to view evaluation results in your Azure AI Studio project.

+> [!NOTE]

+> You may see an `ERROR:asyncio:Unclosed client session` - this can be safely ignored and does not affect the evaluation results.

+### View evaluation results in AI Studio

+Once the evaluation run completes, follow the link to view the evaluation results on the **Evaluation** page in the Azure AI Studio.

+You can also look at the individual rows and see metric scores per row, and view the full context/documents that were retrieved. These metrics can be helpful in interpreting and debugging evaluation results.

+For more information about evaluation results in AI Studio, see [How to view evaluation results in AI Studio](../how-to/evaluate-flow-results.md).

+Now that you verified your copilot behaves as expected, you're ready to deploy your application.

+## Deploy the copilot to Azure

+Now let's go ahead and deploy this copilot to a managed endpoint so that it can be consumed by an external application or website.

+The deploy script will:

+- Create a managed online endpoint

+- Define our flow as a model

+- Deploy our flow to a managed environment on that endpoint that has our environment variables

+- Route all traffic to that deployment

+- Output the link to view and test the deployment in the Azure AI Studio

+The deployment defines a build context (Dockerfile) that relies on the `requirement.txt` specified in our flow folder, and also sets our environment variables to the deployed environment, so we can be confident that our copilot application runs the same in a production environment as it did locally.

+### Build context for the deployment (Dockerfile)

+The deployed environment needs a build context, so let's define a Dockerfile for the deployed environment.

+The deploy script creates an environment based on this Dockerfile. Create this **Dockerfile** in the **copilot_flow** folder:

+```docker

+FROM mcr.microsoft.com/azureml/promptflow/promptflow-runtime:latest

+COPY ./requirements.txt .

+RUN pip install -r requirements.txt

+```

+### Deploy copilot to a managed endpoint

+To deploy your application to a managed endpoint in Azure, create an online endpoint, then create a deployment in that endpoint, and then route all traffic to that deployment.

+As part of creating the deployment, your copilot_flow folder is packaged as a model and a cloud environment is built. The endpoint is set up with Microsoft Entra ID authentication. You can update the auth mode you want in the code, or in the Azure AI Studio on the endpoint details page.

+> [!IMPORTANT]

+> Deploying your application to a managed endpoint in Azure has associated compute cost based on the instance type you choose. Make sure you are aware of the associated cost and have quota for the instance type you specify. Learn more about [online endpoints](../../machine-learning/reference-managed-online-endpoints-vm-sku-list.md).

+Create the file **deploy.py** in the **rag-tutorial** folder. Add the following code:

+> [!IMPORTANT]

+> The endpoint and deployment name must be unique within an Azure region. If you get an error that the endpoint or deployment name already exists, try different names.

+### Output deployment details

+Add the following lines to the end your deploy script to view the evaluation result locally, and get a link to the studio:

+Now, run the script with:

+```bash

+python deploy.py

+```

+> [!NOTE]

+> Deployment may take over 10 minutes to complete. We suggest you follow the next step to assign access to the endpoint while you wait.

+Once the deployment is completed, you get a link to the Azure AI Studio deployment page, where you can test your deployment.

+## Verify the deployment

+We recommend you test your application in the Azure AI Studio. If you prefer to test your deployed endpoint locally, you can invoke it with some custom code.

+Note your endpoint name, which you need for the next steps.

+### Assign access for the endpoint

+While you wait for your application to deploy, you or your administrator can assign role-based access to the endpoint. These roles allow the application to run without keys in the deployed environment, just like it did locally.

+Previously, you provided your account with a specific role to be able to access the resource using Microsoft Entra ID authentication. Now, assign the endpoint that same role.

+### Endpoint access for Azure OpenAI resource

+You or your administrator needs to grant your endpoint the **Cognitive Services OpenAI User** role on the Azure AI Services resource that you're using. This role lets your endpoint call the Azure OpenAI service.

+> [!NOTE]

+> These steps are similar to how you assigned a role for your user identity to use the Azure OpenAI Service in the [quickstart](../quickstarts/get-started-code.md).

+To grant yourself access to the Azure AI Services resource that you're using:

+1. In [AI Studio](https://ai.azure.com), go to your project and select **Settings** from the left pane.

+1. In the **Connected resources** section, select the connection name with type **AIServices**.

+ :::image type="content" source="../media/quickstarts/promptflow-sdk/project-settings-pick-resource.png" alt-text="Screenshot of the project settings page, highlighting how to select the connected AI services resource to open it." lightbox="../media/quickstarts/promptflow-sdk/project-settings-pick-resource.png":::

+ > [!NOTE]

+ > If you don't see the **AIServices** connection, use the **Azure OpenAI** connection instead.

+1. On the resource details page, select the link under the **Resource** heading to open the AI services resource in the Azure portal.

+ :::image type="content" source="../media/quickstarts/promptflow-sdk/project-ai-services-open-in-portal.png" alt-text="Screenshot of the AI Services connection details showing how to open the resource in the Azure portal." lightbox="../media/quickstarts/promptflow-sdk/project-ai-services-open-in-portal.png":::

+1. From the left page in the Azure portal, select **Access control (IAM)** > **+ Add** > **Add role assignment**.

+1. Search for the **Cognitive Services OpenAI User** role and then select it. Then select **Next**.

+ :::image type="content" source="../media/quickstarts/promptflow-sdk/ai-services-add-role-assignment.png" alt-text="Screenshot of the page to select the Cognitive Services OpenAI User role." lightbox="../media/quickstarts/promptflow-sdk/ai-services-add-role-assignment.png":::

+1. Select **Managed identity**. Then select **Select members**.

+1. In the **Select members** pane that opens, select _Machine learning online endpoint_ for the Managed identity, and then search for your endpoint name. Select the endpoint and then select **Select**.

+ :::image type="content" source="../media/tutorials/develop-rag-copilot-sdk/managed-identity-role-aoai.png" alt-text="Screenshot shows Selection of members for the online endpoint.":::

+1. Continue through the wizard and select **Review + assign** to add the role assignment.

+> [!NOTE]

+> It may take a few minutes for the access to propagate. If you get an unauthorized error when testing in the next step, try again after a few minutes.

+### Endpoint access for Azure AI Search resource

+Similar to how you assigned the **Search Index Data Contributor** [role to your Azure AI Search service](./copilot-sdk-build-rag.md#configure-access-for-the-azure-ai-search-service), you need to assign the same role for your endpoint.

+1. In Azure AI Studio, select **Settings** and navigate to the connected **Azure AI Search** service.

+1. Select the link to open a summary of the resource. Select the link on the summary page to open the resource in the Azure portal.

+1. From the left page in the Azure portal, select **Access control (IAM)** > **+ Add** > **Add role assignment**.

+ :::image type="content" source="../media/tutorials/develop-rag-copilot-sdk/add-role-search.png" alt-text="Screenshot shows Access control for search resource.":::

+1. Search for the **Search Index Data Contributor** role and then select it. Then select **Next**.

+1. Select **Managed identity**. Then select **Select members**.

+1. In the **Select members** pane that opens, select _Machine learning online endpoint_ for the Managed identity, and then search for your endpoint name. Select the endpoint and then select **Select**.

+ :::image type="content" source="../media/tutorials/develop-rag-copilot-sdk/managed-identity-role-search.png" alt-text="Screenshot shows selecting the endpoint.":::

+1. Continue through the wizard and select **Review + assign** to add the role assignment.

+> [!NOTE]

+> It may take a few minutes for the access to propagate. If you get an unauthorized error when testing in the next step, try again after a few minutes.

+### Test your deployment in AI Studio

+Once the deployment is completed, you get a handy link to your deployment. If you don't use the link, navigate to the **Deployments** tab in your project and select your new deployment.

+Select the **Test** tab, and try asking a question in the chat interface.

+For example, type "Are the Trailwalker hiking shoes waterproof?" and enter.

+Seeing the response come back verifies your deployment.

+If you get an error, select the **Logs** tab to get more details.

+> [!NOTE]

+> If you get an unauthorized error, your endpoint access may not have been applied yet. Try again in a few minutes.

+### Invoke the deployed copilot locally

+If you prefer to verify your deployment locally, you can invoke it via a Python script.

+Define a script that will:

+- Construct a well-formed request to our scoring URL.

+- Post the request and handle the response.

+Create an **invoke-local.py** file in your **rag-tutorial** folder, with the following code. Modify the `query` and `endpoint_name` (and other parameters as needed) to fit your use case.

+You should see the copilot reply to your query in the console.

+> [!NOTE]

+> If you get an unauthorized error, your endpoint access may not have been applied yet. Try again in a few minutes.

+## Clean up resources

+To avoid incurring unnecessary Azure costs, you should delete the resources you created in this tutorial if they're no longer needed. To manage resources, you can use the [Azure portal](https://portal.azure.com?azure-portal=true).

+## Related content

+> [!div class="nextstepaction"]

+> [Learn more about prompt flow](../how-to/prompt-flow.md)

+description: Learn about certificate rotation in an Azure Kubernetes Service (AKS) cluster.

+Azure Kubernetes Service (AKS) uses certificates for authentication with many of its components. Clusters with Azure role-based access control (Azure RBAC) that were created after March 2022 are enabled with certificate auto-rotation. You may need to periodically rotate those certificates for security or policy reasons. For example, you may have a policy to rotate all your certificates every 90 days.

+> Certificate auto-rotation is enabled by default only for RBAC-enabled AKS clusters.

+### Check certificate expiration for the virtual machine scale set agent node

+* Check the expiration date of the virtual machine scale set agent node certificate using the `az vm run-command invoke` command.

+## Certificate auto-rotation

+> Rotating your certificates using `az aks rotate-certs` recreates all of your nodes, virtual machine scale sets, and disks and can cause up to *30 minutes of downtime* for your AKS cluster.

+This article showed you how to manually and automatically rotate your cluster certificates, CAs, and SAs. For more information, see [Best practices for cluster security and upgrades in Azure Kubernetes Service (AKS)][aks-best-practices-security-upgrades].

+ Title: Check app's API calls for minimal permissions with Dev Proxy

+description: Learn how to use Dev Proxy to check if your app is calling APIs using minimal permissions defined in Azure API Center.

+# Check if your app is calling APIs using minimal permissions with Dev Proxy

+When building your app, you likely integrate with several APIs and operations. To ensure that your app is secure and follows the principle of least privilege, you should check if your app is calling APIs with minimal permissions. By using minimal permissions, you reduce the risk of unauthorized access to your data and resources.

+What's hard about checking if your app is calling APIs with minimal permissions is that each time you integrate a new operation, you need to evaluate the set of permissions you use in your app. Manually tracking all operations and permissions is time-consuming and error-prone. Using Dev Proxy and Azure API Center you can automate checking if your app is calling APIs with minimal permissions.

+To check if your app is calling APIs using minimal permissions, you can use Dev Proxy. Dev Proxy is an API simulator that intercepts and analyzes API requests from applications. One feature of Dev Proxy is comparing the permissions that your app uses with the permissions defined in Azure API Center and reporting on any excessive permissions. Dev Proxy also recommends the minimal set of permissions that you should use.

+> [!VIDEO https://www.youtube.com/embed/fFr3tFBp1Z8]

+## Before you start

+To check if your app is calling APIs using minimal permissions, you need to have an Azure API Center instance with information about the APIs that you use in your organization. If you haven't created one already, see [Quickstart: Create your API center](set-up-api-center.md). Additionally, you need to install [Dev Proxy](https://aka.ms/devproxy).

+> [!TIP]

+> Download the preset for this how to article by running in the command prompt `devproxy preset get demo-apicenter-minimalpermissions`.

+### Register APIs in your Azure API Center instance

+Register APIs that you use in your organization. For each API, upload the OpenAPI specification file that describes the API operations and permissions.

+The Dev Proxy `ApiCenterMinimalPermissionsPlugin` uses this information to check if your app is calling APIs using minimal permissions.

+### Copy API Center information

+From the Azure API Center instance Overview page, copy the **name** of the API Center instance, the name of the **resource group** and the **subscription ID**. You need this information to configure the `ApiCenterMinimalPermissionsPlugin` so that it can connect to your Azure API Center instance.

+## Configure Dev Proxy

+To check if your app is calling APIs using minimal permissions, you need to enable the `ApiCenterMinimalPermissionsPlugin` in the Dev Proxy configuration file. To create a report of permissions that your app uses, add a reporter.

+### Enable the `ApiCenterMinimalPermissionsPlugin`

+In the `devproxyrc.json` file, add the following configuration:

+```json

+{

+ "$schema": "https://raw.githubusercontent.com/microsoft/dev-proxy/main/schemas/v0.19.0/rc.schema.json",

+ "plugins": [

+ {

+ "name": "ApiCenterMinimalPermissionsPlugin",

+ "enabled": true,

+ "pluginPath": "~appFolder/plugins/dev-proxy-plugins.dll",

+ "configSection": "apiCenterMinimalPermissionsPlugin"

+ }

+ ],

+ "urlsToWatch": [

+ "https://api.northwind.com/*"

+ ],

+ "apiCenterMinimalPermissionsPlugin": {

+ "subscriptionId": "00000000-0000-0000-0000-000000000000",

+ "resourceGroupName": "demo",

+ "serviceName": "contoso-api-center",

+ "workspaceName": "default"

+ }

+}

+```

+In the `subscriptionId`, `resourceGroupName`, and `serviceName` properties, provide the information about your Azure API Center instance.

+In the `urlsToWatch` property, specify the URLs that your app uses.

+> [!TIP]

+> Use the [Dev Proxy Toolkit](https://aka.ms/devproxy/toolkit) Visual Studio Code extension to easily manage Dev Proxy configuration.

+### Add a reporter

+The `ApiCenterMinimalPermissionsPlugin` produces a report of APIs that your app is using, and the minimal permissions required to call them. To view this report, add a reporter to your Dev Proxy configuration file. Dev Proxy offers several [reporters](/microsoft-cloud/dev/dev-proxy/technical-reference/overview#reporters). In this example, you use the [plain-text reporter](/microsoft-cloud/dev/dev-proxy/technical-reference/plaintextreporter).

+Update your `devproxyrc.json` file with a reference to the plain-text reporter:

+```json

+{

+ "$schema": "https://raw.githubusercontent.com/microsoft/dev-proxy/main/schemas/v0.19.0/rc.schema.json",

+ "plugins": [

+ {

+ "name": "ApiCenterMinimalPermissionsPlugin",

+ "enabled": true,

+ "pluginPath": "~appFolder/plugins/dev-proxy-plugins.dll",

+ "configSection": "apiCenterMinimalPermissionsPlugin"

+ },

+ {

+ "name": "PlainTextReporter",

+ "enabled": true,

+ "pluginPath": "~appFolder/plugins/dev-proxy-plugins.dll"

+ }

+ ],

+ "urlsToWatch": [

+ "https://api.northwind.com/*"

+ ],

+ "apiCenterMinimalPermissionsPlugin": {

+ "subscriptionId": "00000000-0000-0000-0000-000000000000",

+ "resourceGroupName": "demo",

+ "serviceName": "contoso-api-center",

+ "workspaceName": "default"

+ }

+}

+```

+## Check if your app is calling APIs using minimal permissions

+To check if your app is calling APIs using minimal permissions, you need to connect to your Azure subscription, run Dev Proxy, and let it intercept API requests from your app. Dev Proxy then compares the information about the API requests with the information from Azure API Center and reports on the minimal permissions.

+### Connect to your Azure subscription

+Dev Proxy uses information from Azure API Center to determine if your app is calling APIs using minimal permissions. To get this information, it needs a connection to your Azure subscription. You can connect to your Azure subscription in [several ways](/microsoft-cloud/dev/dev-proxy/technical-reference/apicenterproductionversionplugin#remarks).

+### Run Dev Proxy

+After connecting to your Azure subscription, start Dev Proxy. If you start Dev Proxy from the same folder where your `devproxyrc.json` file is located, it automatically loads the configuration. Otherwise, specify the path to the configuration file using the `--config-file` option.

+When Dev Proxy starts, it checks that it can connect to your Azure subscription. When the connection is successful, you see a message similar to:

+```text

+ info Plugin ApiCenterMinimalPermissionsPlugin connecting to Azure...

+ info Listening on 127.0.0.1:8000...

+Hotkeys: issue (w)eb request, (r)ecord, (s)top recording, (c)lear screen

+Press CTRL+C to stop Dev Proxy

+```

+Press <kbd>r</kbd> to start recording API requests from your app.

+### Use your app

+Use your app as you would normally do. In this tutorial, you can use the following request with a simulated access token with `customer.readwrite` permission:

+```http

+@readwriteToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJzY3AiOlsiY3VzdG9tZXIucmVhZHdyaXRlIl19.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

+GET https://api.northwind.com/customers/ALFKI

+Authorization: Bearer {{readwriteToken}}

+```

+Dev Proxy intercepts the API requests and stores information about them in memory. In the command line where Dev Proxy runs, you should see information about API requests that your app makes.

+```text

+ info Plugin ApiCenterMinimalPermissionsPlugin connecting to Azure...

+ info Listening on 127.0.0.1:8000...

+Hotkeys: issue (w)eb request, (r)ecord, (s)top recording, (c)lear screen

+Press CTRL+C to stop Dev Proxy

+Γùë Recording...

+ req Γò¡ GET https://api.northwind.com/customers/ALFKI

+ mock Γò░ 200 /{customer-id}

+```

+### Check permissions

+Stop the recording by pressing <kbd>s</kbd>. Dev Proxy connects to the API Center instance and compares the information about requests with the information from API Center.

+```text

+ info Plugin ApiCenterMinimalPermissionsPlugin connecting to Azure...

+ info Listening on 127.0.0.1:8000...

+Hotkeys: issue (w)eb request, (r)ecord, (s)top recording, (c)lear screen

+Press CTRL+C to stop Dev Proxy

+Γùë Recording...

+ req Γò¡ GET https://api.northwind.com/customers/ALFKI

+ mock Γò░ 200 /{customer-id}

+Γùï Stopped recording

+ info Checking if recorded API requests use minimal permissions as defined in API Center...

+ info Loading APIs from API Center...

+ info Loading API definitions from API Center...

+ info Checking minimal permissions for API https://api.northwind.com...

+ info Analyzing recorded requests...

+ warn Calling API Northwind with excessive permissions: customer.readwrite. Minimal permissions are: customer.read

+ info DONE

+```

+When Dev Proxy finishes its analysis, it creates a report in a file named `ApiCenterMinimalPermissionsPlugin_PlainTextReporter.txt` with the following contents:

+```text

+Azure API Center minimal permissions report

+APIS

+Northwind

+x Called using excessive permissions

+Permissions

+- Minimal permissions: customer.read

+- Permissions on the token: customer.readwrite

+- Excessive permissions: customer.readwrite

+Requests

+- GET https://api.northwind.com/customers/ALFKI

+UNMATCHED REQUESTS

+No unmatched requests found.

+ERRORS

+No errors occurred.

+```

+## Summary

+Using the `ApiCenterMinimalPermissionsPlugin`, you can check if your app is calling APIs using minimal permissions. The plugin compares the information about API requests from your app with information from Azure API Center and reports on excessive permissions. It also recommends the minimal permissions needed to call the APIs that you're using in your app. Verifying that your app is calling APIs using minimal permissions, helps you make your app more secure. You can run this check manually or integrate with your CI/CD pipeline to ensure that your app is calling APIs using minimal permissions before releasing it to production.

+## Related content

+- [Learn more about Dev Proxy](/microsoft-cloud/dev/dev-proxy/overview)

+- [Learn more about Azure API Center](./key-concepts.md)

+ Title: Find nonproduction API requests with Dev Proxy

+description: Learn how to check if your app is using production-level APIs defined in Azure API Center using Dev Proxy.

+# Find nonproduction API requests with Dev Proxy

+When building your app, you might be using APIs that are still in preview. You often use preview APIs, when you're integrating with new features that are being built along with your app. Before you release your app to production, you should ensure that you're using production-level APIs. When you use stable APIs, which are supported and covered by Service Level Agreements (SLAs), your app is more robust.

+One way to check if your app is using production-level APIs, is by using [Dev Proxy](https://aka.ms/devproxy). Dev Proxy is an API simulator that intercepts and analyzes API requests from applications. One feature of Dev Proxy is checking if the intercepted API requests belong to a nonproduction API. Dev Proxy also recommends the production version of the API you're using.

+## Before you start

+To detect nonproduction API requests, you need to have an Azure API Center instance with information about the APIs that you use in your organization. If you haven't created one already, see [Quickstart: Create your API center](set-up-api-center.md). Additionally, you need to install [Dev Proxy](https://aka.ms/devproxy).

+### Register APIs in your API Center instance

+Register APIs that you use in your organization. For each API, define the versions you use and specify their lifecycle stage.

+The Dev Proxy's `ApiCenterProductionVersionPlugin` uses this information to check if the APIs, that your app is using, belong to production or nonproduction APIs.

+### Copy API Center information

+From the Azure API Center instance Overview page, copy the **name** of the API Center instance, the name of the **resource group** and the **subscription ID**. You need this information to configure the `ApiCenterProductionVersionPlugin` so that it can connect to your Azure API Center instance.

+## Configure Dev Proxy

+To check if your app is using production-level APIs, you need to enable the `ApiCenterProductionVersionPlugin` in the Dev Proxy configuration file. To create a report of APIs that your app uses, add a reporter.

+### Enable the `ApiCenterProductionVersionPlugin`

+In the `devproxyrc.json` file, add the following configuration:

+```json

+{

+ "$schema": "https://raw.githubusercontent.com/microsoft/dev-proxy/main/schemas/v0.19.0/rc.schema.json",

+ "plugins": [

+ {

+ "name": "ApiCenterProductionVersionPlugin",

+ "enabled": true,

+ "pluginPath": "~appFolder/plugins/dev-proxy-plugins.dll",

+ "configSection": "apiCenterProductionVersionPlugin"

+ }

+ ],

+ "urlsToWatch": [

+ "https://jsonplaceholder.typicode.com/*"

+ ],

+ "apiCenterProductionVersionPlugin": {

+ "subscriptionId": "00000000-0000-0000-0000-000000000000",

+ "resourceGroupName": "demo",

+ "serviceName": "contoso-api-center",

+ "workspaceName": "default"

+ }

+}

+```

+In the `subscriptionId`, `resourceGroupName`, and `serviceName` properties, provide the information about your Azure API Center instance.

+In the `urlsToWatch` property, specify the URLs that your app uses.

+> [!TIP]

+> Use the [Dev Proxy Toolkit](https://aka.ms/devproxy/toolkit) Visual Studio Code extension to easily manage Dev Proxy configuration.

+### Add a reporter

+The `ApiCenterProductionVersionPlugin` produces a report of APIs that your app is using. To view this report, add a reporter to your Dev Proxy configuration file. Dev Proxy offers several [reporters](/microsoft-cloud/dev/dev-proxy/technical-reference/overview#reporters). In this example, you use the [plain-text reporter](/microsoft-cloud/dev/dev-proxy/technical-reference/plaintextreporter).

+Update your `devproxyrc.json` file with a reference to the plain-text reporter:

+```json

+{

+ "$schema": "https://raw.githubusercontent.com/microsoft/dev-proxy/main/schemas/v0.19.0/rc.schema.json",

+ "plugins": [

+ {

+ "name": "ApiCenterProductionVersionPlugin",

+ "enabled": true,

+ "pluginPath": "~appFolder/plugins/dev-proxy-plugins.dll",

+ "configSection": "apiCenterProductionVersionPlugin"

+ },

+ {

+ "name": "PlainTextReporter",

+ "enabled": true,

+ "pluginPath": "~appFolder/plugins/dev-proxy-plugins.dll"

+ }

+ ],

+ "urlsToWatch": [

+ "https://jsonplaceholder.typicode.com/*"

+ ],

+ "apiCenterProductionVersionPlugin": {

+ "subscriptionId": "00000000-0000-0000-0000-000000000000",

+ "resourceGroupName": "demo",

+ "serviceName": "contoso-api-center",

+ "workspaceName": "default"

+ }

+}

+```

+## Check if your app is using production-level APIs

+To check if your app is using production-level APIs, you need to connect to your Azure subscription, run Dev Proxy, and let it intercept API requests from your app. Dev Proxy then compares the information about the API requests with the information from Azure API Center and reports on any nonproduction APIs.

+### Connect to your Azure subscription

+Dev Proxy uses information from Azure API Center to determine if the APIs your app is using are production-level. To get this information, it needs a connection to your Azure subscription. You can connect to your Azure subscription in [several ways](/microsoft-cloud/dev/dev-proxy/technical-reference/apicenterproductionversionplugin#remarks).

+### Run Dev Proxy

+After connecting to your Azure subscription, start Dev Proxy. If you start Dev Proxy from the same folder where your `devproxyrc.json` file is located, it automatically loads the configuration. Otherwise, specify the path to the configuration file using the `--config-file` option.

+When Dev Proxy starts, it checks that it can connect to your Azure subscription. When the connection is successful, you see a message similar to:

+```text

+ info Plugin ApiCenterProductionVersionPlugin connecting to Azure...

+ info Listening on 127.0.0.1:8000...

+Hotkeys: issue (w)eb request, (r)ecord, (s)top recording, (c)lear screen

+Press CTRL+C to stop Dev Proxy

+```

+Press <kbd>r</kbd> to start recording API requests from your app.

+### Use your app

+Use your app as you would normally do. Dev Proxy intercepts the API requests and stores information about them in memory. In the command line where Dev Proxy runs, you should see information about API requests that your app makes.

+```text

+ info Plugin ApiCenterProductionVersionPlugin connecting to Azure...

+ info Listening on 127.0.0.1:8000...

+Hotkeys: issue (w)eb request, (r)ecord, (s)top recording, (c)lear screen

+Press CTRL+C to stop Dev Proxy

+Γùë Recording...

+ req Γò¡ GET https://jsonplaceholder.typicode.com/posts?api-version=v1.0

+ api Γò░ Passed through

+ req Γò¡ GET https://jsonplaceholder.typicode.com/users?api-version=beta

+ api Γò░ Passed through

+```

+### Check API versions

+Stop the recording by pressing <kbd>s</kbd>. Dev Proxy connects to the API Center instance and compares the information about requests with the information from API Center.

+```text

+ info Plugin ApiCenterProductionVersionPlugin connecting to Azure...

+ info Listening on 127.0.0.1:8000...

+Hotkeys: issue (w)eb request, (r)ecord, (s)top recording, (c)lear screen

+Press CTRL+C to stop Dev Proxy

+Γùë Recording...

+ req Γò¡ GET https://jsonplaceholder.typicode.com/posts?api-version=v1.0

+ api Γò░ Passed through

+ req Γò¡ GET https://jsonplaceholder.typicode.com/users?api-version=beta

+ api Γò░ Passed through

+Γùï Stopped recording

+ info Checking if recorded API requests use production APIs as defined in API Center...

+ info Loading APIs from API Center...

+ info Analyzing recorded requests...

+ warn Request GET https://jsonplaceholder.typicode.com/users?api-version=beta uses API version beta which is defined as Preview. Upgrade to a production version of the API. Recommended versions: v1.0

+ info DONE

+```

+When Dev Proxy finishes its analysis, it creates a report in a file named `ApiCenterProductionVersionPlugin_PlainTextReporter.txt` with the following contents:

+```text

+Non-production APIs:

+ GET https://jsonplaceholder.typicode.com/users?api-version=beta

+

+Production APIs:

+ GET https://jsonplaceholder.typicode.com/posts?api-version=v1.0

+```

+## Summary

+Using Dev Proxy and its `ApiCenterProductionVersionPlugin`, you can check if your app is using production-level APIs. The plugin compares the information about API requests from your app with information from Azure API Center and reports on any nonproduction API requests. It also recommends the production version of the APIs you're using. Verifying what APIs your app is using, helps you ensure that your app is using stable APIs, which are supported and covered by SLAs, making your app more robust. You can run this check manually or integrate with your CI/CD pipeline to ensure that your app is using production-level APIs before releasing it to production.

+## Related content

+- [Learn more about Dev Proxy](/microsoft-cloud/dev/dev-proxy/overview)

+- [Learn more about Azure API Center](./key-concepts.md)

+* **Option 2** - Import APIs directly from API Management to your API center using the [az apic import-from-apim](/cli/azure/apic#az-apic-import-from-apim) command.

+* See the [Azure CLI reference for Azure API Center](/cli/azure/apic) for a complete command list, including commands to manage [environments](/cli/azure/apic/environment), [deployments](/cli/azure/apic/api/deployment), [metadata schemas](/cli/azure/apic/metadata), and [services](/cli/azure/apic).

+Mutual TLS authentication is [natively supported](./api-management-howto-mutual-certificates.md) by API Management and can be enabled in Kubernetes by [installing an Ingress Controller](../aks/ingress-own-tls.md) (Fig. 3). As a result, authentication will be performed in the Ingress Controller, which simplifies the microservices. Additionally, you can add the IP addresses of API Management to the allowed list by Ingress to make sure only API Management has access to the cluster. If API Management [Premium Tier](./api-management-using-with-internal-vnet.md) or [Standard V2](./integrate-vnet-outbound.md) tier is used, network level isolation can be achieved.

+* Security risk due to public visibility of Ingress Controller endpoint(s) unless API Management Standard v2 or Premium tier is being used.

+A zone redundant deployment has triple the infrastructure, and ensures that even if two of the three zones go down, your workloads remain available. Due to the increased system need, the minimum charge for a zone redundant App Service Environment is 18 cores. If you've fewer than this number of cores across all App Service plans in your App Service Environment, the difference is charged as Windows I1v2. If you've 18 or more cores, there's no added charge to have a zone redundant App Service Environment. To learn more about zone redundancy, see [Regions and availability zones](./overview-zone-redundancy.md). For sample calculations for zone redundant App Service Environment, see [App Service Environment pricing](overview.md#pricing).

+> [!NOTE]

+> Changes to NSG rules can take up to 14 days to take effect due to HTTP connection persistence. If you make a change that blocks platform/management traffic, it could take up to 14 days for the impact to be seen.

+>

+>

+ Title: 'Quickstart: Deploy a Python (Django, Flask, or FastAPI) web app to Azure'

+In this quickstart, you deploy a Python web app (Django, Flask, or FastAPI) to [Azure App Service](./overview.md#app-service-on-linux). Azure App Service is a fully managed web hosting service that supports Python apps hosted in a Linux server environment.

+This quickstart can be completed using either Flask, Django, or FastAPI. A sample application in each framework is provided to help you follow along with this quickstart. Download or clone the sample application to your local workstation.

+### [FastAPI](#tab/fastapi)

+```Console

+git clone https://github.com/Azure-Samples/msdocs-python-fastapi-webapp-quickstart.git

+```

+### [FastAPI](#tab/fastapi)

+1. Go to the application folder:

+ ```Console

+ cd msdocs-python-fastapi-webapp-quickstart

+ ```

+1. Create a virtual environment for the app:

+ [!INCLUDE [Virtual environment setup](./includes/quickstart-python/virtual-environment-setup.md)]

+1. Install the dependencies:

+ ```Console

+ pip install -r requirements.txt

+ ```

+1. Run the app:

+ ```Console

+ uvicorn main:app --reload

+ ```

+1. Browse to the sample application at `http://localhost:8000` in a web browser.

+ :::image type="content" source="./media/quickstart-python/run-django-app-localhost.png" alt-text="Screenshot of the FastAPI app running locally in a browser.":::

+Having issues? [Let us know](https://aka.ms/PythonAppServiceQuickstartFeedback).

+## 4 - Configure startup script

+Based on the presence of certain files in a deployment, App Service automatically detects whether an app is a Django or Flask app and performs default steps to run your app. For apps based on other web frameworks like FastAPI, you need to configure a startup script for App Service to run your app; otherwise, App Service runs a default read-only app located in the *opt/defaultsite* folder.

+To learn more about how App Service runs Python apps and how you can configure and customize its behavior with your app, see [Configure a Linux Python app for Azure App Service](configure-language-python.md).

+### [Azure CLI](#tab/azure-cli/flask)

+App Service automatically detects the presence of a Flask app. No additional configuration is needed for this quickstart.

+### [Azure CLI](#tab/azure-cli/django)

+App Service automatically detects the presence of a Django app. No additional configuration is needed for this quickstart.

+### [Azure CLI](#tab/azure-cli/fastapi)

+For FastAPI, you must configure a custom startup command for App Service to run your app. The following command starts Gunicorn with 2 Uvicorn worker processes: `gunicorn -w 2 -k uvicorn.workers.UvicornWorker -b 0.0.0.0:8000 main:app`.

+First, configure the startup command using the [az webapp config set](/cli/azure/webapp/config#az-webapp-config-set) command.

+```azurecli

+az webapp config set \

+ --startup-file "gunicorn -w 2 -k uvicorn.workers.UvicornWorker -b 0.0.0.0:8000 main:app" \

+ --name $APP_SERVICE_NAME \

+ --resource-group $RESOURCE_GROUP_NAME

+```

+Next, restart the web app using the [az webapp restart](/cli/azure/webapp#az-webapp-restart) command.

+```azurecli

+az webapp restart \

+ --name $APP_SERVICE_NAME \

+ --resource-group $RESOURCE_GROUP_NAME

+```

+### [VS Code](#tab/vscode-aztools/flask)

+App Service automatically detects the presence of a Flask app. No additional configuration is needed for this quickstart.

+### [VS Code](#tab/vscode-aztools/django)

+App Service automatically detects the presence of a Django app. No additional configuration is needed for this quickstart.

+### [VS Code](#tab/vscode-aztools/fastapi)

+Use Azure CLI or the Azure portal to configure the startup command.

+### [Azure portal](#tab/azure-portal/flask)

+App Service automatically detects the presence of a Flask app. No additional configuration is needed for this quickstart.

+### [Azure portal](#tab/azure-portal/django)

+App Service automatically detects the presence of a Django app. No additional configuration is needed for this quickstart.

+### [Azure portal](#tab/azure-portal/fastapi)

+For FastAPI, you must configure a custom startup command for App Service to run your app. The following command starts Gunicorn with 2 Uvicorn worker processes: `gunicorn -w 2 -k uvicorn.workers.UvicornWorker -b 0.0.0.0:8000 main:app`.

+| Instructions | Screenshot |

+|:-|--:|

+| [!INCLUDE [Configure startup command from Azure portal 1](./includes/quickstart-python/configure-startup-azure-portal-1.md)] | :::image type="content" source="./media/quickstart-python/configure-startup-azure-portal-1-240px.png" alt-text="A screenshot of the location in the Azure portal where to configure the startup command." lightbox="./media/quickstart-python/configure-startup-azure-portal-1.png"::: |

+| [!INCLUDE [Configure startup command from Azure portal 2](./includes/quickstart-python/configure-startup-azure-portal-2.md)] | :::image type="content" source="./media/quickstart-python/configure-startup-azure-portal-2-240px.png" alt-text="A screenshot of how to reset the web app in the Azure portal." lightbox="./media/quickstart-python/configure-startup-azure-portal-2.png"::: |

+## 5 - Browse to the app

+## 6 - Stream logs

+### [FastAPI](#tab/fastapi)

+> [Tutorial: Python (Django or Flask) web app with PostgreSQL](./tutorial-python-postgresql-app.md)

+* All Application Gateways v2 deployments must contain public facing frontend IP configuration to enable communication to the **Gateway Manager** service tag.

+* Network Security Group associations require rules to allow inbound access from GatewayManager and Outbound access to Internet.

+* When introducing a default route (0.0.0.0/0) to forward traffic anywhere other than the Internet, metrics, monitoring, and updates of the gateway result in a failed status.

+* Private IP address only frontend IP configuration

+* Elimination of inbound traffic from GatewayManager service tag via Network Security Group

+* Ability to define a **Deny All** outbound Network Security Group (NSG) rule to restrict egress traffic to the Internet

+* Ability to override the default route to the Internet (0.0.0.0/0)

+* DNS resolution via defined resolvers on the virtual network [Learn more](../virtual-network/manage-virtual-network.yml#change-dns-servers), including private link private DNS zones.

+# [Azure portal](#tab/portal)

+# [Azure portal](#tab/portal)

+### Private link configuration

+>[!Note]

+>Query string parameter values such as "secret", "password", "pwd", "passwd", "key", "token", "pat", "accesskey", "accesstoken", "credential", "sas", "personalAccessToken", and "personal.access.token" logged in the requestUri field will be replaced with a value of _**<redacted\>**_ to prevent sensitive information from being logged. This is non-configurable.

+ 

+> [!IMPORTANT]

+> New Runtime environment experience allows you to manage modules and packages by allowing you to configure the job execution environment. In the new experience, Modules and Packages blades are not available. To manage modules and packages, see [Manage Runtime environment and associated runbooks](manage-runtime-environment.md).

+ > - Use *.zip* files for PowerShell runbook types as mentioned [here](/powershell/scripting/developer/module/understanding-a-windows-powershell-module)

+- Management of modules for Azure Automation State Configuration is not supported through Runtime environment experience. You can continue using the old experience for managing modules and packages for Azure Automation State Configuration.

+> [!IMPORTANT]

+> New Runtime environment experience allows you to manage modules and packages by allowing you to configure the job execution environment. In the new experience, Modules and Packages blades are not available. To manage modules and packages, see [Manage Runtime environment and associated runbooks](../manage-runtime-environment.md).

+## July 9, 2024

+**Image tag**: `v1.31.0_2024-07-09`

+For complete release version information, review [Version log](version-log.md#july-9-2024).

+> The custom locations feature is dependent on the [cluster connect](cluster-connect.md) feature. Both features must be enabled in the cluster for custom locations to function. To enable the custom locations feature, follow the steps below:

+This warning occurs because the service principal lacks the necessary permissions to retrieve the `oid` (object ID) of the custom location used by the Azure Arc service. To avoid this error, follow these steps:

+1. Sign in to Azure CLI with your user account.

+1. Run the following command to fetch the `oid` (object ID) of the custom location, where `--id` is predefined and set to `bc313c14-388c-4e7d-a58e-70017303ee3b`:

+ **Important!** Copy and run the command exactly as it is shown below. Do not replace the value passed to the `--id` parameter with a different value.

+ ```azurecli

+1. Sign in to Azure CLI using the service principal. Run the following command to enable the custom locations feature on the cluster, using the `oid` (object ID) value from the previous step for the `--custom-locations-oid` parameter:

+ az connectedk8s enable-features -n <cluster-name> -g <resource-group-name> --custom-locations-oid <cl-oid> --features cluster-connect custom-locations

+### SSH folder access denied

+The CLI requires permission to access the SSH folder during deployment or operations that involve accessing files within the folder. This folder contains essential files such as the kubeconfig and logs key for the appliance VM. For instance, the CLI needs to access the logs key stored in the SSH folder to collect logs from the appliance VM.

+If you encounter an error stating: `Access to the file in the SSH folder was denied. This may occur if the CLI doesn't have permission to the SSH folder or if another CLI instance is using the file`, there are two common causes for this issue:

+1. Insufficient permissions: The CLI lacks the necessary permissions to access the SSH folder. Ensure that the user account running the CLI has appropriate permissions to access the SSH folder.

+1. Concurrent file access: Another instance of the CLI might be using the file in the SSH folder. This often happens on workstations with shared profiles. Ensure that any other CLI instance completes or terminates its operation before you proceed.

+ [!INCLUDE [azure-cli-subscription](./includes/azure-cli-subscription.md)]

+ [!INCLUDE [azure-cli-all](./includes/azure-cli-all.md)]

+ [!INCLUDE [azure-cli-specified-arc](./includes/azure-cli-specified-arc.md)]

+ |**Authorization level**|Choose `Anonymous`, which enables anyone to call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ |**Authorization level**| Choose `Anonymous`, which lets anyone call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ |**Authorization level**|Choose `Anonymous`, which enables anyone to call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ |**Authorization level**|Choose `Anonymous`, which enables anyone to call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ |**Authorization level**|Choose `Anonymous`, which enables anyone to call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ |**Authorization level**| Choose `ANONYMOUS`, which lets anyone call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ |**Authorization level**|Choose `Anonymous`, which enables anyone to call your function endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+You can still cause a disabled function to run by supplying the master access key (`_master`) in a REST request to the endpoint URL of the disabled function. In this way, you can develop and validate functions in Azure in a disabled state while preventing them from being accessed by others. Using any other type of key in the request returns an HTTP 404 response.

+To learn more about the master key, see [Understand keys](function-keys-how-to.md#understand-keys). To learn more about calling non-HTTP triggered functions, see [Manually run a non HTTP-triggered function](functions-manually-run-non-http.md).

+Azure Functions uses an encrypted repository file (host.json) to securely store [access keys](../../function-keys-how-to.md) used by your function app. Whenever the Functions host is unable to decrypt this repository file, it and regenerates the repository file and creates a backup of the unreadable file with a name like `host.snapshot.<DATE>.json`.

+Azure Functions uses an encrypted repository file (host.json) to securely store [access keys](../../function-keys-how-to.md) (function or host) used by your function app. When the access tier of this secrets repository file is set to `archive`, functions that require access keys return an error. These functions can include HTTP triggers, Event Grid calls, and durable orchestrations.

+This event indicates the name and type of the key that is in violation. You should regenerate the key to obtain a new value that is highly identifiable. To learn how to regenerate keys, see [Renew access keys](../../function-keys-how-to.md#renew-or-create-access-keys).

+This REST API is an administrator API, so it requires your function app [master key](function-keys-how-to.md). Don't confuse the system key (for invoking an Event Grid trigger function) with the master key (for performing administrative tasks on the function app). When you subscribe to an Event Grid topic, be sure to use the system key.

+Deployments in the Flex Consumption plan follow a single path. After your project code is built and zipped into an application package, it is deployed to a blob storage container. On startup, your app gets the package and runs your function code from this package. By default, the same storage account used to store internal host metadata (AzureWebJobsStorage) is also used as the deployment container. However, you can use an alternative storage account or choose your preferred authentication method by [configuring your app's deployment settings](flex-consumption-how-to.md#configure-deployment-settings). In streamlining the deployment path, there's no longer the need for app settings to influence deployment behavior.

+ Title: Work with access keys in Azure Functions

+description: Learn about access keys in Azure Functions, including how to get and renew keys and how to use access keys when calling function endpoints.

+#CustomerIntent: As an Azure Functions developer, I want learn how to work with access keys so that I can properly harden both my function endpoints and my overall function app running in Azure.

+# Work with access keys in Azure Functions

+Azure Functions lets you use secret keys to make it more difficult to access your function endpoints. This article describes the various kinds of access keys supported by Functions, and how to work with access keys.

+While access keys provide some mitigation against unwanted access, you should consider other options to secure HTTP endpoints in production. For example, it's not a good practice to distribute shared secrets in a public app. If your function is being called from a public client, you should consider implementing these or other security mechanisms:

+

+Access keys provide the basis for HTTP authorization in HTTP triggered functions. For more information, see [Authorization level](./functions-bindings-http-webhook-trigger.md#http-auth).

+## Understand keys

+The scope of an access key and the actions it supports depend on the type of access key.

+| Key type | Key name | HTTP auth level | Description |

+| -- | -- | - | - |

+| **Function** | `default` or user defined | `function` | Allows access only to a specific function endpoint. |

+| **Host** | `default` or user defined | `function` | Allows access to all function endpoints in a function app. |

+| **Master** | `_master` | `admin` | Special host key that also provides administrative access to the runtime REST APIs in a function app. This key can't be revoked. Because the master key grants elevated permissions in your function app, you shouldn't share this key with third parties or distribute it in native client applications. |

+| **System** | Depends on the extension | n/a | Specific extensions might require a system-managed key to access webhook endpoints. System keys are designed for extension-specific function endpoints that get called by internal components. For example, the [Event Grid trigger](functions-bindings-event-grid-trigger.md) requires that the subscription use a system key when calling the trigger endpoint. Durable Functions also uses system keys to call [Durable Task extension APIs](durable/durable-functions-http-api.md). <br/>System keys can only be created by specific extensions, and you can't explicitly set their values. Like other keys, you can generate a new value for the key from the portal or by using the key APIs. |

+Each key is named for reference, and there's a default key (named `default`) at the function and host level. Function keys take precedence over host keys. When two keys are defined with the same name, the function key is always used.

+The following table compares the uses for various kinds of access keys:

+| Action | Scope | Key type |

+|--|--|--|

+| Execute a function | Specific function | Function |

+| Execute a function | Any function | Function or host |

+| Call an `admin` endpoint | Function app | Master-only |

+| Call Durable Task extension APIs | Function app<sup>*</sup> | System |

+| Call an extension-specific Webhook (internal) | Function app<sup>*</sup> | system |

+<sup>*</sup>Scope determined by the extension.

+## Key requirements

+In Functions, access keys are randomly generated 32-byte arrays that are encoded as URL-safe base-64 strings. While you can generate your own access keys and use them with Functions, we strongly recommend that you instead allow Functions to generate all of your access keys for you.

+Functions-generated access keys include special signature and checksum values that indicate the type of access key and that it was generated by Azure Functions. Having these extra components in the key itself makes it much easier to determine the source of these kinds of secrets located during security scanning and other automated processes.

+To allow Functions to generate your keys for you, don't supply the key `value` to any of the APIs that you can use to generate keys.

+## Manage key storage

+Keys are stored as part of your function app in Azure and are encrypted at rest. By default, keys are stored in a Blob storage container in the account provided by the `AzureWebJobsStorage` setting. You can use the [`AzureWebJobsSecretStorageType`](functions-app-settings.md#azurewebjobssecretstoragetype) setting to override this default behavior and instead store keys in one of these alternate locations:

+|Location | Value | Description |

+||||

+| A second storage account | `blob` | Stores keys in Blob storage in a storage account that's different that the one used by the Functions runtime. The specific account and container used is defined by a shared access signature (SAS) URL set in the [`AzureWebJobsSecretStorageSas`](functions-app-settings.md#azurewebjobssecretstoragesas) setting. You must maintain the `AzureWebJobsSecretStorageSas` setting when the SAS URL changes. |

+| [Azure Key Vault](../key-vault/general/overview.md) | `keyvault` | The key vault set in [`AzureWebJobsSecretStorageKeyVaultUri`](functions-app-settings.md#azurewebjobssecretstoragekeyvaulturi) is used to store keys. |

+| File system | `files` | Keys are persisted on the local file system, which is the default in Functions v1.x. File system storage isn't recommended. |

+| Kubernetes Secrets |`kubernetes` | The resource set in [AzureWebJobsKubernetesSecretName](functions-app-settings.md#azurewebjobskubernetessecretname) is used to store keys. Supported only when your function app is deployed to Kubernetes. The [Azure Functions Core Tools](functions-run-local.md) generates the values automatically when you use it to deploy your app to a Kubernetes cluster.|

+When using Key Vault for key storage, the app settings you need depend on the managed identity type, either system-assigned or user-assigned.

+| Setting name | System-assigned | User-assigned | App registration |

+| | | | |

+| [AzureWebJobsSecretStorageKeyVaultUri](functions-app-settings.md#azurewebjobssecretstoragekeyvaulturi) | Γ£ô | Γ£ô | Γ£ô |

+| [AzureWebJobsSecretStorageKeyVaultClientId](functions-app-settings.md#azurewebjobssecretstoragekeyvaultclientid) | X | Γ£ô |Γ£ô |

+| [AzureWebJobsSecretStorageKeyVaultClientSecret](functions-app-settings.md#azurewebjobssecretstoragekeyvaultclientsecret) | X | X | Γ£ô |

+| [AzureWebJobsSecretStorageKeyVaultTenantId](functions-app-settings.md#azurewebjobssecretstoragekeyvaulttenantid) | X | X | Γ£ô |

+## Use access keys

+HTTP triggered functions can generally be called by using a URL in the format: `https://<APP_NAME>.azurewebsites.net/api/<FUNCTION_NAME>`. When the authorization level of a given function is set a value other than `anonymous`, you must also provide an access key in your request. The access key can either be provided in the URL using the `?code=` query string or in the request header (`x-functions-key`). For more information, see [Access key authorization](functions-bindings-http-webhook-trigger.md#api-key-authorization).

+To access the runtime REST APIs (under `/admin/`), you must provide the master key (`_master`) in the `x-functions-key` request header.

+## Get your function access keys

+You can get function and host keys programmatically by using these Azure Resource Manager APIs:

+To learn how to call Azure Resource Manager APIs, see the [Azure REST API reference](/rest/api/azure/).

+You can use these methods to get access keys without having to use the REST APIs.

+### [Azure portal](#tab/azure-portal)

+1. Sign in to the Azure portal, then search for and select **Function App**.

+1. Select the function app you want to work with.

+1. In the left pane, expand **Functions**, and then select **App keys**.

+ The **App keys** page appears. On this page the host keys are displayed, which can be used to access any function in the app. The system key is also displayed, which gives anyone administrator-level access to all function app APIs.

+You can also practice least privilege by using the key for a specific function. You can get function-specific keys from the **Function keys** tab of a specific HTTP-triggered function.

+### [Azure CLI](#tab/azure-cli)

+Run the following script in Azure Cloud Shell, the output of which is the `default` host key, which can be used to access any HTTP triggered function in the function app.

+```azurecli-interactive

+az functionapp keys list --resource-group <RESOURCE_GROUP> --name <APP_NAME> --query functionKeys.default --output tsv

+```

+In this script, replace `<RESOURCE_GROUP>` and `<APP_NAME>` with the resource group and your function app name, respective.

+Because the output contains sensitive information, either don't persist the output or secure any persisted file outputs.

+### [Azure PowerShell](#tab/azure-powershell)

+Run the following script, the output of which is the `default` host key, which can be used to access any HTTP triggered function in the function app.

+```powershell-interactive

+$subName = '<SUBSCRIPTION_ID>'

+$rGroup = '<RESOURCE_GROUP>'

+$appName = '<APP_NAME>'

+$path = "/subscriptions/$((Get-AzContext).Subscription.Id)/resourceGroups/$rGroup/providers/Microsoft.Web/sites/$appName/host/default/listKeys?api-version=2018-11-01"

+((Invoke-AzRestMethod -Path $path -Method POST).Content | ConvertFrom-JSON).functionKeys.default

+```

+In this script, replace `<RESOURCE_GROUP>` and `<APP_NAME>` with the resource group and your function app name, respective.

+## Renew or create access keys

+When you renew or create your access key values, you must manually redistribute the updated key values to all clients that call your function.

+You can renew function and host keys programmatically or create new ones by using these Azure Resource Manager APIs:

+To learn how to call Azure Resource Manager APIs, see the [Azure REST API reference](/rest/api/azure/).

+You can use these methods to get access keys without having to manually create calls to the REST APIs.

+### [Azure portal](#tab/azure-portal)

+1. Sign in to the Azure portal, then search for and select **Function App**.

+1. Select the function app you want to work with.

+1. In the left pane, expand **Functions**, and then select **App keys**.

+ The **App keys** page appears. On this page the host keys are displayed, which can be used to access any function in the app. The system key is also displayed, which gives anyone administrator-level access to all function app APIs.

+1. Select **Renew key value** next to the key you want to renew, then select **Renew and save**.

+You can also renew a function key in the **Function keys** tab of a specific HTTP-triggered function.

+### [Azure CLI](#tab/azure-cli)

+Run the following script in Azure Cloud Shell, which renews the `default` host key with a new key value generated by Functions.

+```azurecli-interactive

+az functionapp keys set --resource-group <RESOURCE_GROUP> --name <APP_NAME> --key-type functionKeys --key-name default

+```

+In this script, replace `<RESOURCE_GROUP>` and `<APP_NAME>` with the resource group and your function app name, respective. This script has been created to run in Azure Cloud Shell (Bash). You must modify it to run in a Windows terminal.

+The new key value generated by Functions is displayed for your reference. This new key value must be securely distributed to any apps that rely on the host key. Because the output contains sensitive information, either don't persist the output or secure any persisted file outputs.

+### [Azure PowerShell](#tab/azure-powershell)

+Run the following script, which uses the REST APIs to renew the `default` host key with a new key value generated by Functions.

+```powershell-interactive

+# Variables - replace these with your actual values

+$resourceGroupName = "<RESOURCE_GROUP>"

+$functionAppName = "<APP_NAME>"

+# Construct the URI for the REST API call

+$uri = "https://management.azure.com/subscriptions/$((Get-AzContext).Subscription.Id)/resourceGroups/$resourceGroupName/providers/Microsoft.Web/sites/$functionAppName/host/default/listkeys?api-version=2021-02-01"

+# Construct the body of the request

+$body = @{

+ properties = @{

+ name = "default"

+ }

+} | ConvertTo-Json

+# Invoke the REST API to create or update the host-level secret

+$response = Invoke-AzRestMethod -Method Post -Uri $uri -Payload $body

+# Output the updated key for reference

+($response.Content | ConvertFrom-Json).functionKeys.default

+```

+In this script, replace `<RESOURCE_GROUP>` and `<APP_NAME>` with the resource group and your function app name, respective.

+The new key value generated by Functions is returned for your reference. It must be securely distributed to any apps that rely on the host key. Because the output contains sensitive information, either don't persist the output or secure any persisted file outputs.

+## Delete access keys

+You can delete function and host keys programmatically by using these Azure Resource Manager APIs:

+To learn how to call Azure Resource Manager APIs, see the [Azure REST API reference](/rest/api/azure/).

+## Related content

+To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+_This setting is deprecated and was only used when running on version 3.x of the Azure Functions runtime._

+The name of a key vault instance used to store keys. This setting was only used in version 3.x of the Functions runtime, which is no longer supported. For version 4.x, instead use `AzureWebJobsSecretStorageKeyVaultUri`. This setting requires you to set `AzureWebJobsSecretStorageType` to `keyvault`.

+To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+The tenant ID of the app registration used to access the vault where keys are stored. This setting requires you to set `AzureWebJobsSecretStorageType` to `keyvault`. Supported in version 4.x and later versions of the Functions runtime. To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+A Blob Storage SAS URL for a second storage account used for key storage. By default, Functions uses the account set in `AzureWebJobsStorage`. When using this secret storage option, make sure that `AzureWebJobsSecretStorageType` isn't explicitly set or is set to `blob`. To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+To learn more, see [Manage key storage](function-keys-how-to.md#manage-key-storage).

+For Node.js v18 or lower, the app setting is used, and the default behavior depends on if the error happens before or after a model v4 function has been registered:

+On a function app running in a [Dedicated (App Service) plan](./dedicated-plan.md), the Functions runtime goes idle after a few minutes of inactivity, a which point only requests to an HTTP trigger _wakes up_ your function app. To make sure that your non-HTTP triggered functions run correctly, including Timer trigger functions, enable Always On for the function app by setting the `alwaysOn` site setting to a value of `true`.

+Here's the code for the `ToDoItem` class, referenced in this example:

+TypeScript samples aren't documented for model v3.

+| `route` | Route for the http endpoint. If None, it will be set to function name if present or user-defined python function name. |

+#### [Isolated worker model](#tab/isolated-process)

+| A custom type | When the body of the request is JSON, the runtime tries to parse it to set the object properties. |

+When the trigger parameter is of type `HttpRequestData` or `HttpRequest`, custom types can also be bound to other parameters using `Microsoft.Azure.Functions.Worker.Http.FromBodyAttribute`. Use of this attribute requires [`Microsoft.Azure.Functions.Worker.Extensions.Http` version 3.1.0 or later](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Extensions.Http). This is a different type than the similar attribute in `Microsoft.AspNetCore.Mvc`. When using ASP.NET Core integration, you need a fully qualified reference or `using` statement. This example shows how to use the attribute to get just the body contents while still having access to the full `HttpRequest`, using ASP.NET Core integration:

+#### [In-process model](#tab/in-process)

+#### [Isolated worker model](#tab/isolated-process)

+#### [In-process model](#tab/in-process)

+#### [Model v4](#tab/nodejs-v4)

+#### [Model v3](#tab/nodejs-v3)

+TypeScript samples aren't documented for model v3.

+#### [Model v4](#tab/nodejs-v4)

+#### [Model v3](#tab/nodejs-v3)

+#### [v2](#tab/python-v2)

+#### [v1](#tab/python-v1)

+By default, all function routes are prefixed with `api`. You can also customize or remove the prefix using the `extensions.http.routePrefix` property in your [host.json](functions-host-json.md) file. The following example removes the `api` route prefix by using an empty string for the prefix in the *host.json* file.

+#### [v2](#tab/python-v2)

+#### [v1](#tab/python-v1)

+#### [Model v4](#tab/nodejs-v4)

+#### [Model v3](#tab/nodejs-v3)

+TypeScript samples aren't documented for model v3.

+#### [Model v4](#tab/nodejs-v4)

+#### [Model v3](#tab/nodejs-v3)

+### HTTP streams

+HTTP streams support in Python lets you accept and return data from your HTTP endpoints using FastAPI request and response APIs enabled in your functions. These APIs enable the host to process data in HTTP messages as chunks instead of having to read an entire message into memory. For more information, see [HTTP streams in Python](./functions-reference-python.md#http-streams-preview)

+>[!IMPORTANT]

+> HTTP streams support for Python is currently in preview and is only supported for the Python v2 programming model.

+You can also read this information from binding data.

+> [!NOTE]

+> Access to authenticated client information is currently only available for .NET languages. It also isn't supported in version 1.x of the Functions runtime.

+#### [Isolated worker model](#tab/isolated-process)

+#### [In-process model](#tab/in-process)

+Alternatively, the ClaimsPrincipal can simply be included as an extra parameter in the function signature:

+|**anonymous**| No access key is required.|

+|**function**| A function-specific key is required to access the endpoint. |

+|**admin**| The master key is required to access the endpoint.|

+When a level isn't explicitly set, authorization defaults to the `function` level.

+When a level isn't explicitly set, the default authorization depends on the version of the Node.js model:

+#### [Model v4](#tab/nodejs-v4)

+Authorization defaults to the `anonymous` level.

+#### [Model v3](#tab/nodejs-v3)

+Authorization defaults to the `function` level.

+### <a name="authorization-keys"></a>Function access keys

+Functions lets you use access keys to make it harder to access your function endpoints. Unless the authorization level on an HTTP triggered function is set to `anonymous`, requests must include an access key in the request. For more information, see [Work with access keys in Azure Functions](function-keys-how-to.md).

+### <a name="api-key-authorization"></a>Access key authorization

+Most HTTP trigger templates require an access key in the request. So your HTTP request normally looks like the following URL:

+The key can be included in a query string variable named `code`, as mentioned earlier. It can also be included in an `x-functions-key` HTTP header. The value of the key can be any function key defined for the function, or any host key.

+You can allow anonymous requests, which don't require keys. You can also require that the master key is used. You change the default authorization level by using the `authLevel` property in the binding JSON.

+In version 1.x, webhook templates provide another validation for webhook payloads. In version 2.x and higher, the base HTTP trigger still works and is the recommended approach for webhooks.

+| **`--authlevel`** | Lets you set the authorization level for an HTTP trigger. Supported values are: `function`, `anonymous`, `admin`. Authorization isn't enforced when running locally. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth). |

+| **`--access-token`** | Lets you use a specific access token when performing authenticated `azure` actions. |

+| **`--access-token`** | Lets you use a specific access token when performing authenticated `azure` actions. |

+| **`--keys-secret-name`** | The name of a Kubernetes Secrets collection to use for storing [access keys](function-keys-how-to.md). |

+| **`--mount-funckeys-as-containervolume`** | Mounts the [access keys](function-keys-how-to.md) as a container volume. |

+> If you set authLevel to `FUNCTION` or `ADMIN`, the [access key](function-keys-how-to.md) isn't required when running locally.

+1. In **Template details**, use `HttpExample` for **New Function**, select **Anonymous** from the **[Authorization level](functions-bindings-http-webhook-trigger.md#http-auth)** drop-down list, and then select **Create**.

+ | **Authorization level** | **Anonymous** | The created function can be triggered by any client without providing a key. This authorization setting makes it easy to test your new function. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth). |

+ Make sure you set the **Authorization level** to **Anonymous**. If you choose the default level of **Function**, you're required to present the [function key](function-keys-how-to.md) in requests to access your function endpoint in Azure.

+You must manually sync triggers when using these deployment options:

+ This authorization level requires that you provide a [function key](function-keys-how-to.md) when you call the function endpoint.

+ | **Authorization level** | **Anonymous** | The created function can be triggered by any client without providing a key. This authorization setting makes it easy to test your new function. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth).|

+ | **Authorization level** | **Anonymous** | The created function can be triggered by any client without providing a key. This authorization setting makes it easy to test your new function. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth). |

+ Make sure you set the **Authorization level** to **Anonymous**. If you choose the default level of **Function**, you're required to present the [function key](function-keys-how-to.md) in requests to access your function endpoint.

+| Feature | Consumption plan | Flex Consumption plan | Premium plan | Dedicated plan |

+| [Advanced tools (Kudu)](#kudu) | Windows: Γ£ö <br/>Linux: **X** | **X** | Γ£ö | Γ£ö|

+| [App Service editor](#editor) | Windows: Γ£ö <br/>Linux: **X** | **X** | Windows: Γ£ö <br/>Linux: **X** | Windows: Γ£ö <br/>Linux: **X**|

+| [Backups](../app-service/manage-backup.md) |**X** |**X** | **X** | Γ£ö|

+| [Console](#console) | Windows: command-line <br/>Linux: **X** | **X** | Windows: command-line <br/>Linux: SSH | Windows: command-line <br/>Linux: SSH |

+You can use a Bicep file or an Azure Resource Manager (ARM) template to automate the process of deploying your function app. During the deployment, you can use existing Azure resources or create new ones. Automation help's you with these scenarios:

+The template code required depends on the desired hosting options for your function app. This article supports the following hosting options:

+| [Azure Functions Flex Consumption plan](functions-infrastructure-as-code.md?pivots=consumption-plan) | Code-only | [Flex Consumption plan](./flex-consumption-plan.md) |

+When using this article, keep these considerations in mind:

+

+You must create or configure these resources for an Azure Functions-hosted deployment:

+| An [Application Insights](#create-application-insights) component | Recommended | [Microsoft.Insights/components](/azure/templates/microsoft.insights/components)<sup>*</sup>|

+| A [hosting plan](#create-the-hosting-plan)| Required | [Microsoft.Web/serverfarms](/azure/templates/microsoft.web/serverfarms) |

+You must create or configure these resources for an Azure Functions-hosted deployment:

+| An [Application Insights](#create-application-insights) component | Recommended | [Microsoft.Insights/components](/azure/templates/microsoft.insights/components)<sup>*</sup>|

+| An [Application Insights](#create-application-insights) component | Recommended | [Microsoft.Insights/components](/azure/templates/microsoft.insights/components)<sup>*</sup>|

+| An [Application Insights](#create-application-insights) component | Recommended | [Microsoft.Insights/components](/azure/templates/microsoft.insights/components)<sup>1</sup>|

+<sup>*</sup>If you don't already have a Log Analytics Workspace that can be used by your Application Insights instance, you also need to create this resource.

+This example section creates a Standard general purpose v2 storage account:

+### [Bicep](#tab/bicep)

+```bicep

+resource storageAccountName 'Microsoft.Storage/storageAccounts@2023-05-01' = {

+ name: storageAccountName

+ location: location

+ kind: 'StorageV2'

+ sku: {

+ name: 'Standard_LRS'

+ }

+ properties: {

+ supportsHttpsTrafficOnly: true

+ defaultToOAuthAuthentication: true

+ allowBlobPublicAccess: false

+ }

+}

+```

+For more context, see the complete [main.bicep](https://github.com/Azure-Samples/function-app-arm-templates/blob/main/function-app-linux-consumption/main.bicep#L37) file in the templates repository.

+For more context, see the complete [storage-account.bicep](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/starters/http/dotnet/infra/core/storage/storage-account.bicep#L11) file in the sample repository.

+ "apiVersion": "2023-05-01",

+ "name": "Standard_LRS"

+ "defaultToOAuthAuthentication": true,

+ "allowBlobPublicAccess": false

+You need to set the connection string of this storage account as the `AzureWebJobsStorage` app setting, which Functions requires. The templates in this article construct this connection string value based on the created storage account, which is a best practice. For more information, see [Application configuration](#application-configuration).

+<!{{todo: MI/KeyVault info/links here}} -->

+### Deployment container

+Deployments to an app running in the Flex Consumption plan require a container in Azure Blob Storage as the deployment source. You can use either the default storage account or you can specify a separate storage account. For more information, see [Configure deployment settings](flex-consumption-how-to.md#configure-deployment-settings).

+This deployment account must already be configured when you create your app, including the specific container used for deployments. To learn more about configuring deployments, see [Deployment sources](#deployment-sources-2).

+This example shows how to create a container in the storage account:

+For the snippet in context, see [this deployment example](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/bicep/core/storage/storage-account.bicep#L46).

+### [ARM template](#tab/json)

+For the snippet in context, see [this deployment example](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/armtemplate/azuredeploy.json#L117).

+Other deployment settings are [configured with the app itself](#deployment-sources-2).

+#### [Bicep](#tab/bicep)

+```bicep

+resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2021-09-01' existing = {

+ name:'default'

+ parent:storageAccountName

+}

+resource storageDataPlaneLogs 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {

+ name: '${storageAccountName}-logs'

+ scope: blobService

+ properties: {

+ workspaceId: myLogAnalytics.id

+ logs: [

+ {

+ category: 'StorageWrite'

+ enabled: true

+ }

+ ]

+ metrics: [

+ {

+ category: 'Transaction'

+ enabled: true

+ }

+ ]

+ }

+}

+```

+This same workspace can be used for the Application Insights resource defined later. For more information, including how to work with these logs, see [Monitoring Azure Storage](../storage/blobs/monitor-blob-storage.md).

+## Create Application Insights

+You should be using Application Insights for monitoring your function app executions. Application Insights now requires an Azure Log Analytics workspace, which can be shared. These examples assume you're using an existing workspace and have the fully qualified resource ID for the workspace. For more information, see [Azure Log Analytics workspace](../azure-monitor/logs/log-analytics-overview.md).

+In this example section, the Application Insights resource is defined with the type `Microsoft.Insights/components` and the kind `web`:

+### [Bicep](#tab/bicep)

+resource applicationInsight 'Microsoft.Insights/components@2020-02-02' = {

+ name: applicationInsightsName

+ location: appInsightsLocation

+ tags: tags

+ kind: 'web'

+ properties: {

+ Application_Type: 'web'

+ WorkspaceResourceId: '<FULLY_QUALIFIED_RESOURCE_ID>'

+ }

+```

+For more context, see the complete [main.bicep](https://github.com/Azure-Samples/function-app-arm-templates/blob/main/function-app-linux-consumption/main.bicep#L60) file in the templates repository.

+### [ARM template](#tab/json)

+```json

+{

+ "type": "Microsoft.Insights/components",

+ "apiVersion": "2020-02-02",

+ "name": "[parameters('applicationInsightsName')]",

+ "location": "[parameters('location')]",

+ "kind": "web",

+ "properties": {

+ "Application_Type": "web",

+ "WorkspaceResourceId": "<FULLY_QUALIFIED_RESOURCE_ID>"

+For more context, see the complete [azuredeploy.json](https://github.com/Azure-Samples/function-app-arm-templates/blob/main/function-app-linux-consumption/azuredeploy.json#L102) file in the templates repository.

+The connection must be provided to the function app using the [`APPLICATIONINSIGHTS_CONNECTION_STRING`](functions-app-settings.md#applicationinsights_connection_string) application setting. For more information, see [Application configuration](#application-configuration).

+The examples in this article obtain the connection string value for the created instance. Older versions might instead use [`APPINSIGHTS_INSTRUMENTATIONKEY`](functions-app-settings.md#appinsights_instrumentationkey) to set the instrumentation key, which is no longer recommended.

+## Create the hosting plan

+Apps hosted in an Azure Functions [Flex Consumption plan](./flex-consumption-plan.md), [Premium plan](./functions-premium-plan.md), or [Dedicated (App Service) plan](./dedicated-plan.md) must have the hosting plan explicitly defined.

+Flex Consumption is a Linux-based hosting plan that builds on the Consumption _pay for what you use_ serverless billing model. The plan features support for private networking, instance memory size selection, and improved managed identity support.

+A Flex Consumption plan is a special type of `serverfarm` resource. You can specify it by using `FC1` for the `Name` property value in the `sku` property with a `tier` value of `FlexConsumption`.

+This example section creates Flex Consumption plan:

+For more context, see the complete [function.bicep](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/bicep/core/host/function.bicep#L21) file in the Flex Consumption plan sample repository.

+### [ARM template](#tab/json)

+For more context, see the complete [azuredeploy.json](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/armtemplate/azuredeploy.json#L136) file in the templates repository.

+

+Because the Flex Consumption plan currently only supports Linux, you must also set the `reserved` property to `true`.

+Flex Consumption replaces many of the standard application settings and site configuration properties used in Bicep and ARM template deployments. For more information, see [Application configuration](#application-configuration).

+

+### [Bicep](#tab/bicep)

+For more context, see the complete [function.bicep](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/bicep/core/host/function.bicep#L35) file in the Flex Consumption plan sample repository.

+### [ARM template](#tab/json)

+For more context, see the complete [azuredeploy.json](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/armtemplate/azuredeploy.json#L144) file in the templates repository.

+## Deployment sources

+In the Flex Consumption plan, your project code is deployed from a zip-compressed package published to a Blob storage container. For more information, see [Deployment](flex-consumption-plan.md#deployment). The specific storage account and container used for deployments, the authentication method, and credentials are set in the `functionAppConfig.deployment.storage` element of the `properties` for the site. The container and any application settings must exist when the app is created. For an example of how to create the storage container, see [Deployment container](#deployment-container).

+This example uses a system assigned managed identity to access the specified blob storage container, which is created elsewhere in the deployment:

+### [Bicep](#tab/bicep)

+### [ARM template](#tab/json)

+When using managed identities, you must also enable the function app to access the storage account using the identity, as shown in this example:

+ ### [Bicep](#tab/bicep)

+For a complete reference example, see [this Bicep file](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/bicep/core/host/function.bicep).

+### [ARM template](#tab/json)

+For a complete reference example, see [this ARM template](https://github.com/Azure-Samples/azure-functions-flex-consumption-samples/blob/main/IaC/armtemplate/azuredeploy.json).

+When using a connection string instead of managed identities, you need to instead set the `authentication.type` to `StorageAccountConnectionString` and set `authentication.storageAccountConnectionStringName` to the name of the application setting that contains the deployment storage account connection string.

+To successfully deploy your application by using Azure Resource Manager, it's important to understand how resources are deployed in Azure. In most examples, top-level configurations are applied by using `siteConfig`. It's important to set these configurations at a top level, because they convey information to the Functions runtime and deployment engine. Top-level information is required before the child `sourcecontrols/web` resource is applied. Although it's possible to configure these settings in the child-level `config/appSettings` resource, in some cases your function app must be deployed _before_ `config/appSettings` is applied.

+There are scenarios that require you to rebuild your app remotely. One such example is when you need to include Linux-specific packages in Python or Node.js apps that you developed on a Windows computer. In this case, you can configure Functions to perform a remote build on your code after the zip deployment.

+The way that you request a remote build depends on the operating system to which you're deploying:

+### [Bicep](#tab/bicep)

+```bicep

+resource functionApp 'Microsoft.Web/sites@2022-03-01' = {

+ name: functionAppName

+ location: location

+ kind: 'functionapp'

+ properties: {

+ serverFarmId: hostingPlan.id

+ siteConfig: {

+ appSettings: [

+ {

+ name: 'AzureWebJobsStorage'

+ value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${storageAccount.listKeys().keys[0].value}'

+ }

+ {

+ name: 'FUNCTIONS_WORKER_RUNTIME'

+ value: 'node'

+ }

+ {

+ name: 'WEBSITE_NODE_DEFAULT_VERSION'

+ value: '~14'

+ }

+ {

+ name: 'FUNCTIONS_EXTENSION_VERSION'

+ value: '~4'

+ }

+ {

+ name: 'DOCKER_REGISTRY_SERVER_URL'

+ value: dockerRegistryUrl

+ }

+ {

+ name: 'DOCKER_REGISTRY_SERVER_USERNAME'

+ value: dockerRegistryUsername

+ }

+ {

+ name: 'DOCKER_REGISTRY_SERVER_PASSWORD'

+ value: dockerRegistryPassword

+ }

+ {

+ name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE'

+ value: 'false'

+ }

+ ]

+ linuxFxVersion: 'DOCKER|myacr.azurecr.io/myimage:mytag'

+ }

+ }

+ dependsOn: [

+ storageAccount

+ ]

+}

+```

+When deploying [containerized functions to Azure Container Apps](./functions-container-apps-hosting.md), your template must:

+The definition of a containerized function app deployed from a private container registry to an existing Container Apps environment might look like this example:

+ kind: 'functionapp,linux,container,azurecontainerapps'

+ serverFarmId: hostingPlanName

+ linuxFxVersion: 'DOCKER|myacr.azurecr.io/myimage:mytag'

+ name: 'AzureWebJobsStorage'

+ value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccountName};AccountKey=${storageAccount.listKeys().keys[0].value}'

+ name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'

+ value: applicationInsightsName.properties.ConnectionString

+ managedEnvironmentId: managedEnvironmentId

+ hostingPlan

+When deploying functions to Azure Arc, the value you set for the `kind` field of the function app resource depends on the type of deployment:

+| Deployment type | `kind` field value |

+|-|-|

+| Code-only deployment | `functionapp,linux,kubernetes` |

+| Container deployment | `functionapp,linux,kubernetes,container` |

+You must also set the `customLocationId` as you did for the [hosting plan resource](#create-the-hosting-plan).

+The definition of a containerized function app, using a .NET 6 quickstart image, might look like this example:

+ kind: 'kubernetes,functionapp,linux,container'

+ extendedLocation: {

+ name: customLocationId

+ }

+ linuxFxVersion: 'DOCKER|mcr.microsoft.com/azure-functions/4-dotnet-isolated6.0-appservice-quickstart'

+ alwaysOn: true

+## Application configuration

+In a Flex Consumption plan, you configure your function app in Azure with two types of properties:

+| Configuration | `Microsoft.Web/sites` property |

+| - | - |

+| Application configuration | `functionAppConfig` |

+| Application settings | `siteConfig.appSettings` collection |

+These configurations are maintained in `functionAppConfig`:

+| Behavior | Setting in `functionAppConfig`|

+| | |

+| [Language runtime](functions-app-settings.md#functions_worker_runtime) | `runtime.name` |

+| [Language version](supported-languages.md) | `runtime.version` |

+| [Maximum instance count](event-driven-scaling.md#flex-consumption-plan) | `scaleAndConcurrency.maximumInstanceCount` |

+| [Instance memory size](flex-consumption-plan.md#instance-memory) | `scaleAndConcurrency.instanceMemoryMB` |

+| [Deployment source](#deployment-sources) | `deployment` |

+The Flex Consumption plan also supports these application settings:

+ + [`APPLICATIONINSIGHTS_CONNECTION_STRING`](functions-app-settings.md#applicationinsights_connection_string)

+ + [`AzureWebJobsStorage`](functions-app-settings.md#azurewebjobsstorage)

+ + [`APPLICATIONINSIGHTS_AUTHENTICATION_STRING`](functions-app-settings.md#applicationinsights_authentication_string)

+ + [`AzureWebJobsStorage__accountName`](functions-app-settings.md#azurewebjobsstorage__accountname)

+These site settings are required on the `siteConfig` property:

+Functions lets you deploy different versions of your code to unique endpoints in your function app. This option makes it easier to develop, validate, and deploy functions updates without impacting functions running in production. Deployment slots is a feature of Azure App Service. The number of slots available [depends on your hosting plan](./functions-scale.md#service-limits). For more information, see [Azure Functions deployment slots](functions-deployment-slots.md) functions.

+To learn about how to swap slots by using templates, see [Automate with Resource Manager templates](../app-service/deploy-staging-slots.md#automate-with-resource-manager-templates).

+These projects provide Bicep-based examples of how to deploy your function apps in a virtual network, including with network access restrictions:

+## Function access keys

+Host-level [function access keys](function-keys-how-to.md) are defined as Azure resources. This means that you can create and manage host keys in your ARM templates and Bicep files. A host key is defined as a resource of type `Microsoft.Web/sites/host/functionKeys`. This example creates a host-level access key named `my_custom_key` when the function app is created:

+### [Bicep](#tab/bicep)

+```bicep

+resource functionKey 'Microsoft.Web/sites/host/functionKeys@2022-09-01' = {

+ name: '${parameters('name')}/default/my_custom_key'

+ properties: {

+ name: 'my_custom_key'

+ }

+ dependsOn: [

+ resourceId('Microsoft.Web/Sites', parameters('name'))

+ ]

+}

+```

+### [ARM template](#tab/json)

+```json

+{

+ "type": "Microsoft.Web/sites/host/functionKeys",

+ "apiVersion": "2022-09-01",

+ "name": "[concat(parameters('name'), '/default/my_custom_key')]",

+ "properties": {

+ "name": "my_custom_key"

+ },

+ "dependsOn": [

+ "[resourceId('Microsoft.Web/Sites', parameters('name'))]"

+ ]

+}

+```

+In this example, the `name` parameter is the name of the new function app. You must include a `dependsOn` setting to guarantee that the key is created with the new function app. Finally, the `properties` object of the host key can also include a `value` property that can be used to set a specific key.

+When you don't set the `value` property, Functions automatically generates a new key for you when the resource is created, which is recommended. To learn more about access keys, including security best practices for working with access keys, see [Work with access keys in Azure Functions](function-keys-how-to.md).

+ This link shows you the ARM template generated based on the options you chose in portal. This template can seem a bit complex when you're creating a function app with many new resources. However, it can provide a good reference for how your ARM template might look.

+### [Bicep](#tab/bicep)

+- [Azure CLI](../azure-resource-manager/bicep/deploy-cli.md)

+- [PowerShell](../azure-resource-manager/bicep/deploy-powershell.md)

+The following PowerShell commands create a resource group and deploy a Bicep file or ARM template that creates a function app with its required resources. To run locally, you must have [Azure PowerShell](/powershell/azure/install-azure-powershell) installed. Run [`Connect-AzAccount`](/powershell/module/az.accounts/connect-azaccount) to sign in.

+#### [Bicep](#tab/bicep)

+New-AzResourceGroupDeployment -ResourceGroupName "MyResourceGroup" -TemplateFile main.bicep -Verbose

+#### [ARM template](#tab/json)

+New-AzResourceGroupDeployment -ResourceGroupName "MyResourceGroup" -TemplateFile azuredeploy.json -Verbose

+This section doesn't apply to version 1.x of the Functions runtime. In version 1.x, supported bindings were included in the core product extension.

+- Azure Functions 4.x uses `Azure.Identity` and `Azure.Security.KeyVault.Secrets` for the Key Vault provider and has deprecated the use of Microsoft.Azure.KeyVault. For more information about how to configure function app settings, see the Key Vault option in [Manage key storage](function-keys-how-to.md#manage-key-storage). ([#2048](https://github.com/Azure/Azure-Functions/issues/2048))

+|Microsoft.web/sites/functions/listkeys/action | Return the [keys for the function](function-keys-how-to.md).|

+|Microsoft.Web/sites/host/listkeys/action | Return the [host keys for the function app](function-keys-how-to.md).|

+ | **Authorization level** | **Function** | When running in Azure, clients must provide a key when accessing the endpoint. For more information, see [Authorization level](functions-bindings-http-webhook-trigger.md#http-auth). |

+In many ways, planning for secure development, deployment, and operation of serverless functions is much the same as for any web-based or cloud-hosted application. [Azure App Service](../app-service/index.yml) provides the hosting infrastructure for your function apps. This article provides security strategies for running your function code, and how App Service can help you secure your functions.

+Defender for Cloud integrates with your function app in the portal. It provides, for free, a quick assessment of potential configuration-related security vulnerabilities. Function apps running in a dedicated plan can also use Defender for Cloud's enhanced security features for an extra cost. To learn more, see [Protect your Azure App Service web apps and APIs](../defender-for-cloud/defender-for-app-service-introduction.md).

+### Secure HTTP endpoints

+HTTP endpoints that are exposed publicly provide a vector of attack for malicious actors. When securing your HTTP endpoints, you should use a layered security approach. These techniques can be used to reduce the vulnerability of publicly exposed HTTP endpoints, ordered from most basic to most secure and restrictive:

+When you require HTTPS, you should also require the latest TLS version. To learn how, see [Enforce TLS versions](../app-service/configure-ssl-bindings.md#enforce-tls-versions).

+Functions lets you use keys to make it harder to access your function endpoints. Unless the HTTP access level on an HTTP triggered function is set to `anonymous`, requests must include an access key in the request. For more information, see [Work with access keys in Azure Functions](function-keys-how-to.md).

+While access keys can provide some mitigation for unwanted access, the only way to truly secure your function endpoints is by implementing positive authentication of clients accessing your functions. You can then make authorization decisions based on identity.

+For the highest level of security, you can also secure the entire application architecture inside a virtual network [using private endpoints](#deploy-your-function-app-to-a-virtual-network) or by [running in isolation.](#deploy-your-function-app-in-isolation).

+### Enable App Service Authentication/Authorization

+The App Service platform lets you use Microsoft Entra ID and several third-party identity providers to authenticate clients. You can use this strategy to implement custom authorization rules for your functions, and you can work with user information from your function code. To learn more, see [Authentication and authorization in Azure App Service](../app-service/overview-authentication-authorization.md) and [Working with client identities](functions-bindings-http-webhook-trigger.md#working-with-client-identities).

+### Use Azure API Management (APIM) to authenticate requests

+APIM provides various API security options for incoming requests. To learn more, see [API Management authentication policies](../api-management/api-management-policies.md#authentication-and-authorization). With APIM in place, you can configure your function app to accept requests only from the IP address of your APIM instance. To learn more, see [IP address restrictions](ip-addresses.md#ip-address-restrictions).

+When you're writing code that creates the connection to [Azure services that support Microsoft Entra authentication](../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-azure-ad-authentication), you can choose to use an identity instead of a secret or connection string. Details for both connection methods are covered in the documentation for each service.

+Some Azure Functions binding extensions can be configured to access services using identity-based connections. For more information, see [Configure an identity-based connection](./functions-reference.md#configure-an-identity-based-connection).

+When you create a function app, you must create or link to a general-purpose Azure Storage account that supports Blob, Queue, and Table storage. You can replace this storage account with one that is secured by a virtual network with access enabled by service endpoints or private endpoints. For more information, see [Restrict your storage account to a virtual network](./functions-networking-options.md#restrict-your-storage-account-to-a-virtual-network).

+### Deploy your function app to a virtual network

+Azure App Service Environment provides a dedicated hosting environment in which to run your functions. These environments let you configure a single front-end gateway that you can use to authenticate all incoming requests. For more information, see [Configuring a Web Application Firewall (WAF) for App Service Environment](../app-service/environment/integrate-with-application-gateway.md).

+ 

+1. Blob storage is the default store for function keys, but you can [configure an alternate store](function-keys-how-to.md#manage-key-storage).

+2. Azure Files is set up by default, but you can [create an app without Azure Files](#create-an-app-without-azure-files) under certain conditions.

+You shouldn't apply [lifecycle management policies](../storage/blobs/lifecycle-management-overview.md) to your Blob Storage account used by your function app. Functions uses Blob storage to persist important information, such as [function access keys](function-keys-how-to.md), and policies could remove blobs (such as keys) needed by the Functions host. If you must use policies, exclude containers used by Functions, which are prefixed with `azure-webjobs` or `scm`.

+ 1. [Secure HTTP endpoint](../azure-functions/security-concepts.md#secure-http-endpoints) for the Azure function in production.

+[Create a function access key]: ../azure-functions/function-keys-how-to.md#renew-or-create-access-keys

+A regression in nss-pem package [v1.0.3-5.el7](https://pkgs.org/download/nss-pem) caused a severe performance issue. We've been seeing this issue come up a lot in Redhat/CentOS 7.x distributions. To learn more about this issue, see [1667121 Performance regression in libcurl](https://bugzilla.redhat.com/show_bug.cgi?id=1667121).

+1. Upgrade the nss-pem package to [v1.0.3-5.el7_6.1](https://pkgs.org/download/nss-pem): <br/>

+ Title: Data field differences between MMA and AMA

+description: Documents that field lever data changes made in the migration.

+Customer intent: As an azure administrator, I want to understand which Log Analytics Workspace queries I may need to update after AMA migration.

+# AMA agent data field differences from MMA

+[Azure Monitor Agent (AMA)](./agents-overview.md) replaces the Log Analytics agent, also known as Microsoft Monitor Agent (MMA) and OMS, for Windows and Linux machines, in Azure and non-Azure environments, on-premises and other clouds. The agent introduces a simplified, flexible method of configuring data collection using [Data Collection Rules (DCRs)](../essentials/data-collection-rule-overview.md). The article provides information on the data fields that change when collected by AMA, which is critical information for you to migrate your LAW queries.

+Each of the data changes was carefully considered and the rational for each change is provided in the table. If you encounter a data field that isn't in the tables file a support request. Your help keeping the tables current and complete is appreciated.

+## Log analytics workspace tables

+### W3CIISLog Table for Internet Information Services (IIS)

+This table collects log data from the Internet Information Service on Window systems.

+|LAW Field | Difference | Reason| Additional Information |

+|||||

+| sSiteName | Not be populated | depends on customer data collection configuration | The MMA agent could turn on collection by default, but by principle is restricted from making configuration changes in other services.<p>Enable the `Service Name (s-sitename)` field in W3C logging of IIS. See [Select W3C Fields to Log](/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis#select-w3c-fields-to-log).|

+| Fileuri | No longer populated | not required for MMA parity | MMA doesn't collect this field. This field was only populated for IIS logs collected from Azure Cloud Services through the Azure Diagnostics Extension.|

+## Next steps

+- [Azure Monitor Agent migration helper workbook](./azure-monitor-agent-migration-helper-workbook.md)

+- [DCR Config Generator](./azure-monitor-agent-migration-data-collection-rule-generator.md)

+You can obtain the `Trace ID` and `Span ID` of the currently active Span using following steps.

+builder.Services.AddOpenTelemetry()

+ .UseAzureMonitor()

+ // Configure the ResourceBuilder to add the custom resource attributes to all signals.

+ // Custom resource attributes should be added AFTER AzureMonitor to override the default ResourceDetectors.

+ .ConfigureResource(resourceBuilder => resourceBuilder.AddAttributes(_testResourceAttributes));

+> [!NOTE]

+> Alternatively, you can go to the **Overview** page of a Log Analytics workspace or Application Insights resource and click **View Cost** in the upper right corner of the **Essentials** section. This will launch the **Cost Analysis** from Azure Cost Management + Billing already scoped to the workspace or application. (You might need to use the [preview version](https://preview.portal.azure.com/) of the Azure portal to see this option.)

+This article explains the aggregation of metrics in the time-series database that backs Azure Monitor [platform metrics](../data-platform.md) and [custom metrics](../essentials/metrics-custom-overview.md). The article also applies to standard [Application Insights metrics](../app/app-insights-overview.md).

+This information in this article is complex and is provided for those who want to dig deeper into the metrics system. You do not need to understand it to use Azure Monitor metrics effectively.

+- Set up and manage Gateways on Arc-enabled servers from SCOM Managed Instance portal.

+Capacity pools must be at least 1 TiB and can be increased or decreased in 1-TiB intervals. Capacity pools contain volumes that range in size from a minimum of 100 GiB to a maximum of 100 TiB for regular volumes and up to 1 PiB for [large volumes](azure-netapp-files-understand-storage-hierarchy.md#large-volumes). Volumes are assigned quotas that are subtracted from the capacity poolΓÇÖs provisioned size. For an active volume, capacity consumption against the quota is based on logical (effective) capacity, being active filesystem data or snapshot data. See [How Azure NetApp Files snapshots work](snapshots-introduction.md) for details.

+| 50-1,024 TiB large volumes | Store large volumes of data up to 1,024 TiB in a single volume. | Manage large datasets and high-performance workloads with ease.

+| Maximum size of a single [large volume](large-volumes-requirements-considerations.md) | 1,024 TiB | No |

+| Maximum size of a single large volume on dedicated capacity (preview) | 2,048 TiB | No |

+- Volumes contain a capacity of between 100 GiB and 100 TiB. You can create a [large volume](#large-volumes) with a size of between 50 and 1 PiB.

+Azure NetApp Files allows you to create large volumes up to 1 PiB in size. Large volumes begin at a capacity of 50 TiB and scale up to 1 PiB. Regular Azure NetApp Files volumes are offered between 100 GiB and 102,400 GiB.

+* You must create a large volume at a size of 50 TiB or larger. A single volume can't exceed 1 PiB.

+* Throughput ceilings for the three performance tiers (Standard, Premium, and Ultra) of large volumes are based on the existing 100-TiB maximum capacity targets. You're able to grow to 1 PiB with the throughput ceiling per the following table:

+ <table><thead>

+ <tr>

+ <th></th>

+ <th colspan="2">Capacity</th>

+ <th colspan="2">Linear performance scaling per TiB up to maximum throughput </th>

+ </tr></thead>

+ <tbody>

+ <tr>

+ <td>Capacity tier</td>

+ <td>Minimum volume size<br>(TiB)</td>

+ <td>Maximum volume size (TiB)</td>

+ <td>Minimum throughput (MiB/s)</td>

+ <td>Maximum throughput (MiB/s)</td>

+ </tr>

+ <tr>

+ <td>Standard (16 MiB/s per TiB)</td>

+ <td>50</td>

+ <td>1,024</td>

+ <td>800</td>

+ <td>12,800</td>

+ </tr>

+ <tr>

+ <td>Premium (64 MiB/s per TiB)</td>

+ <td>50</td>

+ <td>1,024</td>

+ <td>3,200</td>

+ <td>12</td>

+ </tr>

+ </tbody>

+ </table>

+ \* 2-PiB large volumes are available on request depending on regional dedicated capacity availability. To request 2-PiB large volumes, contact your account team.

+Once your [regional capacity quota](regional-capacity-quota.md) has increased, you can create volumes that are up to 1 PiB in size. When creating a volume, after you designate the volume quota, you must select **Yes** for the **Large volume** field. Once created, you can manage your large volumes in the same manner as regular volumes.

+With the volume hard quota change, Azure NetApp Files volumes are no longer thinly provisioned at (the maximum) 100 TiB. The volumes will be provisioned at the actual configured size (quota). Also, the underlying capacity pools will no longer automatically grow upon reaching full-capacity consumption. This change will reflect the behavior like Azure managed disks, which are also provisioned as-is, without automatic capacity increase.

+ You aren't able to write more data on the volume beyond this size.

+* Volume quota change: Only changes performance (bandwidth) of the volume. It doesn't change client visible or usable capacity.

+* Capacity pool: Remains 4 TiB in size and doesn't automatically grow.

+This section provides guidance on how to operationalize the change to volume hard quota for a smooth transition. It also provides insights for handling currently provisioned volumes and capacity pools, ongoing monitoring, and alerting and capacity management options.

+ There's no additional charge for volume-level capacity increase if the underlaying capacity pool doesn't need to be grown. As an effect of this change, you might observe a bandwidth limit *increase* for the volume (in case the [auto QoS capacity pool type](azure-netapp-files-understand-storage-hierarchy.md#qos_types) is used).

+ After the volume sizes adjustments, if the sum of volumes sizes becomes larger than the size of the hosting capacity pool, the capacity pool has to be increased to a size equal to or larger than the sum of the volumes, with a maximum of 500 TiB. For information about limits, see [Azure NetApp Files resource limits](azure-netapp-files-resource-limits.md#resource-limits)). Additional capacity pool capacity is subject to ACR charge as normal.

+* When an Azure NetApp Files capacity pool or volume is resized, ANFCapacityManager modifies the metric alert rule based on the specified percent capacity consumed threshold. If the alert rule doesn't exist, it's created.

+* When an Azure NetApp Files capacity pool or volume is deleted, the corresponding metric alert rule it's deleted.

+1. From your NetApp Account, select **Volumes**.

+In some cases, the hosting capacity pool doesn't have sufficient capacity to resize the volumes. However, you can [change the capacity pool size](azure-netapp-files-resize-capacity-pools-or-volumes.md#resizing-the-capacity-pool-or-a-volume-using-azure-cli) in 1-TiB increments or decrements. The capacity pool size can't be smaller than 4 TiB. *Resizing the capacity pool changes the purchased Azure NetApp Files capacity.*

+The hard volume quota isn't enforced on replication destination volumes.

+[The ANFCapacityManager logic app is provided as-is and isn't supported by NetApp or Microsoft](https://github.com/ANFTechTeam/ANFCapacityManager#disclaimer). You're encouraged to modify to fit your specific environment or requirements. You should test the functionality before deploying it to any business critical or production environments.

+* [Azure NetApp Files large volume enhancement:](large-volumes-requirements-considerations.md) increased throughput and maximum size limit of 2-PiB volume (preview)

+ Azure NetApp Files large volumes now support increased maximum throughput and size limits. This update brings an increased size limit to **one PiB,** available via Azure Feature Exposure Control (AFEC), allowing for more extensive and robust data management solutions for various workloads, including HPC, EDA, VDI, and more.

+

+ This update also introduces a preview of a large volume type, starting from **one PiB** up to **two PiB**, available upon request. This **2-PiB** enhancement is subject to regional availability and capacity, ensuring that Azure NetApp Files can meet your specific needs and requirements. This feature is currently in preview. To take advantage of the 2-PiB large volume feature, contact your account team.

+

+ Regular Azure NetApp Files volumes are limited to 100 TiB in size. Azure NetApp Files [large volumes](azure-netapp-files-understand-storage-hierarchy.md#large-volumes) break this barrier by enabling volumes of 100 TiB to 1 PiB in size. The large volumes capability enables various use cases and workloads that require large volumes with a single directory namespace.

+The **Menu behavior** section lets you choose how the [Azure portal menu](azure-portal-overview.md#portal-menu) appears.

+When defining a [module](./modules.md), regardless of the types of the referenced file - whether it's a local file, module registry file, template spec, you can open the referenced file by selecting or highlighting the module path and then press **[F12]**. If the referenced file is an [Azure Verified Modules(AVM)](https://aka.ms/avm), you can toggle between compiled JSON or Bicep file. To be able to open the Bicep file of a private registry module, ensure that the module is published to the registry with the `WithSource` switch enabled. For more information, see [Publish files to registry](./private-module-registry.md#publish-files-to-registry). The Visual Studio Code Bicep extension version 0.27.1 or newer is required for opening Bicep file from private module registry.

+## Troubleshoot

+The `Problems` pane summarizes the errors and warning in your Bicep file.

+For the list of error/warning codes, see [Bicep error/warning codes](./bicep-error-codes.md).

+

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows the page for access control and selections for adding a role assignment.":::

+`WebPubSubTrigger` is used when you need to handle requests from service side. The trigger endpoint pattern would be like below which should be set in Web PubSub service side (Portal: settings -> event handler -> URL Template). In the endpoint pattern, the query part `code=<API_KEY>` is **REQUIRED** when you're using Azure Function App for [security](../azure-functions/function-keys-how-to.md#understand-keys) reasons. The key can be found in **Azure portal**. Find your function app resource and navigate to **Functions** -> **App keys** -> **System keys** -> **webpubsub_extension** after you deploy the function app to Azure. Though, this key isn't needed when you're working with local functions.

+Use the Get Access Token API to authorize your request to access replicated restore points in the secondary region:

+| **Proxy server/firewall is blocking registration** <br/>Or <br/>**No internet connectivity** <br/><br/> If your machine has limited internet access, and you don't ensure the firewall, proxy, and network settings allow access to the FQDNS and public IP addresses, the registration will fail.| Follow these steps:<br/> <br><br>- Work with your IT team to ensure the system has internet connectivity.<br>- If you don't have a proxy server, ensure the proxy option isn't selected when you register the agent. [Check your proxy settings](#verifying-proxy-settings-for-windows).<br>- If you do have a firewall/proxy server, work with your networking team to allow access to the following FQDNs and public IP addresses. Access to all of the URLs and IP addresses listed below uses the HTTPS protocol on port 443.<br/> <br> **URLs**<br> `*.microsoft.com` <br> `*.windowsazure.com` <br> `*.microsoftonline.com` <br> `*.windows.net` <br> `*blob.core.windows.net` <br> `*queue.core.windows.net` <br> `*blob.storage.azure.net`<br><br><br>- If you're a US Government customer, ensure that you have access to the following URLs:<br><br> `www.msftncsi.com` <br> `*.microsoft.com` <br> `*.windowsazure.us` <br> `*.microsoftonline.us` <br> `*.windows.net` <br> `*.usgovcloudapi.net` <br> `*blob.core.windows.net` <br> `*queue.core.windows.net` <br> `*blob.storage.azure.net` <br><br> Try registering again after you complete the preceding troubleshooting steps.<br></br> If your connection is via Azure ExpressRoute, make sure the settings are configured as described in Azure [ExpressRoute support](../backup/backup-support-matrix-mars-agent.md#azure-expressroute-support). <br/> <br/> If you are using the [Entra Tenant Restrictions](https://learn.microsoft.com/entra/identity/enterprise-apps/tenant-restrictions) feature with your proxy, ensure that the tenant id of Recovery Services Vault used to register the MARS agent is added to the list of allowed tenants in the `Restrict-Access-To-Tenants` header. This tenant id is unique per Azure region. You can find the tenant id by opening the vault credential file and locating the `<AadTenantId>` element.|

+>- Backup an Azure VM with disks that have public network access disabled is now supported and generally available.

+### Folder is missing when a Linux VM is recovered as a new VM

+This issue can occur if disks are mounted to a directory using the device name (e.g., /dev/sdc1) instead of UUID. When the VM reboots or when it is recovered as a new VM, the device names are assigned in a random order. To ensure that the right drive is mounted to your directory, always mount drives using UUID obtained from the `blkid` utility. [Learn more](../virtual-machines/linux/attach-disk-portal.yml).

+* [Change the allocation method for a private IP address assigned to a network interface](../virtual-network/ip-services/virtual-networks-static-private-ip-arm-ps.md)

+1. Use the Get Access Token API to get an access token to enable communication between the Azure Backup services.

+Error Message: Operation failed as the file share isn't found

+### AFSMaxSnapshotReached- You have reached the max limit of snapshots for this file share; you'll be able to take more once the older ones expire

+Error Message: You have reached the max limit of snapshots for this file share; you'll be able to take more once the older ones expire.

+NC2 on Azure implements a shared responsibility model that defines distinct roles and responsibilities of the three parties involved in the offering: the Customer, Microsoft and Nutanix.

+On-premises Nutanix environments require the Nutanix customer to support all the hardware and software for running the platform. For NC2 on Azure, Microsoft maintains the hardware for the customer.

+Microsoft continuously monitors the health of the underlay and BareMetal infrastructure. If Microsoft detects a failure, it takes action to repair the failed services.

+1. Run the following commands in an [Azure Cloud Shell](../cloud-shell/overview.md) window where you have the active subscription set to be the subscription where your AKS cluster is deployed. Replace `MyManagedCluster` and `MyResourceGroup` with the name of your cluster and resource group.

+ az aks get-credentials --admin --name MyManagedCluster --resource-group MyResourceGroup

+[5008263]: https://support.microsoft.com/topic/december-14-2021-kb5008263-monthly-rollup-513a39f5-b624-4214-b2be-b93f5a775e12

+ Title: Download WhatsApp message media

+description: In this quickstart, you learn how to download the media received in a WhatsApp message with Azure Communication Services Messages.

+# Quickstart: Download WhatsApp message media

+Azure Communication Services enables you to send and receive WhatsApp messages. In this quickstart, you learn how to download the media payload received in a WhatsApp message.

+Use case: A business receives a WhatsApp message from their customer that contains an image. The business needs to download the image from WhatsApp in order to view the image.

+## Next steps

+In this quickstart, you tried out the Advanced Messaging for WhatsApp SDK. Next you might also want to see the following articles:

+- [Send WhatsApp Messages using Advanced Messages](../../../quickstarts/advanced-messaging/whatsapp/get-started.md)

+- [Handle Advanced Messaging Events](./handle-advanced-messaging-events.md)

+- [Send WhatsApp Template Messages](../../../concepts/advanced-messaging/whatsapp/template-messages.md)

+# Quickstart: Send WhatsApp messages using Advanced Messages

+- [Handle Advanced Messaging events](./handle-advanced-messaging-events.md)

+- [Send WhatsApp template messages](../../../concepts/advanced-messaging/whatsapp/template-messages.md)

+ 

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-page.png" alt-text="Screenshot that shows Add role assignment page in Azure portal.":::

+ Title: Monitor metrics in Azure Cosmos DB for MongoDB (vCore)

+description: Discover how to monitor memory or CPU usage for operations in Azure Cosmos DB. Account owners can identify resource-intensive operations.

+# Explore Azure Monitor in vCore-based Azure Cosmos DB for MongoDB (vCore)

+Azure Monitor for vCore-based Azure Cosmos DB for MongoDB provides a metrics view to monitor your account and create dashboards. The Azure Cosmos DB metrics are collected by default, however this feature is only accessible to M40 and above cluster tiers. The **CPU percent** metric is used to get the consumption for different types of operations. Later you can analyze which operations used most of the committed memory. By default, the consumption data is aggregated at five-minute interval. However, you can change the aggregation unit by changing the time granularity option.

+## Introduction

+Before you begin, you should understand how information is presented and visualized.

+It delivers:

+* **At-scale perspective** of your Azure Cosmos DB for MongoDB (vCore) resources across all your subscriptions in a single location. You can selectively scope to only the subscriptions and resources that you're interested in evaluating.

+* **Drill-down analysis** of a particular Azure Cosmos DB for MongoDB (vCore) resource. You can diagnose issues or perform detailed analysis by using the categories of utilization, failures, capacity, and operations. Selecting any one of the options provides an in-depth view of the relevant Azure Cosmos DB for MongoDB (vCore) metrics.

+* **Customizable** experience built on top of Azure Monitor workbook templates. You can change what metrics are displayed, modify or set thresholds that align with your limits, and then save into a custom workbook. Charts in the workbooks can then be pinned to Azure dashboards.

+## Metrics available today

+### System Metrics (available on all cluster tiers)

+- **Committed memory percent**: Shows the percentage of the committed memory limit that is allocated by applications on a shard. This metric helps in monitoring the memory usage against the allocated limit.

+- **CPU percent**: Indicates the CPU utilization on a shard.

+ - **High CPU Utilization**: If you notice a spike in CPU utilization on average, the best option to maximize performance is to increase the cluster tier. After increasing the tier, monitor the usage to see if it stabilizes.

+ - **Low CPU Utilization**: Conversely, if the CPU utilization is consistently low, it is recommended to scale down to a lower cluster tier to save on cost.

+- **Memory percent**: Shows the memory utilization on a shard. For read-heavy workloads, consider using cluster tiers with more RAM to optimize performance and ensure smoother operations.

+- **Storage percent:** Displays the available storage percentage on a shard.

+- **Storage used**: Represents the actual amount of storage used on a shard. This metric is crucial for understanding the storage consumption trends and managing storage resources.

+ - **Monitoring and Management**: If storage utilization increases above 80%, users should monitor this more closely. It is recommended to increase the SKU size of the disk to manage storage more effectively.

+ - **Performance Optimization**: If write performance is not at the desired level, particularly when running at scale, increasing the disk size can enhance write performance.

+- **IOPS:** Measures the disk IO operations per second on a shard. It provides insights into the read and write performance of the storage system, helping to optimize disk usage.

+ - **Write Heavy Workloads**: IOPS is particularly important for write-heavy workloads, especially when operating at scale. If write performance needs to be improved, it is recommended to upgrade the storage disk SKU size rather than increasing the cluster tier.

+### Database metrics

+- **Mongo request duration**: Captures the end-to-end duration in milliseconds of client MongoDB requests handled by the Mongo cluster, updated every 60 seconds. This metric is vital for assessing the responsiveness and latency of the database operations.

+>[!NOTE]

+>There's no charge to access Database metrics. However, you'll have to be on the M40 cluster tier or higher to access the metrics. For more information on upgrading, please refer to [this guide](./how-to-scale-cluster.md).

+## View metrics

+1. Sign in to the [Azure portal](https://portal.azure.com).

+2. Navigate to the existing Azure Cosmos DB for MongoDB vCore cluster page.

+3. From the Azure Cosmos DB for MongoDB vCore cluster page, select the **Metrics** navigation menu option.

+ :::image type="content" source="./media/monitor/monitor-metrics-blade.png" alt-text="Screenshot of metrics blade in Azure Cosmos DB.":::

+1. Next select the **Monogo request duration** metric from the list of available metrics. In this example, let's select **Mongo request duration** and **Avg** as the aggregation value. In addition to these details, you can also select the **Time range** and **Time granularity** of the metrics. At max, you can view metrics for the past 30 days. After you apply the filter, a chart is displayed based on your filter. You can see the average number of request units consumed per minute for the selected period.

+ :::image type="content" source="./media/monitor/monitor-metric-mongo-request-duration.png" alt-text="Screenshot of choosing a metric from the Azure portal." border="true":::

+## Filters for database metrics

+- You can also filter metrics and get the charts displayed by a specific **CollectionName**, **DatabaseName**, **Operation**, and **StatusCode**. The **Add filter** and **Apply splitting** options allows you to filter the usage and group the metrics.

+- If you want to see the usage by collection, select **Apply splitting** and choose the collection name as a filter. You will see a chart like the following with a choice of collections within the dashboard. You can then select a specific collection name to view more details:

+ :::image type="content" source="./media/monitor/monitor-metrics-filtering.png" alt-text="Azure Cosmos DB memory request duration for all operations by the collection in Azure monitor" border="true":::

+## Next steps

+* Configure [metric alerts](../../../azure-monitor/alerts/alerts-metric.md) to set up automated alerting to aid in detecting issues.

+* [Migrate your data](./migration-options.md) to vCore-based Azure Cosmos DB for MongoDB

+ Title: Optimize Retrieval-Augmented Generation (RAG) with Azure Cosmos DB for MongoDB (vCore), LangChain, and OpenAI

+description: Learn how to enhance AI-based applications using Retrieval-Augmented Generation (RAG) with Azure Cosmos DB for MongoDB (vCore), LangChain, and OpenAI. Discover key concepts, architecture, and real-world applications.

+# RAG with vCore-based Azure Cosmos DB for MongoDB

+In the fast-evolving realm of generative AI, Large Language Models (LLMs) like GPT-3.5 have transformed natural language processing. However, an emerging trend in AI is the use of vector stores, which play a pivotal role in enhancing AI applications.

+This tutorial explores how to use Azure Cosmos DB for MongoDB (vCore), LangChain, and OpenAI to implement Retrieval-Augmented Generation (RAG) for superior AI performance alongside discussing LLMs and their limitations. We explore the rapidly adopted paradigm of "retrieval-augmented generation" (RAG), and briefly discuss the LangChain framework, Azure OpenAI models. Finally, we integrate these concepts into a real-world application. By the end, readers will have a solid understanding of these concepts.

+## Understand Large Language Models (LLMs) and their limitations

+Large Language Models (LLMs) are advanced deep neural network models trained on extensive text datasets, enabling them to understand and generate human-like text. While revolutionary in natural language processing, LLMs have inherent limitations:

+- **Hallucinations**: LLMs sometimes generate factually incorrect or ungrounded information, known as "hallucinations."

+- **Stale Data**: LLMs are trained on static datasets that might not include the most recent information, limiting their current relevance.

+- **No Access to UserΓÇÖs Local Data**: LLMs don't have direct access to personal or localized data, restricting their ability to provide personalized responses.

+- **Token Limits**: LLMs have a maximum token limit per interaction, constraining the amount of text they can process at once. For example, OpenAIΓÇÖs gpt-3.5-turbo has a token limit of 4096.

+## Leverage Retrieval-Augmented Generation (RAG)

+Retrieval-augmented generation (RAG) is an architecture designed to overcome LLM limitations. RAG uses vector search to retrieve relevant documents based on an input query, providing these documents as context to the LLM for generating more accurate responses. Instead of relying solely on pretrained patterns, RAG enhances responses by incorporating up-to-date, relevant information. This approach helps to:

+- **Minimize Hallucinations**: Grounding responses in factual information.

+- **Ensure Current Information**: Retrieving the most recent data to ensure up-to-date responses.

+- **Utilize External Databases**: Though it doesn't grant direct access to personal data, RAG allows integration with external, user-specific knowledge bases.

+- **Optimize Token Usage**: By focusing on the most relevant documents, RAG makes token usage more efficient.

+This tutorial demonstrates how RAG can be implemented using Azure Cosmos DB for MongoDB (vCore) to build a question-answering application tailored to your data.

+## Application architecture overview

+The architecture diagram below illustrates the key components of our RAG implementation:

+

+## Key components and frameworks

+We'll now discuss the various frameworks, models, and components used in this tutorial, emphasizing their roles and nuances.

+### Azure Cosmos DB for MongoDB (vCore)

+Azure Cosmos DB for MongoDB (vCore) supports semantic similarity searches, essential for AI-powered applications. It allows data in various formats to be represented as vector embeddings, which can be stored alongside source data and metadata. Using an approximate nearest neighbors algorithm, like Hierarchical navigable small world (HNSW), these embeddings can be queried for fast semantic similarity searches.

+### LangChain framework

+LangChain simplifies the creation of LLM applications by providing a standard interface for chains, multiple tool integrations, and end-to-end chains for common tasks. It enables AI developers to build LLM applications that leverage external data sources.

+Key aspects of LangChain:

+- **Chains**: Sequences of components solving specific tasks.

+- **Components**: Modules like LLM wrappers, vector store wrappers, prompt templates, data loaders, text splitters, and retrievers.

+- **Modularity**: Simplifies development, debugging, and maintenance.

+- **Popularity**: An open-source project rapidly gaining adoption and evolving to meet user needs.

+### Azure App Services interface

+App services provide a robust platform for building user-friendly web interfaces for Gen-AI applications. This tutorial uses Azure App services to create an interactive web interface for the application.

+### OpenAI models

+OpenAI is a leader in AI research, providing various models for language generation, text vectorization, image creation, and audio-to-text conversion. For this tutorial, we'll use OpenAIΓÇÖs embedding and language models, crucial for understanding and generating language-based applications.

+### Embedding models vs. Language generation models

+| | **Text Embedding Model** | **Language Model** |

+||-||

+| **Purpose** | Converting text into vector embeddings. | Understanding and generating natural language. |

+| **Function** | Transforms textual data into high-dimensional arrays of numbers, capturing the semantic meaning of the text. | Comprehends and produces human-like text based on given input. |

+| **Output** | Array of numbers (vector embeddings). | Text, answers, translations, code, etc. |

+| **Example Output** | Each embedding represents the semantic meaning of the text in numerical form, with a dimensionality determined by the model. For example, `text-embedding-ada-002` generates vectors with 1536 dimensions. | Contextually relevant and coherent text generated based on the input provided. For example, `gpt-3.5-turbo` can generate responses to questions, translate text, write code, and more. |

+| **Typical Use Cases** | - Semantic search | - Chatbots |

+| | - Recommendation systems | - Automated content creation |

+| | - Clustering and classification of text data | - Language translation |

+| | - Information retrieval | - Summarization |

+| **Data Representation** | Numerical representation (embeddings) | Natural language text |

+| **Dimensionality** | The length of the array corresponds to the number of dimensions in the embedding space, for example, 1536 dimensions. | Typically represented as a sequence of tokens, with the context determining the length. |

+### Main components of the application

+- **Azure Cosmos DB for MongoDB vCore**: Storing and querying vector embeddings.

+- **LangChain**: Constructing the applicationΓÇÖs LLM workflow. Utilizes tools such as:

+ - **Document Loader**: For loading and processing documents from a directory.

+ - **Vector Store Integration**: For storing and querying vector embeddings in Azure Cosmos DB.

+ - **AzureCosmosDBVectorSearch**: Wrapper around Cosmos DB Vector search

+- **Azure App Services**: Building the user interface for Cosmic Food app.

+- **Azure OpenAI**: For providing LLM and embedding models, including:

+ - **text-embedding-ada-002**: A text embedding model that converts text into vector embeddings with 1536 dimensions.

+ - **gpt-3.5-turbo**: A language model for understanding and generating natural language.

+### Set up the environment

+To get started with optimizing retrieval-augmented generation (RAG) using Azure Cosmos DB for MongoDB (vCore), follow these steps:

+- **Create the following resources on Microsoft Azure:**

+ - **Azure Cosmos DB for MongoDB vCore cluster**: See the [Quick Start guide here](https://aka.ms/tryvcore).

+ - **Azure OpenAI resource with:**

+ - **Embedding model deployment** (for example, `text-embedding-ada-002`).

+ - **Chat model deployment** (for example, `gpt-35-turbo`).

+### Sample documents

+In this tutorial, we will be loading a single text file using [Document](https://python.langchain.com/v0.1/docs/modules/data_connection/document_loaders/). These files should be saved in a directory named **data** in the **src** folder. The contents of the are as follows:

+```food_items.json

+ {

+ "category": "Cold Dishes",

+ "name": "Hamachi Fig",

+ "description": "Hamachi sashimi lightly tossed in a fig sauce with rum raisins, and serrano peppers then topped with fried lotus root.",

+ "price": "16.0 USD"

+ },

+```

+### Load documents

+1. Set the Cosmos DB for MongoDB (vCore) connection string, Database Name, Collection Name, and Index:

+```python

+mongo_client = MongoClient(mongo_connection_string)

+database_name = "Contoso"

+db = mongo_client[database_name]

+collection_name = "ContosoCollection"

+index_name = "ContosoIndex"

+collection = db[collection_name]

+```

+2. Initialize the Embedding Client.

+```python

+from langchain_openai import AzureOpenAIEmbeddings

+openai_embeddings_model = os.getenv("AZURE_OPENAI_EMBEDDINGS_MODEL_NAME", "text-embedding-ada-002")

+openai_embeddings_deployment = os.getenv("AZURE_OPENAI_EMBEDDINGS_DEPLOYMENT_NAME", "text-embedding")

+azure_openai_embeddings: AzureOpenAIEmbeddings = AzureOpenAIEmbeddings(

+ model=openai_embeddings_model,

+ azure_deployment=openai_embeddings_deployment,

+)

+```

+3. Create embeddings from the data, save to the database and return a connection to your vector store, Cosmos DB for MongoDB (vCore).

+```python

+vector_store: AzureCosmosDBVectorSearch = AzureCosmosDBVectorSearch.from_documents(

+ json_data,

+ azure_openai_embeddings,

+ collection=collection,

+ index_name=index_name,

+)

+```

+4. Create the following [HNSW vector Index](./vector-search.md) on the collection (Note the name of the index is same as above).

+```python

+num_lists = 100

+dimensions = 1536

+similarity_algorithm = CosmosDBSimilarityType.COS

+kind = CosmosDBVectorSearchType.VECTOR_HNSW

+m = 16

+ef_construction = 64

+vector_store.create_index(

+ num_lists, dimensions, similarity_algorithm, kind, m, ef_construction

+)

+```

+### Perform Vector search using Cosmos DB for MongoDB (vCore)

+1. Connect to your vector store.

+```python

+vector_store: AzureCosmosDBVectorSearch = AzureCosmosDBVectorSearch.from_connection_string(

+ connection_string=mongo_connection_string,

+ namespace=f"{database_name}.{collection_name}",

+ embedding=azure_openai_embeddings,

+)

+```

+2. Define a function that performs semantic similarity search using Cosmos DB Vector Search on a query (note this code snippet is just a test function).

+```python

+query = "beef dishes"

+docs = vector_store.similarity_search(query)

+print(docs[0].page_content)

+```

+3. Initialize the Chat Client to implement a RAG function.

+```python

+azure_openai_chat: AzureChatOpenAI = AzureChatOpenAI(

+ model=openai_chat_model,

+ azure_deployment=openai_chat_deployment,

+)

+```

+4. Create a RAG function.

+```python

+history_prompt = ChatPromptTemplate.from_messages(

+ [

+ MessagesPlaceholder(variable_name="chat_history"),

+ ("user", "{input}"),

+ (

+ "user",

+ """Given the above conversation,

+ generate a search query to look up to get information relevant to the conversation""",

+ ),

+ ]

+)

+context_prompt = ChatPromptTemplate.from_messages(

+ [

+ ("system", "Answer the user's questions based on the below context:\n\n{context}"),

+ MessagesPlaceholder(variable_name="chat_history"),

+ ("user", "{input}"),

+ ]

+)

+```

+5. Converts the vector store into a retriever, which can search for relevant documents based on specified parameters.

+```python

+vector_store_retriever = vector_store.as_retriever(

+ search_type=search_type, search_kwargs={"k": limit, "score_threshold": score_threshold}

+)

+```

+6. Create a retriever chain that is aware of the conversation history, ensuring contextually relevant document retrieval using the **azure_openai_chat** model and **vector_store_retriever**.

+```python

+retriever_chain = create_history_aware_retriever(azure_openai_chat, vector_store_retriever, history_prompt)

+```

+7. Create a chain that combines retrieved documents into a coherent response using the language model (**azure_openai_chat**) and a specified prompt (**context_prompt**).

+```python

+context_chain = create_stuff_documents_chain(llm=azure_openai_chat, prompt=context_prompt)

+```

+8. Create a chain that handles the entire retrieval process, integrating the history-aware retriever chain and the document combination chain. This RAG chain can be executed to retrieve and generate contextually accurate responses.

+```python

+rag_chain: Runnable = create_retrieval_chain(

+ retriever=retriever_chain,

+ combine_docs_chain=context_chain,

+)

+```

+### Sample outputs

+The screenshot below illustrates the outputs for various questions. A purely semantic-similarity search returns the raw text from the source documents, while the question-answering app using the RAG architecture generates precise and personalized answers by combining retrieved document contents with the language model.

+

+### Conclusion

+In this tutorial, we explored how to build a question-answering app that interacts with your private data using Cosmos DB as a vector store. By leveraging the retrieval-augmented generation (RAG) architecture with LangChain and Azure OpenAI, we demonstrated how vector stores are essential for LLM applications.

+RAG is a significant advancement in AI, particularly in natural language processing, and combining these technologies allows for the creation of powerful AI-driven applications for various use cases.

+## Next steps

+For a detailed, hands-on experience and to see how RAG can be implemented using Azure Cosmos DB for MongoDB (vCore), LangChain, and OpenAI models, visit our GitHub repository.

+> [!div class="nextstepaction"]

+> [Check out RAG sample on GitHub](https://github.com/Azure-Samples/Cosmic-Food-RAG-app)

+* [Custom filters](https://hbase.apache.org/apidocs/org/apache/hadoop/hbase/filter/package-summary.html)

+ 

+- Only the accounts specified in the request are transferred. If all accounts are chosen, then they all get transferred.

+- A current enrollment's prepayment term ends.

+- Usage transferred might take up to 72 hours to be reflected in the new enrollment.

+- Prices for the new enrollment might take at least 72 hours to be reflected in the Price sheet download and the Azure Pricing calculator.

+- If the old enrollment that you're transferring from has any reservation purchases, the historic (past) reservation purchasing fee remains in the old source enrollment. All future purchasing fees transfer to the new enrollment. Additionally, all reservation benefits are transferred across for use in the new enrollment.

+- The historic marketplace one-time purchase fee and any monthly fixed fees already incurred on the old enrollment aren't transferred to the new enrollment. Consumption-based marketplace charges are transferred.

+- Usage might take up to 24 - 48 hours to be reflected in the target enrollment.

+- Exports, views, budget alerts, and scheduled actions - The existing rules at billing scopes (billing account, enrollment account, and department scopes) need to be recreated after the enrollment transfer. All rules at management group, subscription, and resource group scopes get transferred to the new enrollment and no further action is required.

+- Reservation utilization alert and cost allocation rules - These features are supported only at billing account scope. They need to get recreated after the enrollment transfer.

+- Anomaly alerts - This feature is supported at the subscription scope. They get transferred to the new enrollment requiring no further action.

+- If there's a backdated enrollment transfer, any reservation or savings plan benefit is applicable from the transfer request submission date - not from the effective transfer date.

+| function key | Access key for the Azure Function. Click on the **Manage** section for the respective function, and copy either the **Function Key** or the **Host key**. Find out more here: [Work with access keys](../azure-functions/function-keys-how-to.md) | yes |

+| Function key | Access key for the Azure Function. Click on the **Manage** section for the respective function, and copy either the **Function Key** or the **Host key**. Find out more here: [Work with access keys](../azure-functions/function-keys-how-to.md) | Yes |

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-page.png" alt-text="Screenshot that shows the page for adding a role assignment in the Azure portal.":::

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::

+ :::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::

+Microsoft uses two shipping partners to return Data Box Disk devices to Azure Data Centers. Canada and US Government orders are returned by UPS; United States public cloud orders are serviced by FedEx.

+#### [United States - FedEx](#tab/fedex)

+Take the following steps if you are a US Public Cloud customer returning a Data Box Disk device in the US or Canada.

+1. Use the return shipping label that has the clear plastic sleeve affixed to the box. If the label is damaged or lost:

+ - Go to **Overview > Download shipping label** and download a return ship label.

+ - Affix the label on the device.

+1. Seal the shipping box and ensure that the return shipping label is visible.

+1. Schedule a pickup with FedEx. To schedule a pickup:

+ - Call the local FedEx number: 800-Go-FedEx.

+ - Provide the reverse shipment tracking number as shown on your printed label.

+ - Contact [Azure Data Box Operations](mailto:adbops@microsoft.com) if you encounter any issues while scheduling a pickup.

+You can also drop your Data Box Disk at your nearest FedEx drop-off location.

+#### [US Government and Canada - UPS](#tab/ups)

+

+ Title: 'Tutorial: Configure Azure DDoS Protection metric alerts through portal'

+# Tutorial: Configure Azure DDoS Protection metric alerts through portal

+DDoS Protection metrics alerts are an important step in alerting your team through Azure portal, email, SMS message, push, or voice notification when an attack is detected.

+- DDoS Protection monitors public IP addresses assigned to resources within a virtual network. If you don't have any resources with public IP addresses in the virtual network, you must first create a resource with a public IP address.  

+ :::image type="content" source="./media/ddos-alerts/ddos-protection-alert-page.png" alt-text="Screenshot of DDoS Protection creating Alerts." lightbox="./media/ddos-alerts/ddos-protection-alert-page.png":::

+1. On the **Condition** page, select **+ Add Condition**, then in the *Search by signal name* search box, search, and select **Under DDoS attack or not**.

+1. In the **Create an alert rule** page, select the following information.

+ :::image type="content" source="./media/ddos-alerts/ddos-protection-alert-signal.png" alt-text="Screenshot of adding DDoS Protection attack alert signal." lightbox="./media/ddos-alerts/ddos-protection-alert-signal.png":::

+ | Threshold | Leave as the default *Static*. |

+ | Aggregation type | Leave as default *Maximum*. |

+ | Unit | Leave as default *Count*. |

+ | Check every | Choose how often the alert rule will check if the condition is met. Leave as default *1 minute*. |

+ | Lookback period | This is the lookback period, or the time period to look back at each time the data is checked. For example, every 1 minute youΓÇÖll be looking at the past 5 minutes. Leave as default *5 minutes*. |

+ :::image type="content" source="./media/ddos-alerts/ddos-protection-alert-action-group-basics.png" alt-text="Screenshot of adding DDoS Protection attack alert action group basics." lightbox="./media/ddos-alerts/ddos-protection-alert-action-group-basics.png":::

+ | Region | Choose these locations for the broadest set of Azure products and long-term capacity growth. |

+ | Action Group | Provide an action group name that is unique within the resource group. For this example, enter **myDDoSAlertsActionGroup**. |

+ | Display name | This display name will be shown as the action group name in email and SMS notifications. For this example, enter **myDDoSAlerts**. |

+1. On the *Notifications* tab, under *Notification type*, select the notification type you wish to use. For this example, we select **Email/SMS message/Push/Voice**. In the *Name* tab, enter **myUnderAttackEmailAlert**.

+> [!NOTE]

+> Review the [Action groups](../azure-monitor/alerts/action-groups.md) documentation for more information on creating action groups.

+ :::image type="content" source="./media/ddos-alerts/ddos-protection-alert-rule.png" alt-text="Screenshot of Alerts page within Azure for DDoS Protection." lightbox="./media/ddos-alerts/ddos-protection-alert-rule.png":::

+ :::image type="content" source="./media/ddos-alerts/ddos-protection-delete-alert-rules.png" alt-text="Screenshot of Alert rules page within Azure for DDoS Protection." lightbox="./media/ddos-alerts/ddos-protection-delete-alert-rules.png":::

+ Title: 'Tutorial: Configure Azure DDoS Protection Log Analytics workspace'

+# Tutorial: Configure Azure DDoS Protection Log Analytics workspace

+In order to use diagnostic logging, you'll first need a Log Analytics workspace with diagnostic settings enabled.

+ :::image type="content" source="./media/ddos-log-analytics-workspace/ddos-protection-diagnostic-settings.png" alt-text="Screenshot of log analytics workspace diagnostic setting.":::

+ Title: 'Tutorial: Configure Azure DDoS Protection diagnostic logging alerts'

+# Tutorial: Configure Azure DDoS Protection diagnostic logging alerts

+DDoS Protection diagnostic logging alerts provide visibility into DDoS attacks and mitigation actions. You can configure alerts for all DDoS protected public IP addresses that you have enabled diagnostic logging on.

+- DDoS Protection monitors public IP addresses assigned to resources within a virtual network. If you don't have any resources with public IP addresses in the virtual network, you must first create a resource with a public IP address.

+With these templates, you are able to configure alerts for all public IP addresses that you have enabled diagnostic logging on.

+The Azure Monitor alert rule template runs a query against the diagnostic logs to detect when an active DDoS mitigation is occurring. The alert indicates a potential attack. Action groups can be used to invoke actions as a result of the alert.

+ | Workspace Name | Enter your workspace name. In this example, the *Workspace name* is **myLogAnalyticsWorkspace**. |

+ | Workspace Name | Enter your workspace name. In this example, the *Workspace name* is **myLogAnalyticsWorkspace**. |

+Let's assume you have only one subscription in your tenant. If you create a Network Protection plan, the plan includes protection for 100 IP address. That subscription is billed for $2,944 USD per month (29.5 USD x 100 resources). To learn more about different scenarios within DDoS Network Protection, see [Pricing examples](https://azure.microsoft.com/pricing/details/ddos-protection/#pricing).

+Let's take this same scenario and assume you have 10 Public IP addresses. If you enable IP Protection for each Public IP address, you're billed for $1,990 USD per month (199 USD x 10 resources).

+- Ensure packets conform to internet specifications and aren't malformed.

+Azure DDoS Protection drops attack traffic and forwards the remaining traffic to its intended destination. Within a few minutes of attack detection, you're notified using Azure Monitor metrics. By configuring logging on DDoS Protection telemetry, you can write the logs to available options for future analysis. Metric data in Azure Monitor for DDoS Protection is retained for 30 days.

+> [!NOTE]

+> At no additional cost, Azure DDoS infrastructure protection protects every Azure service that uses public IPv4 and IPv6 addresses. This DDoS protection service helps to protect all Azure services, including platform as a service (PaaS) services such as Azure DNS. For more information on supported PaaS services, see [DDoS Protection reference architectures](ddos-protection-reference-architectures.md). Azure DDoS infrastructure protection requires no user configuration or application changes. Azure provides continuous protection against DDoS attacks. DDoS protection does not store customer data.

+- PaaS services (multi-tenant), which includes Azure App Service Environment for Power Apps, Azure API Management in deployment modes other than APIM with virtual network integration (For more information, see https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-ddos-standard-protection-now-supports-apim-in-vnet/ba-p/3641671), and Azure Virtual WAN aren't currently supported.

+> [!NOTE]

+> Scenarios in which a single VM is running behind a public IP is supported, but not recommended. For more information, see [Fundamental best practices](./fundamental-best-practices.md#design-for-scalability).

+Azure DDoS Network Protection customers have access to the DDoS Rapid Response (DRR) team, who can help with attack investigation during an attack and post-attack analysis. For more information, including when you should engage the DRR team, see [DDoS Rapid Response](ddos-rapid-response.md). Azure DDoS IP Protection customers should create a request to connect with Microsoft support. To learn more, see [Create a support request](../azure-portal/supportability/how-to-create-azure-support-request.md).

+1. In the **Settings** page, select the **Protected Resources** tab, then select the **Dissociate** icon next to the virtual network that contains the resources you're protecting. When prompted, select **Yes** to confirm.

+ Title: 'Tutorial: View Azure DDoS Protection alerts in Microsoft Defender for Cloud'

+# Tutorial: View Azure DDoS Protection alerts in Microsoft Defender for Cloud

+Microsoft Defender for Cloud provides a list of [security alerts](../security-center/security-center-managing-and-responding-alerts.md), with information to help investigate and remediate problems. With this feature, you get a unified view of alerts - including DDoS attack-related alerts - and the actions to take to mitigate the attack.

+ Title: 'Tutorial: View Azure DDoS Protection logs in Log Analytics workspace'

+# Tutorial: View Azure DDoS Protection logs in Log Analytics workspace

+DDoS Protection diagnostic logs provide you with the ability to view DDoS Protection notifications, mitigation reports and mitigation flow logs after a DDoS attack. You can view these logs in your Log Analytics workspace.

+Attack mitigation reports use the Netflow protocol data, which is aggregated to provide detailed information about the attack on your resource. Anytime a public IP resource is under attack, the report generation starts as soon as the mitigation starts. There will be an incremental report generated every 5 mins and a post-mitigation report for the whole mitigation period. This is to ensure that in an event the DDoS attack continues for a longer duration of time, you'll be able to view the most current snapshot of mitigation report every 5 minutes and a complete summary once the attack mitigation is over.

+1. On the left-side tab, select **Logs**. Here you see the query explorer. Exit out the *Queries* pane to utilize the *Logs* page.

+### Query Azure DDoS Protection logs in log analytics workspace

+For more information on log schemas, see [View diagnostic logs](ddos-view-diagnostic-logs.md#example-log-queries).

+#### DDoSProtectionNotifications logs

+1. Under the **Log analytics workspaces** blade, select your log analytics workspace.

+1. On the left side pane, select **Logs**.

+ :::image type="content" source="./media/ddos-attack-telemetry/ddos-workspace-diagnostic-logs.png" alt-text="Screenshot of log query in Log analytics workspaces.":::

+1. In Query explorer, type in the following Kusto Query and change the time range to Custom and change the time range to last three months. Then hit Run.

+ ```kusto

+ AzureDiagnostics

+ | where Category == "DDoSProtectionNotifications"

+ ```

+1. To view **DDoSMitigationFlowLogs** change the query to the following and keep the same time range and hit Run.

+ ```kusto

+ AzureDiagnostics

+ | where Category == "DDoSMitigationFlowLogs"

+ ```

+1. To view **DDoSMitigationReports** change the query to the following and keep the same time range and hit Run.

+ ```kusto

+ AzureDiagnostics

+ | where Category == "DDoSMitigationReports"

+ ```

+| **OperationName** | For notifications, this is `DDoSProtectionNotifications`. |

+Attack mitigation flow logs allow you to review the dropped traffic, forwarded traffic, and other interesting data-points during an active DDoS attack in near-real time. You can ingest the constant stream of this data into Microsoft Sentinel or to your third-party SIEM systems via event hub for near-real time monitoring, take potential actions and address the need of your defense operations.

+| **Category** | For flow logs, this is `DDoSMitigationFlowLogs`.|

+| **OperationName** | For flow logs, this is `DDoSMitigationFlowLogs`. |

+| **Category** | For mitigation reports, this is `DDoSMitigationReports`. |

+| **OperationName** | For mitigation reports, this is `DDoSMitigationReports`.  |

+ Title: 'Tutorial: Configure Azure DDoS Protection diagnostic logging through portal'

+# Tutorial: Configure Azure DDoS Protection diagnostic logging through portal

+Configure diagnostic logging for Azure DDoS Protection to gain visibility into DDoS attacks.

+- DDoS monitors public IP addresses assigned to resources within a virtual network. If you don't have any resources with public IP addresses in the virtual network, you must first create a resource with a public IP address.

+ :::image type="content" source="./media/ddos-attack-telemetry/ddos-public-ip-diagnostic-setting.png" alt-text="Screenshot of DDoS Protection diagnostic settings.":::

+For example, the risk of attack increases with the size (*surface area*) of the application. You can reduce the surface area by using an approval list to close down the exposed IP address space and listening ports that aren't needed on the load balancers ([Azure Load Balancer](../load-balancer/quickstart-load-balancer-standard-public-portal.md) and [Azure Application Gateway](../application-gateway/application-gateway-create-probe-portal.md)). [Network security groups (NSGs)](../virtual-network/network-security-groups-overview.md) are another way to reduce the attack surface.

+Azure DDoS Protection offers in-depth insights and visualizations of attack patterns through DDoS Attack Analytics. It provides customers with comprehensive visibility into attack traffic and mitigation actions via reports and flow logs. During a DDoS attack, detailed metrics are available through Azure Monitor, which also allows alert configurations based on these metrics.

+ :::image type="content" source="./media/ddos-attack-telemetry/ddos-metrics-menu.png" alt-text="Screenshot of creating DDoS protection metrics menu." lightbox="./media/ddos-attack-telemetry/ddos-metrics-menu.png":::

+ :::image type="content" source="./media/ddos-attack-telemetry/vnet-ddos-metrics.png" alt-text="Screenshot of DDoS diagnostic settings within Azure." lightbox="./media/ddos-attack-telemetry/vnet-ddos-metrics.png":::

+> [!NOTE]

+> To filter IP Addresses select **Add filter**. Under **Property**, select **Protected IP Address**, and the operator should be set to **=**. Under **Values**, you will see a dropdown of public IP addresses, associated with the virtual network, that are protected by Azure DDoS Protection.

+> [!NOTE]

+> When changing DDoS IP protection from **enabled** to **disabled**, telemetry for the public IP resource will not be available.

+> [!NOTE]

+For this tutorial, you'll create a test environment that includes:

+- A DDoS protection plan

+- A virtual network

+- An Azure Bastion host

+- A load balancer

+- Two virtual machines

+You'll then configure diagnostic logs and alerts to monitor for attacks and traffic patterns. Finally, you'll configure a DDoS attack simulation using one of our approved testing partners.

+ :::image type="content" source="./media/ddos-attack-simulation/ddos-public-ip-diagnostic-setting.png" alt-text="Screenshot of DDoS diagnostic settings in Azure.":::

+ :::image type="content" source="./media/ddos-attack-simulation/ddos-protection-alert-page.png" alt-text="Screenshot of creating Alerts in Azure." lightbox="./media/ddos-attack-simulation/ddos-protection-alert-page.png":::

+- **

+- [Alerts for AI workloads](alerts-ai-workloads.md)

+ Title: Alerts for AI workloads

+description: This article lists the security alerts for AI workloads visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for AI workloads

+This article lists the security alerts you might get for AI workloads from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## AI workload alerts

+### Detected credential theft attempts on an Azure OpenAI model deployment

+(AI.Azure_CredentialTheftAttempt)

+**Description**: The credential theft alert is designed to notify the SOC when credentials are detected within GenAI model responses to a user prompt, indicating a potential breach. This alert is crucial for detecting cases of credential leak or theft, which are unique to generative AI and can have severe consequences if successful.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access, Lateral Movement, Exfiltration

+**Severity**: Medium

+### A Jailbreak attempt on an Azure OpenAI model deployment was blocked by Azure AI Content Safety Prompt Shields

+(AI.Azure_Jailbreak.ContentFiltering.BlockedAttempt)

+**Description**: The Jailbreak alert, carried out using a direct prompt injection technique, is designed to notify the SOC there was an attempt to manipulate the system prompt to bypass the generative AIΓÇÖs safeguards, potentially accessing sensitive data or privileged functions. It indicated that such attempts were blocked by Azure Responsible AI Content Safety (AKA Prompt Shields), ensuring the integrity of the AI resources and the data security.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Privilege Escalation, Defense Evasion

+**Severity**: Medium

+### A Jailbreak attempt on an Azure OpenAI model deployment was detected by Azure AI Content Safety Prompt Shields

+(AI.Azure_Jailbreak.ContentFiltering.DetectedAttempt)

+**Description**: The Jailbreak alert, carried out using a direct prompt injection technique, is designed to notify the SOC there was an attempt to manipulate the system prompt to bypass the generative AIΓÇÖs safeguards, potentially accessing sensitive data or privileged functions. It indicated that such attempts were detected by Azure Responsible AI Content Safety (AKA Prompt Shields), but were not blocked due to content filtering settings or due to low confidence.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Privilege Escalation, Defense Evasion

+**Severity**: Medium

+### Sensitive Data Exposure Detected in Azure OpenAI Model Deployment

+(AI.Azure_DataLeakInModelResponse.Sensitive)

+**Description**: The sensitive data leakage alert is designed to notify the SOC that a GenAI model responded to a user prompt with sensitive information, potentially due to a malicious user attempting to bypass the generative AIΓÇÖs safeguards to access unauthorized sensitive data.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: Medium

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure App Service

+description: This article lists the security alerts for Azure App Service visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure App Service

+This article lists the security alerts you might get for Azure App Service from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure App Service alerts

+[Further details and notes](defender-for-app-service-introduction.md)

+### **An attempt to run Linux commands on a Windows App Service**

+(AppServices_LinuxCommandOnWindows)

+**Description**: Analysis of App Service processes detected an attempt to run a Linux command on a Windows App Service. This action was running by the web application. This behavior is often seen during campaigns that exploit a vulnerability in a common web application.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **An IP that connected to your Azure App Service FTP Interface was found in Threat Intelligence**

+(AppServices_IncomingTiClientIpFtp)

+**Description**: Azure App Service FTP log indicates a connection from a source address that was found in the threat intelligence feed. During this connection, a user accessed the pages listed.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Medium

+### **Attempt to run high privilege command detected**

+(AppServices_HighPrivilegeCommand)

+**Description**: Analysis of App Service processes detected an attempt to run a command that requires high privileges.

+The command ran in the web application context. While this behavior can be legitimate, in web applications this behavior is also observed in malicious activities.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Communication with suspicious domain identified by threat intelligence**

+(AzureDNS_ThreatIntelSuspectDomain)

+**Description**: Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access, Persistence, Execution, Command And Control, Exploitation

+**Severity**: Medium

+### **Connection to web page from anomalous IP address detected**

+(AppServices_AnomalousPageAccess)

+**Description**: Azure App Service activity log indicates an anomalous connection to a sensitive web page from the listed source IP address. This might indicate that someone is attempting a brute force attack into your web app administration pages. It might also be the result of a new IP address being used by a legitimate user. If the source IP address is trusted, you can safely suppress this alert for this resource. To learn how to suppress security alerts, see [Suppress alerts from Microsoft Defender for Cloud](alerts-suppression-rules.md).

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Low

+### **Dangling DNS record for an App Service resource detected**

+(AppServices_DanglingDomain)

+**Description**: A DNS record that points to a recently deleted App Service resource (also known as "dangling DNS" entry) has been detected. This leaves you susceptible to a subdomain takeover. Subdomain takeovers enable malicious actors to redirect traffic intended for an organization's domain to a site performing malicious activity.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: High

+### **Detected encoded executable in command line data**

+(AppServices_Base64EncodedExecutableInCommandLineParams)

+**Description**: Analysis of host data on {Compromised host} detected a base-64 encoded executable. This has previously been associated with attackers attempting to construct executables on-the-fly through a sequence of commands, and attempting to evade intrusion detection systems by ensuring that no individual command would trigger an alert. This could be legitimate activity, or an indication of a compromised host.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Detected file download from a known malicious source**

+(AppServices_SuspectDownload)

+**Description**: Analysis of host data has detected the download of a file from a known malware source on your host.

+(Applies to: App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Privilege Escalation, Execution, Exfiltration, Command and Control

+**Severity**: Medium

+### **Detected suspicious file download**

+(AppServices_SuspectDownloadArtifacts)

+**Description**: Analysis of host data has detected suspicious download of remote file.

+(Applies to: App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Medium

+### **Digital currency mining related behavior detected**

+(AppServices_DigitalCurrencyMining)

+**Description**: Analysis of host data on Inn-Flow-WebJobs detected the execution of a process or command normally associated with digital currency mining.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Executable decoded using certutil**

+(AppServices_ExecutableDecodedUsingCertutil)

+**Description**: Analysis of host data on [Compromised entity] detected that certutil.exe, a built-in administrator utility, was being used to decode an executable instead of its mainstream purpose that relates to manipulating certificates and certificate data. Attackers are known to abuse functionality of legitimate administrator tools to perform malicious actions, for example using a tool such as certutil.exe to decode a malicious executable that will then be subsequently executed.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Fileless attack behavior detected**

+(AppServices_FilelessAttackBehaviorDetection)

+**Description**: The memory of the process specified below contains behaviors commonly used by fileless attacks.

+Specific behaviors include: {list of observed behaviors}

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Fileless attack technique detected**

+(AppServices_FilelessAttackTechniqueDetection)

+**Description**: The memory of the process specified below contains evidence of a fileless attack technique. Fileless attacks are used by attackers to execute code while evading detection by security software.

+Specific behaviors include: {list of observed behaviors}

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Fileless attack toolkit detected**

+(AppServices_FilelessAttackToolkitDetection)

+**Description**: The memory of the process specified below contains a fileless attack toolkit: {ToolKitName}. Fileless attack toolkits typically do not have a presence on the filesystem, making detection by traditional anti-virus software difficult.

+Specific behaviors include: {list of observed behaviors}

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Microsoft Defender for Cloud test alert for App Service (not a threat)**

+(AppServices_EICAR)

+**Description**: This is a test alert generated by Microsoft Defender for Cloud. No further action is needed.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: High

+### **NMap scanning detected**

+(AppServices_Nmap)

+**Description**: Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.

+The suspicious activity detected is associated with NMAP. Attackers often use this tool for probing the web application to find vulnerabilities.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Informational

+### **Phishing content hosted on Azure Webapps**

+(AppServices_PhishingContent)

+**Description**: URL used for phishing attack found on the Azure AppServices website. This URL was part of a phishing attack sent to Microsoft 365 customers. The content typically lures visitors into entering their corporate credentials or financial information into a legitimate looking website.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: High

+### **PHP file in upload folder**

+(AppServices_PhpInUploadFolder)

+**Description**: Azure App Service activity log indicates an access to a suspicious PHP page located in the upload folder.

+This type of folder doesn't usually contain PHP files. The existence of this type of file might indicate an exploitation taking advantage of arbitrary file upload vulnerabilities.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Possible Cryptocoinminer download detected**

+(AppServices_CryptoCoinMinerDownload)

+**Description**: Analysis of host data has detected the download of a file normally associated with digital currency mining.

+(Applies to: App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Command and Control, Exploitation

+**Severity**: Medium

+### **Possible data exfiltration detected**

+(AppServices_DataEgressArtifacts)

+**Description**: Analysis of host/device data detected a possible data egress condition. Attackers will often egress data from machines they have compromised.

+(Applies to: App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection, Exfiltration

+**Severity**: Medium

+### **Potential dangling DNS record for an App Service resource detected**

+(AppServices_PotentialDanglingDomain)

+**Description**: A DNS record that points to a recently deleted App Service resource (also known as "dangling DNS" entry) has been detected. This might leave you susceptible to a subdomain takeover. Subdomain takeovers enable malicious actors to redirect traffic intended for an organization's domain to a site performing malicious activity. In this case, a text record with the Domain Verification ID was found. Such text records prevent subdomain takeover but we still recommend removing the dangling domain. If you leave the DNS record pointing at the subdomain you're at risk if anyone in your organization deletes the TXT file or record in the future.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Potential reverse shell detected**

+(AppServices_ReverseShell)

+**Description**: Analysis of host data detected a potential reverse shell. These are used to get a compromised machine to call back into a machine an attacker owns.

+(Applies to: App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration, Exploitation

+**Severity**: Medium

+### **Raw data download detected**

+(AppServices_DownloadCodeFromWebsite)

+**Description**: Analysis of App Service processes detected an attempt to download code from raw-data websites such as Pastebin. This action was run by a PHP process. This behavior is associated with attempts to download web shells or other malicious components to the App Service.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Saving curl output to disk detected**

+(AppServices_CurlToDisk)

+**Description**: Analysis of App Service processes detected the running of a curl command in which the output was saved to the disk. While this behavior can be legitimate, in web applications this behavior is also observed in malicious activities such as attempts to infect websites with web shells.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Spam folder referrer detected**

+(AppServices_SpamReferrer)

+**Description**: Azure App Service activity log indicates web activity that was identified as originating from a web site associated with spam activity. This can occur if your website is compromised and used for spam activity.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Suspicious access to possibly vulnerable web page detected**

+(AppServices_ScanSensitivePage)

+**Description**: Azure App Service activity log indicates a web page that seems to be sensitive was accessed. This suspicious activity originated from a source IP address whose access pattern resembles that of a web scanner.

+This activity is often associated with an attempt by an attacker to scan your network to try to gain access to sensitive or vulnerable web pages.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Suspicious domain name reference**

+(AppServices_CommandlineSuspectDomain)

+**Description**: Analysis of host data detected reference to suspicious domain name. Such activity, while possibly legitimate user behavior, is frequently an indication of the download or execution of malicious software. Typical related attacker activity is likely to include the download and execution of further malicious software or remote administration tools.

+(Applies to: App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+### **Suspicious download using Certutil detected**

+(AppServices_DownloadUsingCertutil)

+**Description**: Analysis of host data on {NAME} detected the use of certutil.exe, a built-in administrator utility, for the download of a binary instead of its mainstream purpose that relates to manipulating certificates and certificate data. Attackers are known to abuse functionality of legitimate administrator tools to perform malicious actions, for example using certutil.exe to download and decode a malicious executable that will then be subsequently executed.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Suspicious PHP execution detected**

+(AppServices_SuspectPhp)

+**Description**: Machine logs indicate that a suspicious PHP process is running. The action included an attempt to run operating system commands or PHP code from the command line, by using the PHP process. While this behavior can be legitimate, in web applications this behavior might indicate malicious activities, such as attempts to infect websites with web shells.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Suspicious PowerShell cmdlets executed**

+(AppServices_PowerShellPowerSploitScriptExecution)

+**Description**: Analysis of host data indicates execution of known malicious PowerShell PowerSploit cmdlets.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Suspicious process executed**

+(AppServices_KnownCredential AccessTools)

+**Description**: Machine logs indicate that the suspicious process: '%{process path}' was running on the machine, often associated with attacker attempts to access credentials.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: High

+### **Suspicious process name detected**

+(AppServices_ProcessWithKnownSuspiciousExtension)

+**Description**: Analysis of host data on {NAME} detected a process whose name is suspicious, for example corresponding to a known attacker tool or named in a way that is suggestive of attacker tools that try to hide in plain sight. This process could be legitimate activity, or an indication that one of your machines has been compromised.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, Defense Evasion

+**Severity**: Medium

+### **Suspicious SVCHOST process executed**

+(AppServices_SVCHostFromInvalidPath)

+**Description**: The system process SVCHOST was observed running in an abnormal context. Malware often uses SVCHOST to mask its malicious activity.

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Suspicious User Agent detected**

+(AppServices_UserAgentInjection)

+**Description**: Azure App Service activity log indicates requests with suspicious user agent. This behavior can indicate on attempts to exploit a vulnerability in your App Service application.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Informational

+### **Suspicious WordPress theme invocation detected**

+(AppServices_WpThemeInjection)

+**Description**: Azure App Service activity log indicates a possible code injection activity on your App Service resource.

+The suspicious activity detected resembles that of a manipulation of WordPress theme to support server side execution of code, followed by a direct web request to invoke the manipulated theme file.

+This type of activity was seen in the past as part of an attack campaign over WordPress.

+If your App Service resource isn't hosting a WordPress site, it isn't vulnerable to this specific code injection exploit and you can safely suppress this alert for the resource. To learn how to suppress security alerts, see [Suppress alerts from Microsoft Defender for Cloud](alerts-suppression-rules.md).

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Vulnerability scanner detected**

+(AppServices_DrupalScanner)

+**Description**: Azure App Service activity log indicates that a possible vulnerability scanner was used on your App Service resource.

+The suspicious activity detected resembles that of tools targeting a content management system (CMS).

+If your App Service resource isn't hosting a Drupal site, it isn't vulnerable to this specific code injection exploit and you can safely suppress this alert for the resource. To learn how to suppress security alerts, see [Suppress alerts from Microsoft Defender for Cloud](alerts-suppression-rules.md).

+(Applies to: App Service on Windows)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Low

+### **Vulnerability scanner detected (Joomla)**

+(AppServices_JoomlaScanner)

+**Description**: Azure App Service activity log indicates that a possible vulnerability scanner was used on your App Service resource.

+The suspicious activity detected resembles that of tools targeting Joomla applications.

+If your App Service resource isn't hosting a Joomla site, it isn't vulnerable to this specific code injection exploit and you can safely suppress this alert for the resource. To learn how to suppress security alerts, see [Suppress alerts from Microsoft Defender for Cloud](alerts-suppression-rules.md).

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Low

+### **Vulnerability scanner detected (WordPress)**

+(AppServices_WpScanner)

+**Description**: Azure App Service activity log indicates that a possible vulnerability scanner was used on your App Service resource.

+The suspicious activity detected resembles that of tools targeting WordPress applications.

+If your App Service resource isn't hosting a WordPress site, it isn't vulnerable to this specific code injection exploit and you can safely suppress this alert for the resource. To learn how to suppress security alerts, see [Suppress alerts from Microsoft Defender for Cloud](alerts-suppression-rules.md).

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Low

+### **Web fingerprinting detected**

+(AppServices_WebFingerprinting)

+**Description**: Azure App Service activity log indicates a possible web fingerprinting activity on your App Service resource.

+The suspicious activity detected is associated with a tool called Blind Elephant. The tool fingerprint web servers and tries to detect the installed applications and version.

+Attackers often use this tool for probing the web application to find vulnerabilities.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Website is tagged as malicious in threat intelligence feed**

+(AppServices_SmartScreen)

+**Description**: Your website as described below is marked as a malicious site by Windows SmartScreen. If you think this is a false positive, contact Windows SmartScreen via report feedback link provided.

+(Applies to: App Service on Windows and App Service on Linux)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: Medium

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure Cosmos DB

+description: This article lists the security alerts for Azure Cosmos DB visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure Cosmos DB

+This article lists the security alerts you might get for Azure Cosmos DB from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure Cosmos DB alerts

+[Further details and notes](concept-defender-for-cosmos.md)

+### **Access from a Tor exit node**

+ (CosmosDB_TorAnomaly)

+**Description**: This Azure Cosmos DB account was successfully accessed from an IP address known to be an active exit node of Tor, an anonymizing proxy. Authenticated access from a Tor exit node is a likely indication that a threat actor is trying to hide their identity.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High/Medium

+### **Access from a suspicious IP**

+(CosmosDB_SuspiciousIp)

+**Description**: This Azure Cosmos DB account was successfully accessed from an IP address that was identified as a threat by Microsoft Threat Intelligence.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Medium

+### **Access from an unusual location**

+(CosmosDB_GeoAnomaly)

+**Description**: This Azure Cosmos DB account was accessed from a location considered unfamiliar, based on the usual access pattern.

+ Either a threat actor has gained access to the account, or a legitimate user has connected from a new or unusual geographic location

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Low

+### **Unusual volume of data extracted**

+(CosmosDB_DataExfiltrationAnomaly)

+**Description**: An unusually large volume of data has been extracted from this Azure Cosmos DB account. This might indicate that a threat actor exfiltrated data.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Medium

+### **Extraction of Azure Cosmos DB accounts keys via a potentially malicious script**

+(CosmosDB_SuspiciousListKeys.MaliciousScript)

+**Description**: A PowerShell script was run in your subscription and performed a suspicious pattern of key-listing operations to get the keys of Azure Cosmos DB accounts in your subscription. Threat actors use automated scripts, like Microburst, to list keys and find Azure Cosmos DB accounts they can access.

+ This operation might indicate that an identity in your organization was breached, and that the threat actor is trying to compromise Azure Cosmos DB accounts in your environment for malicious intentions.

+ Alternatively, a malicious insider could be trying to access sensitive data and perform lateral movement.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: Medium

+### **Suspicious extraction of Azure Cosmos DB account keys** (AzureCosmosDB_SuspiciousListKeys.SuspiciousPrincipal)

+**Description**: A suspicious source extracted Azure Cosmos DB account access keys from your subscription. If this source is not a legitimate source, this might be a high impact issue. The access key that was extracted provides full control over the associated databases and the data stored within. See the details of each specific alert to understand why the source was flagged as suspicious.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: high

+### **SQL injection: potential data exfiltration**

+(CosmosDB_SqlInjection.DataExfiltration)

+**Description**: A suspicious SQL statement was used to query a container in this Azure Cosmos DB account.

+ The injected statement might have succeeded in exfiltrating data that the threat actor isn't authorized to access.

+ Due to the structure and capabilities of Azure Cosmos DB queries, many known SQL injection attacks on Azure Cosmos DB accounts can't work. However, the variation used in this attack might work and threat actors can exfiltrate data.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Medium

+### **SQL injection: fuzzing attempt**

+(CosmosDB_SqlInjection.FailedFuzzingAttempt)

+**Description**: A suspicious SQL statement was used to query a container in this Azure Cosmos DB account.

+ Like other well-known SQL injection attacks, this attack won't succeed in compromising the Azure Cosmos DB account.

+ Nevertheless, it's an indication that a threat actor is trying to attack the resources in this account, and your application might be compromised.

+ Some SQL injection attacks can succeed and be used to exfiltrate data. This means that if the attacker continues performing SQL injection attempts, they might be able to compromise your Azure Cosmos DB account and exfiltrate data.

+ You can prevent this threat by using parameterized queries.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Pre-attack

+**Severity**: Low

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure DDoS Protection

+description: This article lists the security alerts for Azure DDoS Protection visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure DDoS Protection

+This article lists the security alerts you might get for Azure DDoS Protection from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure DDoS Protection alerts

+[Further details and notes](other-threat-protections.md#azure-ddos)

+### **DDoS Attack detected for Public IP**

+(NETWORK_DDOS_DETECTED)

+**Description**: DDoS Attack detected for Public IP (IP address) and being mitigated.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Probing

+**Severity**: High

+### **DDoS Attack mitigated for Public IP**

+(NETWORK_DDOS_MITIGATED)

+**Description**: DDoS Attack mitigated for Public IP (IP address).

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Probing

+**Severity**: Low

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure Key Vault

+description: This article lists the security alerts for Azure Key Vault visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure Key Vault

+This article lists the security alerts you might get for Azure Key Vault from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure Key Vault alerts

+[Further details and notes](defender-for-key-vault-introduction.md)

+### **Access from a suspicious IP address to a key vault**

+(KV_SuspiciousIPAccess)

+**Description**: A key vault has been successfully accessed by an IP that has been identified by Microsoft Threat Intelligence as a suspicious IP address. This might indicate that your infrastructure has been compromised. We recommend further investigation. Learn more about [Microsoft's threat intelligence capabilities](https://go.microsoft.com/fwlink/?linkid=2128684).

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Access from a TOR exit node to a key vault**

+(KV_TORAccess)

+**Description**: A key vault has been accessed from a known TOR exit node. This could be an indication that a threat actor has accessed the key vault and is using the TOR network to hide their source location. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **High volume of operations in a key vault**

+(KV_OperationVolumeAnomaly)

+**Description**: An anomalous number of key vault operations were performed by a user, service principal, and/or a specific key vault. This anomalous activity pattern might be legitimate, but it could be an indication that a threat actor has gained access to the key vault and the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Suspicious policy change and secret query in a key vault**

+(KV_PutGetAnomaly)

+**Description**: A user or service principal has performed an anomalous Vault Put policy change operation followed by one or more Secret Get operations. This pattern is not normally performed by the specified user or service principal. This might be legitimate activity, but it could be an indication that a threat actor has updated the key vault policy to access previously inaccessible secrets. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Suspicious secret listing and query in a key vault**

+(KV_ListGetAnomaly)

+**Description**: A user or service principal has performed an anomalous Secret List operation followed by one or more Secret Get operations. This pattern is not normally performed by the specified user or service principal and is typically associated with secret dumping. This might be legitimate activity, but it could be an indication that a threat actor has gained access to the key vault and is trying to discover secrets that can be used to move laterally through your network and/or gain access to sensitive resources. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Unusual access denied - User accessing high volume of key vaults denied**

+(KV_AccountVolumeAccessDeniedAnomaly)

+**Description**: A user or service principal has attempted access to anomalously high volume of key vaults in the last 24 hours. This anomalous access pattern might be legitimate activity. Though this attempt was unsuccessful, it could be an indication of a possible attempt to gain access of key vault and the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery

+**Severity**: Low

+### **Unusual access denied - Unusual user accessing key vault denied**

+(KV_UserAccessDeniedAnomaly)

+**Description**: A key vault access was attempted by a user that does not normally access it, this anomalous access pattern might be legitimate activity. Though this attempt was unsuccessful, it could be an indication of a possible attempt to gain access of key vault and the secrets contained within it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access, Discovery

+**Severity**: Low

+### **Unusual application accessed a key vault**

+(KV_AppAnomaly)

+**Description**: A key vault has been accessed by a service principal that doesn't normally access it. This anomalous access pattern might be legitimate activity, but it could be an indication that a threat actor has gained access to the key vault in an attempt to access the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Unusual operation pattern in a key vault**

+(KV_OperationPatternAnomaly)

+**Description**: An anomalous pattern of key vault operations was performed by a user, service principal, and/or a specific key vault. This anomalous activity pattern might be legitimate, but it could be an indication that a threat actor has gained access to the key vault and the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Unusual user accessed a key vault**

+(KV_UserAnomaly)

+**Description**: A key vault has been accessed by a user that does not normally access it. This anomalous access pattern might be legitimate activity, but it could be an indication that a threat actor has gained access to the key vault in an attempt to access the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Unusual user-application pair accessed a key vault**

+(KV_UserAppAnomaly)

+**Description**: A key vault has been accessed by a user-service principal pair that doesn't normally access it. This anomalous access pattern might be legitimate activity, but it could be an indication that a threat actor has gained access to the key vault in an attempt to access the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **User accessed high volume of key vaults**

+(KV_AccountVolumeAnomaly)

+**Description**: A user or service principal has accessed an anomalously high volume of key vaults. This anomalous access pattern might be legitimate activity, but it could be an indication that a threat actor has gained access to multiple key vaults in an attempt to access the secrets contained within them. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Denied access from a suspicious IP to a key vault**

+(KV_SuspiciousIPAccessDenied)

+**Description**: An unsuccessful key vault access has been attempted by an IP that has been identified by Microsoft Threat Intelligence as a suspicious IP address. Though this attempt was unsuccessful, it indicates that your infrastructure might have been compromised. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Low

+### **Unusual access to the key vault from a suspicious IP (Non-Microsoft or external)**

+(KV_UnusualAccessSuspiciousIP)

+**Description**: A user or service principal has attempted anomalous access to key vaults from a non-Microsoft IP in the last 24 hours. This anomalous access pattern might be legitimate activity. It could be an indication of a possible attempt to gain access of the key vault and the secrets contained within it. We recommend further investigations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure network layer

+description: This article lists the security alerts for Azure network layer visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure network layer

+This article lists the security alerts you might get for Azure network layer from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure network layer alerts

+[Further details and notes](other-threat-protections.md#network-layer)

+### **Network communication with a malicious machine detected**

+(Network_CommunicationWithC2)

+**Description**: Network traffic analysis indicates that your machine (IP %{Victim IP}) has communicated with what is possibly a Command and Control center. When the compromised resource is a load balancer or an application gateway, the suspected activity might indicate that one or more of the resources in the backend pool (of the load balancer or application gateway) has communicated with what is possibly a Command and Control center.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Command and Control

+**Severity**: Medium

+### **Possible compromised machine detected**

+(Network_ResourceIpIndicatedAsMalicious)

+**Description**: Threat intelligence indicates that your machine (at IP %{Machine IP}) might have been compromised by a malware of type Conficker. Conficker was a computer worm that targets the Microsoft Windows operating system and was first detected in November 2008. Conficker infected millions of computers including government, business and home computers in over 200 countries/regions, making it the largest known computer worm infection since the 2003 Welchia worm.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Command and Control

+**Severity**: Medium

+### **Possible incoming %{Service Name} brute force attempts detected**

+(Generic_Incoming_BF_OneToOne)

+**Description**: Network traffic analysis detected incoming %{Service Name} communication to %{Victim IP}, associated with your resource %{Compromised Host} from %{Attacker IP}. When the compromised resource is a load balancer or an application gateway, the suspected incoming traffic has been forwarded to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows suspicious activity between %{Start Time} and %{End Time} on port %{Victim Port}. This activity is consistent with brute force attempts against %{Service Name} servers.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Informational

+### **Possible incoming SQL brute force attempts detected**

+(SQL_Incoming_BF_OneToOne)

+**Description**: Network traffic analysis detected incoming SQL communication to %{Victim IP}, associated with your resource %{Compromised Host}, from %{Attacker IP}. When the compromised resource is a load balancer or an application gateway, the suspected incoming traffic has been forwarded to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows suspicious activity between %{Start Time} and %{End Time} on port %{Port Number} (%{SQL Service Type}). This activity is consistent with brute force attempts against SQL servers.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Possible outgoing denial-of-service attack detected**

+(DDOS)

+**Description**: Network traffic analysis detected anomalous outgoing activity originating from %{Compromised Host}, a resource in your deployment. This activity might indicate that your resource was compromised and is now engaged in denial-of-service attacks against external endpoints. When the compromised resource is a load balancer or an application gateway, the suspected activity might indicate that one or more of the resources in the backend pool (of the load balancer or application gateway) was compromised. Based on the volume of connections, we believe that the following IPs are possibly the targets of the DOS attack: %{Possible Victims}. Note that it is possible that the communication to some of these IPs is legitimate.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Suspicious incoming RDP network activity from multiple sources**

+(RDP_Incoming_BF_ManyToOne)

+**Description**: Network traffic analysis detected anomalous incoming Remote Desktop Protocol (RDP) communication to %{Victim IP}, associated with your resource %{Compromised Host}, from multiple sources. When the compromised resource is a load balancer or an application gateway, the suspected incoming traffic has been forwarded to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows %{Number of Attacking IPs} unique IPs connecting to your resource, which is considered abnormal for this environment. This activity might indicate an attempt to brute force your RDP end point from multiple hosts (Botnet).

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Suspicious incoming RDP network activity**

+(RDP_Incoming_BF_OneToOne)

+**Description**: Network traffic analysis detected anomalous incoming Remote Desktop Protocol (RDP) communication to %{Victim IP}, associated with your resource %{Compromised Host}, from %{Attacker IP}. When the compromised resource is a load balancer or an application gateway, the suspected incoming traffic has been forwarded to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows %{Number of Connections} incoming connections to your resource, which is considered abnormal for this environment. This activity might indicate an attempt to brute force your RDP end point

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Suspicious incoming SSH network activity from multiple sources**

+(SSH_Incoming_BF_ManyToOne)

+**Description**: Network traffic analysis detected anomalous incoming SSH communication to %{Victim IP}, associated with your resource %{Compromised Host}, from multiple sources. When the compromised resource is a load balancer or an application gateway, the suspected incoming traffic has been forwarded to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows %{Number of Attacking IPs} unique IPs connecting to your resource, which is considered abnormal for this environment. This activity might indicate an attempt to brute force your SSH end point from multiple hosts (Botnet)

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Suspicious incoming SSH network activity**

+(SSH_Incoming_BF_OneToOne)

+**Description**: Network traffic analysis detected anomalous incoming SSH communication to %{Victim IP}, associated with your resource %{Compromised Host}, from %{Attacker IP}. When the compromised resource is a load balancer or an application gateway, the suspected incoming traffic has been forwarded to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows %{Number of Connections} incoming connections to your resource, which is considered abnormal for this environment. This activity might indicate an attempt to brute force your SSH end point

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Suspicious outgoing %{Attacked Protocol} traffic detected**

+(PortScanning)

+**Description**: Network traffic analysis detected suspicious outgoing traffic from %{Compromised Host} to destination port %{Most Common Port}. When the compromised resource is a load balancer or an application gateway, the suspected outgoing traffic has been originated from to one or more of the resources in the backend pool (of the load balancer or application gateway). This behavior might indicate that your resource is taking part in %{Attacked Protocol} brute force attempts or port sweeping attacks.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery

+**Severity**: Medium

+### **Suspicious outgoing RDP network activity to multiple destinations**

+(RDP_Outgoing_BF_OneToMany)

+**Description**: Network traffic analysis detected anomalous outgoing Remote Desktop Protocol (RDP) communication to multiple destinations originating from %{Compromised Host} (%{Attacker IP}), a resource in your deployment. When the compromised resource is a load balancer or an application gateway, the suspected outgoing traffic has been originated from to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows your machine connecting to %{Number of Attacked IPs} unique IPs, which is considered abnormal for this environment. This activity might indicate that your resource was compromised and is now used to brute force external RDP end points. Note that this type of activity could possibly cause your IP to be flagged as malicious by external entities.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery

+**Severity**: High

+### **Suspicious outgoing RDP network activity**

+(RDP_Outgoing_BF_OneToOne)

+**Description**: Network traffic analysis detected anomalous outgoing Remote Desktop Protocol (RDP) communication to %{Victim IP} originating from %{Compromised Host} (%{Attacker IP}), a resource in your deployment. When the compromised resource is a load balancer or an application gateway, the suspected outgoing traffic has been originated from to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows %{Number of Connections} outgoing connections from your resource, which is considered abnormal for this environment. This activity might indicate that your machine was compromised and is now used to brute force external RDP end points. Note that this type of activity could possibly cause your IP to be flagged as malicious by external entities.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: High

+### **Suspicious outgoing SSH network activity to multiple destinations**

+(SSH_Outgoing_BF_OneToMany)

+**Description**: Network traffic analysis detected anomalous outgoing SSH communication to multiple destinations originating from %{Compromised Host} (%{Attacker IP}), a resource in your deployment. When the compromised resource is a load balancer or an application gateway, the suspected outgoing traffic has been originated from to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows your resource connecting to %{Number of Attacked IPs} unique IPs, which is considered abnormal for this environment. This activity might indicate that your resource was compromised and is now used to brute force external SSH end points. Note that this type of activity could possibly cause your IP to be flagged as malicious by external entities.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery

+**Severity**: Medium

+### **Suspicious outgoing SSH network activity**

+(SSH_Outgoing_BF_OneToOne)

+**Description**: Network traffic analysis detected anomalous outgoing SSH communication to %{Victim IP} originating from %{Compromised Host} (%{Attacker IP}), a resource in your deployment. When the compromised resource is a load balancer or an application gateway, the suspected outgoing traffic has been originated from to one or more of the resources in the backend pool (of the load balancer or application gateway). Specifically, sampled network data shows %{Number of Connections} outgoing connections from your resource, which is considered abnormal for this environment. This activity might indicate that your resource was compromised and is now used to brute force external SSH end points. Note that this type of activity could possibly cause your IP to be flagged as malicious by external entities.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: Medium

+### **Traffic detected from IP addresses recommended for blocking**

+(Network_TrafficFromUnrecommendedIP)

+**Description**: Microsoft Defender for Cloud detected inbound traffic from IP addresses that are recommended to be blocked. This typically occurs when this IP address doesn't communicate regularly with this resource. Alternatively, the IP address has been flagged as malicious by Defender for Cloud's threat intelligence sources.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Probing

+**Severity**: Informational

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure Storage

+description: This article lists the security alerts for Azure Storage visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure Storage

+This article lists the security alerts you might get for Azure Storage from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure Storage alerts

+[Further details and notes](defender-for-storage-introduction.md)

+### **Access from a suspicious application**

+(Storage.Blob_SuspiciousApp)

+**Description**: Indicates that a suspicious application has successfully accessed a container of a storage account with authentication.

+This might indicate that an attacker has obtained the credentials necessary to access the account, and is exploiting it. This could also be an indication of a penetration test carried out in your organization.

+Applies to: Azure Blob Storage, Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High/Medium

+### **Access from a suspicious IP address**

+(Storage.Blob_SuspiciousIp

+Storage.Files_SuspiciousIp)

+**Description**: Indicates that this storage account has been successfully accessed from an IP address that is considered suspicious. This alert is powered by Microsoft Threat Intelligence.

+Learn more about [Microsoft's threat intelligence capabilities](https://go.microsoft.com/fwlink/?linkid=2128684).

+Applies to: Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Pre Attack

+**Severity**: High/Medium/Low

+### **Phishing content hosted on a storage account**

+(Storage.Blob_PhishingContent

+Storage.Files_PhishingContent)

+**Description**: A URL used in a phishing attack points to your Azure Storage account. This URL was part of a phishing attack affecting users of Microsoft 365.

+Typically, content hosted on such pages is designed to trick visitors into entering their corporate credentials or financial information into a web form that looks legitimate.

+This alert is powered by Microsoft Threat Intelligence.

+Learn more about [Microsoft's threat intelligence capabilities](https://go.microsoft.com/fwlink/?linkid=2128684).

+Applies to: Azure Blob Storage, Azure Files

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: High

+### **Storage account identified as source for distribution of malware**

+(Storage.Files_WidespreadeAm)

+**Description**: Antimalware alerts indicate that an infected file(s) is stored in an Azure file share that is mounted to multiple VMs. If attackers gain access to a VM with a mounted Azure file share, they can use it to spread malware to other VMs that mount the same share.

+Applies to: Azure Files

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **The access level of a potentially sensitive storage blob container was changed to allow unauthenticated public access**

+(Storage.Blob_OpenACL)

+**Description**: The alert indicates that someone has changed the access level of a blob container in the storage account, which might contain sensitive data, to the 'Container' level, to allow unauthenticated (anonymous) public access. The change was made through the Azure portal.

+Based on statistical analysis, the blob container is flagged as possibly containing sensitive data. This analysis suggests that blob containers or storage accounts with similar names are typically not exposed to public access.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: Medium

+### **Authenticated access from a Tor exit node**

+(Storage.Blob_TorAnomaly

+Storage.Files_TorAnomaly)

+**Description**: One or more storage container(s) / file share(s) in your storage account were successfully accessed from an IP address known to be an active exit node of Tor (an anonymizing proxy). Threat actors use Tor to make it difficult to trace the activity back to them. Authenticated access from a Tor exit node is a likely indication that a threat actor is trying to hide their identity.

+Applies to: Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access / Pre Attack

+**Severity**: High/Medium

+### **Access from an unusual location to a storage account**

+(Storage.Blob_GeoAnomaly

+Storage.Files_GeoAnomaly)

+**Description**: Indicates that there was a change in the access pattern to an Azure Storage account. Someone has accessed this account from an IP address considered unfamiliar when compared with recent activity. Either an attacker has gained access to the account, or a legitimate user has connected from a new or unusual geographic location. An example of the latter is remote maintenance from a new application or developer.

+Applies to: Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High/Medium/Low

+### **Unusual unauthenticated access to a storage container**

+(Storage.Blob_AnonymousAccessAnomaly)

+**Description**: This storage account was accessed without authentication, which is a change in the common access pattern. Read access to this container is usually authenticated. This might indicate that a threat actor was able to exploit public read access to storage container(s) in this storage account(s).

+Applies to: Azure Blob Storage

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High/Low

+### **Potential malware uploaded to a storage account**

+(Storage.Blob_MalwareHashReputation

+Storage.Files_MalwareHashReputation)

+**Description**: Indicates that a blob containing potential malware has been uploaded to a blob container or a file share in a storage account. This alert is based on hash reputation analysis leveraging the power of Microsoft threat intelligence, which includes hashes for viruses, trojans, spyware and ransomware. Potential causes might include an intentional malware upload by an attacker, or an unintentional upload of a potentially malicious blob by a legitimate user.

+Applies to: Azure Blob Storage, Azure Files (Only for transactions over REST API)

+Learn more about [Microsoft's threat intelligence capabilities](https://go.microsoft.com/fwlink/?linkid=2128684).

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: High

+### **Publicly accessible storage containers successfully discovered**

+(Storage.Blob_OpenContainersScanning.SuccessfulDiscovery)

+**Description**: A successful discovery of publicly open storage container(s) in your storage account was performed in the last hour by a scanning script or tool.

+This usually indicates a reconnaissance attack, where the threat actor tries to list blobs by guessing container names, in the hope of finding misconfigured open storage containers with sensitive data in them.

+The threat actor might use their own script or use known scanning tools like Microburst to scan for publicly open containers.

+Γ£ö Azure Blob Storage

+Γ£û Azure Files

+Γ£û Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: High/Medium

+### **Publicly accessible storage containers unsuccessfully scanned**

+(Storage.Blob_OpenContainersScanning.FailedAttempt)

+**Description**: A series of failed attempts to scan for publicly open storage containers were performed in the last hour.

+This usually indicates a reconnaissance attack, where the threat actor tries to list blobs by guessing container names, in the hope of finding misconfigured open storage containers with sensitive data in them.

+The threat actor might use their own script or use known scanning tools like Microburst to scan for publicly open containers.

+Γ£ö Azure Blob Storage

+Γ£û Azure Files

+Γ£û Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: High/Low

+### **Unusual access inspection in a storage account**

+(Storage.Blob_AccessInspectionAnomaly

+Storage.Files_AccessInspectionAnomaly)

+**Description**: Indicates that the access permissions of a storage account have been inspected in an unusual way, compared to recent activity on this account. A potential cause is that an attacker has performed reconnaissance for a future attack.

+Applies to: Azure Blob Storage, Azure Files

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery

+**Severity**: High/Medium

+### **Unusual amount of data extracted from a storage account**

+(Storage.Blob_DataExfiltration.AmountOfDataAnomaly

+Storage.Blob_DataExfiltration.NumberOfBlobsAnomaly

+Storage.Files_DataExfiltration.AmountOfDataAnomaly

+Storage.Files_DataExfiltration.NumberOfFilesAnomaly)

+**Description**: Indicates that an unusually large amount of data has been extracted compared to recent activity on this storage container. A potential cause is that an attacker has extracted a large amount of data from a container that holds blob storage.

+Applies to: Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: High/Low

+### **Unusual application accessed a storage account**

+(Storage.Blob_ApplicationAnomaly

+Storage.Files_ApplicationAnomaly)

+**Description**: Indicates that an unusual application has accessed this storage account. A potential cause is that an attacker has accessed your storage account by using a new application.

+Applies to: Azure Blob Storage, Azure Files

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High/Medium

+### **Unusual data exploration in a storage account**

+(Storage.Blob_DataExplorationAnomaly

+Storage.Files_DataExplorationAnomaly)

+**Description**: Indicates that blobs or containers in a storage account have been enumerated in an abnormal way, compared to recent activity on this account. A potential cause is that an attacker has performed reconnaissance for a future attack.

+Applies to: Azure Blob Storage, Azure Files

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High/Medium

+### **Unusual deletion in a storage account**

+(Storage.Blob_DeletionAnomaly

+Storage.Files_DeletionAnomaly)

+**Description**: Indicates that one or more unexpected delete operations has occurred in a storage account, compared to recent activity on this account. A potential cause is that an attacker has deleted data from your storage account.

+Applies to: Azure Blob Storage, Azure Files, Azure Data Lake Storage Gen2

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: High/Medium

+### **Unusual unauthenticated public access to a sensitive blob container (Preview)**

+Storage.Blob_AnonymousAccessAnomaly.Sensitive

+**Description**: The alert indicates that someone accessed a blob container with sensitive data in the storage account without authentication, using an external (public) IP address. This access is suspicious since the blob container is open to public access and is typically only accessed with authentication from internal networks (private IP addresses). This access could indicate that the blob container's access level is misconfigured, and a malicious actor might have exploited the public access. The security alert includes the discovered sensitive information context (scanning time, classification label, information types, and file types). Learn more on sensitive data threat detection.

+ Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High

+### **Unusual amount of data extracted from a sensitive blob container (Preview)**

+Storage.Blob_DataExfiltration.AmountOfDataAnomaly.Sensitive

+**Description**: The alert indicates that someone has extracted an unusually large amount of data from a blob container with sensitive data in the storage account. Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Medium

+### **Unusual number of blobs extracted from a sensitive blob container (Preview)**

+Storage.Blob_DataExfiltration.NumberOfBlobsAnomaly.Sensitive

+**Description**: The alert indicates that someone has extracted an unusually large number of blobs from a blob container with sensitive data in the storage account. Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2 or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+### **Access from a known suspicious application to a sensitive blob container (Preview)**

+Storage.Blob_SuspiciousApp.Sensitive

+**Description**: The alert indicates that someone with a known suspicious application accessed a blob container with sensitive data in the storage account and performed authenticated operations.

+The access might indicate that a threat actor obtained credentials to access the storage account by using a known suspicious application. However, the access could also indicate a penetration test carried out in the organization.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2 or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High

+### **Access from a known suspicious IP address to a sensitive blob container (Preview)**

+Storage.Blob_SuspiciousIp.Sensitive

+**Description**: The alert indicates that someone accessed a blob container with sensitive data in the storage account from a known suspicious IP address associated with threat intel by Microsoft Threat Intelligence. Since the access was authenticated, it's possible that the credentials allowing access to this storage account were compromised.

+Learn more about [Microsoft's threat intelligence capabilities](https://go.microsoft.com/fwlink/?linkid=2128684).

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Pre-Attack

+**Severity**: High

+### **Access from a Tor exit node to a sensitive blob container (Preview)**

+Storage.Blob_TorAnomaly.Sensitive

+**Description**: The alert indicates that someone with an IP address known to be a Tor exit node accessed a blob container with sensitive data in the storage account with authenticated access. Authenticated access from a Tor exit node strongly indicates that the actor is attempting to remain anonymous for possible malicious intent. Since the access was authenticated, it's possible that the credentials allowing access to this storage account were compromised.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Pre-Attack

+**Severity**: High

+### **Access from an unusual location to a sensitive blob container (Preview)**

+Storage.Blob_GeoAnomaly.Sensitive

+**Description**: The alert indicates that someone has accessed blob container with sensitive data in the storage account with authentication from an unusual location. Since the access was authenticated, it's possible that the credentials allowing access to this storage account were compromised.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Medium

+### **The access level of a sensitive storage blob container was changed to allow unauthenticated public access (Preview)**

+Storage.Blob_OpenACL.Sensitive

+**Description**: The alert indicates that someone has changed the access level of a blob container in the storage account, which contains sensitive data, to the 'Container' level, which allows unauthenticated (anonymous) public access. The change was made through the Azure portal.

+The access level change might compromise the security of the data. We recommend taking immediate action to secure the data and prevent unauthorized access in case this alert is triggered.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the data sensitivity threat detection feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Collection

+**Severity**: High

+### **Suspicious external access to an Azure storage account with overly permissive SAS token (Preview)**

+Storage.Blob_AccountSas.InternalSasUsedExternally

+**Description**: The alert indicates that someone with an external (public) IP address accessed the storage account using an overly permissive SAS token with a long expiration date. This type of access is considered suspicious because the SAS token is typically only used in internal networks (from private IP addresses).

+The activity might indicate that a SAS token has been leaked by a malicious actor or leaked unintentionally from a legitimate source.

+Even if the access is legitimate, using a high-permission SAS token with a long expiration date goes against security best practices and poses a potential security risk.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration / Resource Development / Impact

+**Severity**: Medium

+### **Suspicious external operation to an Azure storage account with overly permissive SAS token (Preview)**

+Storage.Blob_AccountSas.UnusualOperationFromExternalIp

+**Description**: The alert indicates that someone with an external (public) IP address accessed the storage account using an overly permissive SAS token with a long expiration date. The access is considered suspicious because operations invoked outside your network (not from private IP addresses) with this SAS token are typically used for a specific set of Read/Write/Delete operations, but other operations occurred, which makes this access suspicious.

+This activity might indicate that a SAS token has been leaked by a malicious actor or leaked unintentionally from a legitimate source.

+Even if the access is legitimate, using a high-permission SAS token with a long expiration date goes against security best practices and poses a potential security risk.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration / Resource Development / Impact

+**Severity**: Medium

+### **Unusual SAS token was used to access an Azure storage account from a public IP address (Preview)**

+Storage.Blob_AccountSas.UnusualExternalAccess

+**Description**: The alert indicates that someone with an external (public) IP address has accessed the storage account using an account SAS token. The access is highly unusual and considered suspicious, as access to the storage account using SAS tokens typically comes only from internal (private) IP addresses.

+It's possible that a SAS token was leaked or generated by a malicious actor either from within your organization or externally to gain access to this storage account.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration / Resource Development / Impact

+**Severity**: Low

+### **Malicious file uploaded to storage account**

+Storage.Blob_AM.MalwareFound

+**Description**: The alert indicates that a malicious blob was uploaded to a storage account. This security alert is generated by the Malware Scanning feature in Defender for Storage.

+Potential causes might include an intentional upload of malware by a threat actor or an unintentional upload of a malicious file by a legitimate user.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2, or premium block blobs) storage accounts with the new Defender for Storage plan with the Malware Scanning feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: High

+### **Malicious blob was downloaded from a storage account (Preview)**

+Storage.Blob_MalwareDownload

+**Description**: The alert indicates that a malicious blob was downloaded from a storage account. Potential causes might include malware that was uploaded to the storage account and not removed or quarantined, thereby enabling a threat actor to download it, or an unintentional download of the malware by legitimate users or applications.

+Applies to: Azure Blob (Standard general-purpose v2, Azure Data Lake Storage Gen2 or premium block blobs) storage accounts with the new Defender for Storage plan with the Malware Scanning feature enabled.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: High, if Eicar - low

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Azure VM extensions

+description: This article lists the security alerts for Azure VM extensions visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Azure VM extensions

+This article lists the security alerts you might get for Azure VM extensions from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Azure VM extensions alerts

+These alerts focus on detecting suspicious activities of Azure virtual machine extensions and provides insights into attackers' attempts to compromise and perform malicious activities on your virtual machines.

+Azure virtual machine extensions are small applications that run post-deployment on virtual machines and provide capabilities such as configuration, automation, monitoring, security, and more. While extensions are a powerful tool, they can be used by threat actors for various malicious intents, for example:

+- Data collection and monitoring

+- Code execution and configuration deployment with high privileges

+- Resetting credentials and creating administrative users

+- Encrypting disks

+Learn more about [Defender for Cloud latest protections against the abuse of Azure VM extensions](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/microsoft-defender-for-cloud-latest-protection-against/ba-p/3970121).

+### **Suspicious failure installing GPU extension in your subscription (Preview)**

+(VM_GPUExtensionSuspiciousFailure)

+**Description**: Suspicious intent of installing a GPU extension on unsupported VMs. This extension should be installed on virtual machines equipped with a graphic processor, and in this case the virtual machines are not equipped with such. These failures can be seen when malicious adversaries execute multiple installations of such extension for crypto-mining purposes.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Suspicious installation of a GPU extension was detected on your virtual machine (Preview)**

+(VM_GPUDriverExtensionUnusualExecution)

+**Description**: Suspicious installation of a GPU extension was detected on your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use the GPU driver extension to install GPU drivers on your virtual machine via the Azure Resource Manager to perform cryptojacking. This activity is deemed suspicious as the principal's behavior departs from its usual patterns.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Low

+### **Run Command with a suspicious script was detected on your virtual machine (Preview)**

+(VM_RunCommandSuspiciousScript)

+**Description**: A Run Command with a suspicious script was detected on your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use Run Command to execute malicious code with high privileges on your virtual machine via the Azure Resource Manager. The script is deemed suspicious as certain parts were identified as being potentially malicious.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Suspicious unauthorized Run Command usage was detected on your virtual machine (Preview)**

+(VM_RunCommandSuspiciousFailure)

+**Description**: Suspicious unauthorized usage of Run Command has failed and was detected on your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might attempt to use Run Command to execute malicious code with high privileges on your virtual machines via the Azure Resource Manager. This activity is deemed suspicious as it hasn't been commonly seen before.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Suspicious Run Command usage was detected on your virtual machine (Preview)**

+(VM_RunCommandSuspiciousUsage)

+**Description**: Suspicious usage of Run Command was detected on your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use Run Command to execute malicious code with high privileges on your virtual machines via the Azure Resource Manager. This activity is deemed suspicious as it hasn't been commonly seen before.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Low

+### **Suspicious usage of multiple monitoring or data collection extensions was detected on your virtual machines (Preview)**

+(VM_SuspiciousMultiExtensionUsage)

+**Description**: Suspicious usage of multiple monitoring or data collection extensions was detected on your virtual machines by analyzing the Azure Resource Manager operations in your subscription. Attackers might abuse such extensions for data collection, network traffic monitoring, and more, in your subscription. This usage is deemed suspicious as it hasn't been commonly seen before.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Reconnaissance

+**Severity**: Medium

+### **Suspicious installation of disk encryption extensions was detected on your virtual machines (Preview)**

+(VM_DiskEncryptionSuspiciousUsage)

+**Description**: Suspicious installation of disk encryption extensions was detected on your virtual machines by analyzing the Azure Resource Manager operations in your subscription. Attackers might abuse the disk encryption extension to deploy full disk encryptions on your virtual machines via the Azure Resource Manager in an attempt to perform ransomware activity. This activity is deemed suspicious as it hasn't been commonly seen before and due to the high number of extension installations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Suspicious usage of VMAccess extension was detected on your virtual machines (Preview)**

+(VM_VMAccessSuspiciousUsage)

+**Description**: Suspicious usage of VMAccess extension was detected on your virtual machines. Attackers might abuse the VMAccess extension to gain access and compromise your virtual machines with high privileges by resetting access or managing administrative users. This activity is deemed suspicious as the principal's behavior departs from its usual patterns, and due to the high number of the extension installations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Medium

+### **Desired State Configuration (DSC) extension with a suspicious script was detected on your virtual machine (Preview)**

+(VM_DSCExtensionSuspiciousScript)

+**Description**: Desired State Configuration (DSC) extension with a suspicious script was detected on your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use the Desired State Configuration (DSC) extension to deploy malicious configurations, such as persistence mechanisms, malicious scripts, and more, with high privileges, on your virtual machines. The script is deemed suspicious as certain parts were identified as being potentially malicious.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Suspicious usage of a Desired State Configuration (DSC) extension was detected on your virtual machines (Preview)**

+(VM_DSCExtensionSuspiciousUsage)

+**Description**: Suspicious usage of a Desired State Configuration (DSC) extension was detected on your virtual machines by analyzing the Azure Resource Manager operations in your subscription. Attackers might use the Desired State Configuration (DSC) extension to deploy malicious configurations, such as persistence mechanisms, malicious scripts, and more, with high privileges, on your virtual machines. This activity is deemed suspicious as the principal's behavior departs from its usual patterns, and due to the high number of the extension installations.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Low

+### **Custom script extension with a suspicious script was detected on your virtual machine (Preview)**

+(VM_CustomScriptExtensionSuspiciousCmd)

+**Description**: Custom script extension with a suspicious script was detected on your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use Custom script extension to execute malicious code with high privileges on your virtual machine via the Azure Resource Manager. The script is deemed suspicious as certain parts were identified as being potentially malicious.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Suspicious failed execution of custom script extension in your virtual machine**

+(VM_CustomScriptExtensionSuspiciousFailure)

+**Description**: Suspicious failure of a custom script extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Such failures might be associated with malicious scripts run by this extension.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Unusual deletion of custom script extension in your virtual machine**

+(VM_CustomScriptExtensionUnusualDeletion)

+**Description**: Unusual deletion of a custom script extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Unusual execution of custom script extension in your virtual machine**

+(VM_CustomScriptExtensionUnusualExecution)

+**Description**: Unusual execution of a custom script extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Custom script extension with suspicious entry-point in your virtual machine**

+(VM_CustomScriptExtensionSuspiciousEntryPoint)

+**Description**: Custom script extension with a suspicious entry-point was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. The entry-point refers to a suspicious GitHub repository. Attackers might use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Custom script extension with suspicious payload in your virtual machine**

+(VM_CustomScriptExtensionSuspiciousPayload)

+**Description**: Custom script extension with a payload from a suspicious GitHub repository was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for containers - Kubernetes clusters

+description: This article lists the security alerts for containers and Kubernetes clusters visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for containers - Kubernetes clusters

+This article lists the security alerts you might get for containers and Kubernetes clusters from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Alerts for containers and Kubernetes clusters

+Microsoft Defender for Containers provides security alerts on the cluster level and on the underlying cluster nodes by monitoring both control plane (API server) and the containerized workload itself. Control plane security alerts can be recognized by a prefix of `K8S_` of the alert type. Security alerts for runtime workload in the clusters can be recognized by the `K8S.NODE_` prefix of the alert type. All alerts are supported on Linux only, unless otherwise indicated.

+[Further details and notes](defender-for-containers-introduction.md#run-time-protection-for-kubernetes-nodes-and-clusters)

+### **Exposed Postgres service with trust authentication configuration in Kubernetes detected (Preview)**

+(K8S_ExposedPostgresTrustAuth)

+**Description**: Kubernetes cluster configuration analysis detected exposure of a Postgres service by a load balancer. The service is configured with trust authentication method, which doesn't require credentials.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: InitialAccess

+**Severity**: Medium

+### **Exposed Postgres service with risky configuration in Kubernetes detected (Preview)**

+(K8S_ExposedPostgresBroadIPRange)

+**Description**: Kubernetes cluster configuration analysis detected exposure of a Postgres service by a load balancer with a risky configuration. Exposing the service to a wide range of IP addresses poses a security risk.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: InitialAccess

+**Severity**: Medium

+### **Attempt to create a new Linux namespace from a container detected**

+(K8S.NODE_NamespaceCreation) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container in Kubernetes cluster detected an attempt to create a new Linux namespace. While this behavior might be legitimate, it might indicate that an attacker tries to escape from the container to the node. Some CVE-2022-0185 exploitations use this technique.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PrivilegeEscalation

+**Severity**: Informational

+### **A history file has been cleared**

+(K8S.NODE_HistoryFileCleared) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected that the command history log file has been cleared. Attackers might do this to cover their tracks. The operation was performed by the specified user account.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: DefenseEvasion

+**Severity**: Medium

+### **Abnormal activity of managed identity associated with Kubernetes (Preview)**

+(K8S_AbnormalMiActivity)

+**Description**: Analysis of Azure Resource Manager operations detected an abnormal behavior of a managed identity used by an AKS addon. The detected activity isn\'t consistent with the behavior of the associated addon. While this activity can be legitimate, such behavior might indicate that the identity was gained by an attacker, possibly from a compromised container in the Kubernetes cluster.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: Medium

+### **Abnormal Kubernetes service account operation detected**

+(K8S_ServiceAccountRareOperation)

+**Description**: Kubernetes audit log analysis detected abnormal behavior by a service account in your Kubernetes cluster. The service account was used for an operation, which isn't common for this service account. While this activity can be legitimate, such behavior might indicate that the service account is being used for malicious purposes.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement, Credential Access

+**Severity**: Medium

+### **An uncommon connection attempt detected**

+(K8S.NODE_SuspectConnection) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected an uncommon connection attempt utilizing a socks protocol. This is very rare in normal operations, but a known technique for attackers attempting to bypass network-layer detections.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution, Exfiltration, Exploitation

+**Severity**: Medium

+### **Attempt to stop apt-daily-upgrade.timer service detected**

+(K8S.NODE_TimerServiceDisabled) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected an attempt to stop apt-daily-upgrade.timer service. Attackers have been observed stopping this service to download malicious files and grant execution privileges for their attacks. This activity can also happen if the service is updated through normal administrative actions.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: DefenseEvasion

+**Severity**: Informational

+### **Behavior similar to common Linux bots detected (Preview)**

+(K8S.NODE_CommonBot)

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected the execution of a process normally associated with common Linux botnets.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution, Collection, Command And Control

+**Severity**: Medium

+### **Command within a container running with high privileges**

+(K8S.NODE_PrivilegedExecutionInContainer) ^{[1](#footnote1)}

+**Description**: Machine logs indicate that a privileged command was run in a Docker container. A privileged command has extended privileges on the host machine.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PrivilegeEscalation

+**Severity**: Informational

+### **Container running in privileged mode**

+(K8S.NODE_PrivilegedContainerArtifacts) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected the execution of a Docker command that is running a privileged container. The privileged container has full access to the hosting pod or host resource. If compromised, an attacker might use the privileged container to gain access to the hosting pod or host.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PrivilegeEscalation, Execution

+**Severity**: Informational

+### **Container with a sensitive volume mount detected**

+(K8S_SensitiveMount)

+**Description**: Kubernetes audit log analysis detected a new container with a sensitive volume mount. The volume that was detected is a hostPath type which mounts a sensitive file or folder from the node to the container. If the container gets compromised, the attacker can use this mount for gaining access to the node.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Privilege Escalation

+**Severity**: Informational

+### **CoreDNS modification in Kubernetes detected**

+(K8S_CoreDnsModification) ^{[2](#footnote2)} ^{[3](#footnote3)}

+**Description**: Kubernetes audit log analysis detected a modification of the CoreDNS configuration. The configuration of CoreDNS can be modified by overriding its configmap. While this activity can be legitimate, if attackers have permissions to modify the configmap, they can change the behavior of the cluster's DNS server and poison it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Lateral Movement

+**Severity**: Low

+### **Creation of admission webhook configuration detected**

+(K8S_AdmissionController) ^{[3](#footnote3)}

+**Description**: Kubernetes audit log analysis detected a new admission webhook configuration. Kubernetes has two built-in generic admission controllers: MutatingAdmissionWebhook and ValidatingAdmissionWebhook. The behavior of these admission controllers is determined by an admission webhook that the user deploys to the cluster. The usage of such admission controllers can be legitimate, however attackers can use such webhooks for modifying the requests (in case of MutatingAdmissionWebhook) or inspecting the requests and gain sensitive information (in case of ValidatingAdmissionWebhook).

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access, Persistence

+**Severity**: Informational

+### **Detected file download from a known malicious source**

+(K8S.NODE_SuspectDownload) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a download of a file from a source frequently used to distribute malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PrivilegeEscalation, Execution, Exfiltration, Command And Control

+**Severity**: Medium

+### **Detected suspicious file download**

+(K8S.NODE_SuspectDownloadArtifacts) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious download of a remote file.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Informational

+### **Detected suspicious use of the nohup command**

+(K8S.NODE_SuspectNohup) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious use of the nohup command. Attackers have been seen using the command nohup to run hidden files from a temporary directory to allow their executables to run in the background. It's rare to see this command run on hidden files located in a temporary directory.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, DefenseEvasion

+**Severity**: Medium

+### **Detected suspicious use of the useradd command**

+(K8S.NODE_SuspectUserAddition) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious use of the useradd command.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Medium

+### **Digital currency mining container detected**

+(K8S_MaliciousContainerImage) ^{[3](#footnote3)}

+**Description**: Kubernetes audit log analysis detected a container that has an image associated with a digital currency mining tool.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Digital currency mining related behavior detected**

+(K8S.NODE_DigitalCurrencyMining) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected an execution of a process or command normally associated with digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Docker build operation detected on a Kubernetes node**

+(K8S.NODE_ImageBuildOnNode) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a build operation of a container image on a Kubernetes node. While this behavior might be legitimate, attackers might build their malicious images locally to avoid detection.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: DefenseEvasion

+**Severity**: Informational

+### **Exposed Kubeflow dashboard detected**

+(K8S_ExposedKubeflow)

+**Description**: The Kubernetes audit log analysis detected exposure of the Istio Ingress by a load balancer in a cluster that runs Kubeflow. This action might expose the Kubeflow dashboard to the internet. If the dashboard is exposed to the internet, attackers can access it and run malicious containers or code on the cluster. Find more details in the following article: <https://aka.ms/exposedkubeflow-blog>

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Medium

+### **Exposed Kubernetes dashboard detected**

+(K8S_ExposedDashboard)

+**Description**: Kubernetes audit log analysis detected exposure of the Kubernetes Dashboard by a LoadBalancer service. Exposed dashboard allows an unauthenticated access to the cluster management and poses a security threat.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: High

+### **Exposed Kubernetes service detected**

+(K8S_ExposedService)

+**Description**: The Kubernetes audit log analysis detected exposure of a service by a load balancer. This service is related to a sensitive application that allows high impact operations in the cluster such as running processes on the node or creating new containers. In some cases, this service doesn't require authentication. If the service doesn't require authentication, exposing it to the internet poses a security risk.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Medium

+### **Exposed Redis service in AKS detected**

+(K8S_ExposedRedis)

+**Description**: The Kubernetes audit log analysis detected exposure of a Redis service by a load balancer. If the service doesn't require authentication, exposing it to the internet poses a security risk.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Low

+### **Indicators associated with DDOS toolkit detected**

+(K8S.NODE_KnownLinuxDDoSToolkit) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected file names that are part of a toolkit associated with malware capable of launching DDoS attacks, opening ports and services, and taking full control over the infected system. This could also possibly be legitimate activity.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, LateralMovement, Execution, Exploitation

+**Severity**: Medium

+### **K8S API requests from proxy IP address detected**

+(K8S_TI_Proxy) ^{[3](#footnote3)}

+**Description**: Kubernetes audit log analysis detected API requests to your cluster from an IP address that is associated with proxy services, such as TOR. While this behavior can be legitimate, it's often seen in malicious activities, when attackers try to hide their source IP.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Low

+### **Kubernetes events deleted**

+(K8S_DeleteEvents) ^{[2](#footnote2)} ^{[3](#footnote3)}

+**Description**: Defender for Cloud detected that some Kubernetes events have been deleted. Kubernetes events are objects in Kubernetes that contain information about changes in the cluster. Attackers might delete those events for hiding their operations in the cluster.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Low

+### **Kubernetes penetration testing tool detected**

+(K8S_PenTestToolsKubeHunter)

+**Description**: Kubernetes audit log analysis detected usage of Kubernetes penetration testing tool in the AKS cluster. While this behavior can be legitimate, attackers might use such public tools for malicious purposes.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Low

+### **Microsoft Defender for Cloud test alert (not a threat)**

+(K8S.NODE_EICAR) ^{[1](#footnote1)}

+**Description**: This is a test alert generated by Microsoft Defender for Cloud. No further action is needed.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **New container in the kube-system namespace detected**

+(K8S_KubeSystemContainer) ^{[3](#footnote3)}

+**Description**: Kubernetes audit log analysis detected a new container in the kube-system namespace that isn't among the containers that normally run in this namespace. The kube-system namespaces shouldn't contain user resources. Attackers can use this namespace for hiding malicious components.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Informational

+### **New high privileges role detected**

+(K8S_HighPrivilegesRole) ^{[3](#footnote3)}

+**Description**: Kubernetes audit log analysis detected a new role with high privileges. A binding to a role with high privileges gives the user\group high privileges in the cluster. Unnecessary privileges might cause privilege escalation in the cluster.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Informational

+### **Possible attack tool detected**

+(K8S.NODE_KnownLinuxAttackTool) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious tool invocation. This tool is often associated with malicious users attacking others.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution, Collection, Command And Control, Probing

+**Severity**: Medium

+### **Possible backdoor detected**

+(K8S.NODE_LinuxBackdoorArtifact) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious file being downloaded and run. This activity has previously been associated with installation of a backdoor.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, DefenseEvasion, Execution, Exploitation

+**Severity**: Medium

+### **Possible command line exploitation attempt**

+(K8S.NODE_ExploitAttempt) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a possible exploitation attempt against a known vulnerability.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: Medium

+### **Possible credential access tool detected**

+(K8S.NODE_KnownLinuxCredentialAccessTool) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a possible known credential access tool was running on the container, as identified by the specified process and commandline history item. This tool is often associated with attacker attempts to access credentials.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: CredentialAccess

+**Severity**: Medium

+### **Possible Cryptocoinminer download detected**

+(K8S.NODE_CryptoCoinMinerDownload) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected download of a file normally associated with digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: DefenseEvasion, Command And Control, Exploitation

+**Severity**: Medium

+### **Possible Log Tampering Activity Detected**

+(K8S.NODE_SystemLogRemoval) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a possible removal of files that tracks user's activity during the course of its operation. Attackers often try to evade detection and leave no trace of malicious activities by deleting such log files.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: DefenseEvasion

+**Severity**: Medium

+### **Possible password change using crypt-method detected**

+(K8S.NODE_SuspectPasswordChange) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a password change using the crypt method. Attackers can make this change to continue access and gain persistence after compromise.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: CredentialAccess

+**Severity**: Medium

+### **Potential port forwarding to external IP address**

+(K8S.NODE_SuspectPortForwarding) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected an initiation of port forwarding to an external IP address.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration, Command And Control

+**Severity**: Medium

+### **Potential reverse shell detected**

+(K8S.NODE_ReverseShell) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a potential reverse shell. These are used to get a compromised machine to call back into a machine an attacker owns.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration, Exploitation

+**Severity**: Medium

+### **Privileged container detected**

+(K8S_PrivilegedContainer)

+**Description**: Kubernetes audit log analysis detected a new privileged container. A privileged container has access to the node's resources and breaks the isolation between containers. If compromised, an attacker can use the privileged container to gain access to the node.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Privilege Escalation

+**Severity**: Informational

+### **Process associated with digital currency mining detected**

+(K8S.NODE_CryptoCoinMinerArtifacts) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container detected the execution of a process normally associated with digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution, Exploitation

+**Severity**: Medium

+### **Process seen accessing the SSH authorized keys file in an unusual way**

+(K8S.NODE_SshKeyAccess) ^{[1](#footnote1)}

+**Description**: An SSH authorized_keys file was accessed in a method similar to known malware campaigns. This access could signify that an actor is attempting to gain persistent access to a machine.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Unknown

+**Severity**: Informational

+### **Role binding to the cluster-admin role detected**

+(K8S_ClusterAdminBinding)

+**Description**: Kubernetes audit log analysis detected a new binding to the cluster-admin role which gives administrator privileges. Unnecessary administrator privileges might cause privilege escalation in the cluster.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Informational

+### **Security-related process termination detected**

+(K8S.NODE_SuspectProcessTermination) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected an attempt to terminate processes related to security monitoring on the container. Attackers will often try to terminate such processes using predefined scripts post-compromise.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Low

+### **SSH server is running inside a container**

+(K8S.NODE_ContainerSSH) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container detected an SSH server running inside the container.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Informational

+### **Suspicious file timestamp modification**

+(K8S.NODE_TimestampTampering) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious timestamp modification. Attackers will often copy timestamps from existing legitimate files to new tools to avoid detection of these newly dropped files.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, DefenseEvasion

+**Severity**: Low

+### **Suspicious request to Kubernetes API**

+(K8S.NODE_KubernetesAPI) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container indicates that a suspicious request was made to the Kubernetes API. The request was sent from a container in the cluster. Although this behavior can be intentional, it might indicate that a compromised container is running in the cluster.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: LateralMovement

+**Severity**: Medium

+### **Suspicious request to the Kubernetes Dashboard**

+(K8S.NODE_KubernetesDashboard) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container indicates that a suspicious request was made to the Kubernetes Dashboard. The request was sent from a container in the cluster. Although this behavior can be intentional, it might indicate that a compromised container is running in the cluster.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: LateralMovement

+**Severity**: Medium

+### **Potential crypto coin miner started**

+(K8S.NODE_CryptoCoinMinerExecution) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a process being started in a way normally associated with digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+### **Suspicious password access**

+(K8S.NODE_SuspectPasswordFileAccess) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected suspicious attempt to access encrypted user passwords.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Informational

+### **Possible malicious web shell detected**

+(K8S.NODE_Webshell) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container detected a possible web shell. Attackers will often upload a web shell to a compute resource they have compromised to gain persistence or for further exploitation.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, Exploitation

+**Severity**: Medium

+### **Burst of multiple reconnaissance commands could indicate initial activity after compromise**

+(K8S.NODE_ReconnaissanceArtifactsBurst) ^{[1](#footnote1)}

+**Description**: Analysis of host/device data detected execution of multiple reconnaissance commands related to gathering system or host details performed by attackers after initial compromise.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery, Collection

+**Severity**: Low

+### **Suspicious Download Then Run Activity**

+(K8S.NODE_DownloadAndRunCombo) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a file being downloaded then run in the same command. While this isn't always malicious, this is a very common technique attackers use to get malicious files onto victim machines.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution, CommandAndControl, Exploitation

+**Severity**: Medium

+### **Access to kubelet kubeconfig file detected**

+(K8S.NODE_KubeConfigAccess) ^{[1](#footnote1)}

+**Description**: Analysis of processes running on a Kubernetes cluster node detected access to kubeconfig file on the host. The kubeconfig file, normally used by the Kubelet process, contains credentials to the Kubernetes cluster API server. Access to this file is often associated with attackers attempting to access those credentials, or with security scanning tools which check if the file is accessible.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: CredentialAccess

+**Severity**: Medium

+### **Access to cloud metadata service detected**

+(K8S.NODE_ImdsCall) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container detected access to the cloud metadata service for acquiring identity token. The container doesn't normally perform such operation. While this behavior might be legitimate, attackers might use this technique to access cloud resources after gaining initial access to a running container.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: CredentialAccess

+**Severity**: Medium

+### **MITRE Caldera agent detected**

+(K8S.NODE_MitreCalderaTools) ^{[1](#footnote1)}

+**Description**: Analysis of processes running within a container or directly on a Kubernetes node, has detected a suspicious process. This is often associated with the MITRE 54ndc47 agent, which could be used maliciously to attack other machines.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence, PrivilegeEscalation, DefenseEvasion, CredentialAccess, Discovery, LateralMovement, Execution, Collection, Exfiltration, Command And Control, Probing, Exploitation

+**Severity**: Medium

+^{<a name="footnote1"></a>1}: **Preview for non-AKS clusters**: This alert is generally available for AKS clusters, but it is in preview for other environments, such as Azure Arc, EKS, and GKE.

+^{<a name="footnote2"></a>2}: **Limitations on GKE clusters**: GKE uses a Kubernetes audit policy that doesn't support all alert types. As a result, this security alert, which is based on Kubernetes audit events, is not supported for GKE clusters.

+^{<a name="footnote3"></a>3}: This alert is supported on Windows nodes/containers.

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Defender for APIs

+description: This article lists the security alerts for Defender for APIs visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Defender for APIs

+This article lists the security alerts you might get for Defender for APIs from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Defender for APIs alerts

+### **Suspicious population-level spike in API traffic to an API endpoint**

+ (API_PopulationSpikeInAPITraffic)

+**Description**: A suspicious spike in API traffic was detected at one of the API endpoints. The detection system used historical traffic patterns to establish a baseline for routine API traffic volume between all IPs and the endpoint, with the baseline being specific to API traffic for each status code (such as 200 Success). The detection system flagged an unusual deviation from this baseline leading to the detection of suspicious activity.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Suspicious spike in API traffic from a single IP address to an API endpoint**

+ (API_SpikeInAPITraffic)

+**Description**: A suspicious spike in API traffic was detected from a client IP to the API endpoint. The detection system used historical traffic patterns to establish a baseline for routine API traffic volume to the endpoint coming from a specific IP to the endpoint. The detection system flagged an unusual deviation from this baseline leading to the detection of suspicious activity.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Unusually large response payload transmitted between a single IP address and an API endpoint**

+ (API_SpikeInPayload)

+**Description**: A suspicious spike in API response payload size was observed for traffic between a single IP and one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the typical API response payload size between a specific IP and API endpoint. The learned baseline is specific to API traffic for each status code (for example, 200 Success). The alert was triggered because an API response payload size deviated significantly from the historical baseline.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial access

+**Severity**: Medium

+### **Unusually large request body transmitted between a single IP address and an API endpoint**

+ (API_SpikeInPayload)

+**Description**: A suspicious spike in API request body size was observed for traffic between a single IP and one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the typical API request body size between a specific IP and API endpoint. The learned baseline is specific to API traffic for each status code (for example, 200 Success). The alert was triggered because an API request size deviated significantly from the historical baseline.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial access

+**Severity**: Medium

+### **(Preview) Suspicious spike in latency for traffic between a single IP address and an API endpoint**

+ (API_SpikeInLatency)

+**Description**: A suspicious spike in latency was observed for traffic between a single IP and one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the routine API traffic latency between a specific IP and API endpoint. The learned baseline is specific to API traffic for each status code (for example, 200 Success). The alert was triggered because an API call latency deviated significantly from the historical baseline.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial access

+**Severity**: Medium

+### **API requests spray from a single IP address to an unusually large number of distinct API endpoints**

+(API_SprayInRequests)

+**Description**: A single IP was observed making API calls to an unusually large number of distinct endpoints. Based on historical traffic patterns from the last 30 days, Defenders for APIs learns a baseline that represents the typical number of distinct endpoints called by a single IP across 20-minute windows. The alert was triggered because a single IP's behavior deviated significantly from the historical baseline.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Discovery

+**Severity**: Medium

+### **Parameter enumeration on an API endpoint**

+ (API_ParameterEnumeration)

+**Description**: A single IP was observed enumerating parameters when accessing one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the typical number of distinct parameter values used by a single IP when accessing this endpoint across 20-minute windows. The alert was triggered because a single client IP recently accessed an endpoint using an unusually large number of distinct parameter values.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial access

+**Severity**: Medium

+### **Distributed parameter enumeration on an API endpoint**

+ (API_DistributedParameterEnumeration)

+**Description**: The aggregate user population (all IPs) was observed enumerating parameters when accessing one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the typical number of distinct parameter values used by the user population (all IPs) when accessing an endpoint across 20-minute windows. The alert was triggered because the user population recently accessed an endpoint using an unusually large number of distinct parameter values.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial access

+**Severity**: Medium

+### **Parameter value(s) with anomalous data types in an API call**

+ (API_UnseenParamType)

+**Description**: A single IP was observed accessing one of your API endpoints and using parameter values of a low probability data type (for example, string, integer, etc.). Based on historical traffic patterns from the last 30 days, Defender for APIs learns the expected data types for each API parameter. The alert was triggered because an IP recently accessed an endpoint using a previously low probability data type as a parameter input.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Previously unseen parameter used in an API call**

+ (API_UnseenParam)

+**Description**: A single IP was observed accessing one of the API endpoints using a previously unseen or out-of-bounds parameter in the request. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a set of expected parameters associated with calls to an endpoint. The alert was triggered because an IP recently accessed an endpoint using a previously unseen parameter.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Medium

+### **Access from a Tor exit node to an API endpoint**

+ (API_AccessFromTorExitNode)

+**Description**: An IP address from the Tor network accessed one of your API endpoints. Tor is a network that allows people to access the Internet while keeping their real IP hidden. Though there are legitimate uses, it is frequently used by attackers to hide their identity when they target people's systems online.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Pre-attack

+**Severity**: Medium

+### **API Endpoint access from suspicious IP**

+ (API_AccessFromSuspiciousIP)

+**Description**: An IP address accessing one of your API endpoints was identified by Microsoft Threat Intelligence as having a high probability of being a threat. While observing malicious Internet traffic, this IP came up as involved in attacking other online targets.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Pre-attack

+**Severity**: High

+### **Suspicious User Agent detected**

+ (API_AccessFromSuspiciousUserAgent)

+**Description**: The user agent of a request accessing one of your API endpoints contained anomalous values indicative of an attempt at remote code execution. This does not mean that any of your API endpoints have been breached, but it does suggest that an attempted attack is underway.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Medium

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for DNS

+description: This article lists the security alerts for DNS visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for DNS

+This article lists the security alerts you might get for DNS from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Alerts for DNS

+[Further details and notes](plan-defender-for-servers-select-plan.md)

+### **Anomalous network protocol usage**

+(AzureDNS_ProtocolAnomaly)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected anomalous protocol usage. Such traffic, while possibly benign, might indicate abuse of this common protocol to bypass network traffic filtering. Typical related attacker activity includes copying remote administration tools to a compromised host and exfiltrating user data from it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: -

+### **Anonymity network activity**

+(AzureDNS_DarkWeb)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected anonymity network activity. Such activity, while possibly legitimate user behavior, is frequently employed by attackers to evade tracking and fingerprinting of network communications. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+### **Anonymity network activity using web proxy**

+(AzureDNS_DarkWebProxy)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected anonymity network activity. Such activity, while possibly legitimate user behavior, is frequently employed by attackers to evade tracking and fingerprinting of network communications. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+### **Attempted communication with suspicious sinkholed domain**

+(AzureDNS_SinkholedDomain)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected request for sinkholed domain. Such activity, while possibly legitimate user behavior, is frequently an indication of the download or execution of malicious software. Typical related attacker activity is likely to include the download and execution of further malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Medium

+### **Communication with possible phishing domain**

+(AzureDNS_PhishingDomain)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected a request for a possible phishing domain. Such activity, while possibly benign, is frequently performed by attackers to harvest credentials to remote services. Typical related attacker activity is likely to include the exploitation of any credentials on the legitimate service.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Informational

+### **Communication with suspicious algorithmically generated domain**

+(AzureDNS_DomainGenerationAlgorithm)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected possible usage of a domain generation algorithm. Such activity, while possibly benign, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Informational

+### **Communication with suspicious domain identified by threat intelligence**

+(AzureDNS_ThreatIntelSuspectDomain)

+**Description**: Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access

+**Severity**: Medium

+### **Communication with suspicious random domain name**

+(AzureDNS_RandomizedDomain)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected usage of a suspicious randomly generated domain name. Such activity, while possibly benign, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Informational

+### **Digital currency mining activity**

+(AzureDNS_CurrencyMining)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected digital currency mining activity. Such activity, while possibly legitimate user behavior, is frequently performed by attackers following compromise of resources. Typical related attacker activity is likely to include the download and execution of common mining tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+### **Network intrusion detection signature activation**

+(AzureDNS_SuspiciousDomain)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected a known malicious network signature. Such activity, while possibly legitimate user behavior, is frequently an indication of the download or execution of malicious software. Typical related attacker activity is likely to include the download and execution of further malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Medium

+### **Possible data download via DNS tunnel**

+(AzureDNS_DataInfiltration)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected a possible DNS tunnel. Such activity, while possibly legitimate user behavior, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+### **Possible data exfiltration via DNS tunnel**

+(AzureDNS_DataExfiltration)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected a possible DNS tunnel. Such activity, while possibly legitimate user behavior, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+### **Possible data transfer via DNS tunnel**

+(AzureDNS_DataObfuscation)

+**Description**: Analysis of DNS transactions from %{CompromisedEntity} detected a possible DNS tunnel. Such activity, while possibly legitimate user behavior, is frequently performed by attackers to evade network monitoring and filtering. Typical related attacker activity is likely to include the download and execution of malicious software or remote administration tools.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exfiltration

+**Severity**: Low

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for Linux machines

+description: This article lists the security alerts for Linux machines visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for Linux machines

+This article lists the security alerts you might get for Linux machines from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Linux machines alerts

+Microsoft Defender for Servers Plan 2 provides unique detections and alerts, in addition to the ones provided by Microsoft Defender for Endpoint. The alerts provided for Linux machines are:

+[Further details and notes](defender-for-servers-introduction.md)

+### **A history file has been cleared**

+**Description**: Analysis of host data indicates that the command history log file has been cleared. Attackers might do this to cover their traces. The operation was performed by user: '%{user name}'.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Adaptive application control policy violation was audited**

+(VM_AdaptiveApplicationControlLinuxViolationAudited)

+**Description**: The below users ran applications that are violating the application control policy of your organization on this machine. It can possibly expose the machine to malware or application vulnerabilities.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Informational

+### **Antimalware broad files exclusion in your virtual machine**

+(VM_AmBroadFilesExclusion)

+**Description**: Files exclusion from antimalware extension with broad exclusion rule was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Such exclusion practically disabling the Antimalware protection.

+Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Antimalware disabled and code execution in your virtual machine**

+(VM_AmDisablementAndCodeExecution)

+**Description**: Antimalware disabled at the same time as code execution on your virtual machine. This was detected by analyzing Azure Resource Manager operations in your subscription.

+Attackers disable antimalware scanners to prevent detection while running unauthorized tools or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: High

+### **Antimalware disabled in your virtual machine**

+(VM_AmDisablement)

+**Description**: Antimalware disabled in your virtual machine. This was detected by analyzing Azure Resource Manager operations in your subscription.

+Attackers might disable the antimalware on your virtual machine to prevent detection.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Medium

+### **Antimalware file exclusion and code execution in your virtual machine**

+(VM_AmFileExclusionAndCodeExecution)

+**Description**: File excluded from your antimalware scanner at the same time as code was executed via a custom script extension on your virtual machine. This was detected by analyzing Azure Resource Manager operations in your subscription.

+Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running unauthorized tools or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Antimalware file exclusion and code execution in your virtual machine (temporary)**

+(VM_AmTempFileExclusionAndCodeExecution)

+**Description**: Temporary file exclusion from antimalware extension in parallel to execution of code via custom script extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Antimalware file exclusion in your virtual machine**

+(VM_AmTempFileExclusion)

+**Description**: File excluded from your antimalware scanner on your virtual machine. This was detected by analyzing Azure Resource Manager operations in your subscription.

+Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running unauthorized tools or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Medium

+### **Antimalware real-time protection was disabled in your virtual machine**

+(VM_AmRealtimeProtectionDisabled)

+**Description**: Real-time protection disablement of the antimalware extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+Attackers might disable real-time protection from the antimalware scan on your virtual machine to avoid detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Medium

+### **Antimalware real-time protection was disabled temporarily in your virtual machine**

+(VM_AmTempRealtimeProtectionDisablement)

+**Description**: Real-time protection temporary disablement of the antimalware extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+Attackers might disable real-time protection from the antimalware scan on your virtual machine to avoid detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Medium

+### **Antimalware real-time protection was disabled temporarily while code was executed in your virtual machine**

+(VM_AmRealtimeProtectionDisablementAndCodeExec)

+**Description**: Real-time protection temporary disablement of the antimalware extension in parallel to code execution via custom script extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+Attackers might disable real-time protection from the antimalware scan on your virtual machine to avoid detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: High

+### **Antimalware scans blocked for files potentially related to malware campaigns on your virtual machine (Preview)**

+(VM_AmMalwareCampaignRelatedExclusion)

+**Description**: An exclusion rule was detected in your virtual machine to prevent your antimalware extension scanning certain files that are suspected of being related to a malware campaign. The rule was detected by analyzing the Azure Resource Manager operations in your subscription. Attackers might exclude files from antimalware scans to prevent detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Medium

+### **Antimalware temporarily disabled in your virtual machine**

+(VM_AmTemporarilyDisablement)

+**Description**: Antimalware temporarily disabled in your virtual machine. This was detected by analyzing Azure Resource Manager operations in your subscription.

+Attackers might disable the antimalware on your virtual machine to prevent detection.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Antimalware unusual file exclusion in your virtual machine**

+(VM_UnusualAmFileExclusion)

+**Description**: Unusual file exclusion from antimalware extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running arbitrary code or infecting the machine with malware.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion

+**Severity**: Medium

+### **Behavior similar to ransomware detected [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected the execution of files that have resemblance of known ransomware that can prevent users from accessing their system or personal files, and demands ransom payment in order to regain access. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: High

+### **Communication with suspicious domain identified by threat intelligence**

+(AzureDNS_ThreatIntelSuspectDomain)

+**Description**: Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Initial Access, Persistence, Execution, Command And Control, Exploitation

+**Severity**: Medium

+### **Container with a miner image detected**

+(VM_MinerInContainerImage)

+**Description**: Machine logs indicate execution of a Docker container that runs an image associated with a digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Detected anomalous mix of upper and lower case characters in command line**

+**Description**: Analysis of host data on %{Compromised Host} detected a command line with anomalous mix of upper and lower case characters. This kind of pattern, while possibly benign, is also typical of attackers trying to hide from case-sensitive or hash-based rule matching when performing administrative tasks on a compromised host.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Detected file download from a known malicious source**

+**Description**: Analysis of host data has detected the download of a file from a known malware source on %{Compromised Host}.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Detected suspicious network activity**

+**Description**: Analysis of network traffic from %{Compromised Host} detected suspicious network activity. Such traffic, while possibly benign, is typically used by an attacker to communicate with malicious servers for downloading of tools, command-and-control and exfiltration of data. Typical related attacker activity includes copying remote administration tools to a compromised host and exfiltrating user data from it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Digital currency mining related behavior detected**

+**Description**: Analysis of host data on %{Compromised Host} detected the execution of a process or command normally associated with digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: High

+### **Disabling of auditd logging [seen multiple times]**

+**Description**: The Linux Audit system provides a way to track security-relevant information on the system. It records as much information about the events that are happening on your system as possible. Disabling auditd logging could hamper discovering violations of security policies used on the system. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Exploitation of Xorg vulnerability [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected the user of Xorg with suspicious arguments. Attackers might use this technique in privilege escalation attempts. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Failed SSH brute force attack**

+(VM_SshBruteForceFailed)

+**Description**: Failed brute force attacks were detected from the following attackers: %{Attackers}. Attackers were trying to access the host with the following user names: %{Accounts used on failed sign in to host attempts}.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Probing

+**Severity**: Medium

+### **Fileless attack behavior detected**

+(VM_FilelessAttackBehavior.Linux)

+**Description**: The memory of the process specified below contains behaviors commonly used by fileless attacks.

+Specific behaviors include: {list of observed behaviors}

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: Low

+### **Fileless attack technique detected**

+(VM_FilelessAttackTechnique.Linux)

+**Description**: The memory of the process specified below contains evidence of a fileless attack technique. Fileless attacks are used by attackers to execute code while evading detection by security software.

+Specific behaviors include: {list of observed behaviors}

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Execution

+**Severity**: High

+### **Fileless attack toolkit detected**

+(VM_FilelessAttackToolkit.Linux)

+**Description**: The memory of the process specified below contains a fileless attack toolkit: {ToolKitName}. Fileless attack toolkits typically don't have a presence on the filesystem, making detection by traditional anti-virus software difficult.

+Specific behaviors include: {list of observed behaviors}

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Defense Evasion, Execution

+**Severity**: High

+### **Hidden file execution detected**

+**Description**: Analysis of host data indicates that a hidden file was executed by %{user name}. This activity could either be legitimate activity, or an indication of a compromised host.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Informational

+### **New SSH key added [seen multiple times]**

+(VM_SshKeyAddition)

+**Description**: A new SSH key was added to the authorized keys file. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Persistence

+**Severity**: Low

+### **New SSH key added**

+**Description**: A new SSH key was added to the authorized keys file.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Possible backdoor detected [seen multiple times]**

+**Description**: Analysis of host data has detected a suspicious file being downloaded then run on %{Compromised Host} in your subscription. This activity has previously been associated with installation of a backdoor. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Possible exploitation of the mailserver detected**

+(VM_MailserverExploitation )

+**Description**: Analysis of host data on %{Compromised Host} detected an unusual execution under the mail server account

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: Medium

+### **Possible malicious web shell detected**

+**Description**: Analysis of host data on %{Compromised Host} detected a possible web shell. Attackers will often upload a web shell to a machine they've compromised to gain persistence or for further exploitation.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Possible password change using crypt-method detected [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected password change using crypt method. Attackers can make this change to continue access and gaining persistence after compromise. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Process associated with digital currency mining detected [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected the execution of a process normally associated with digital currency mining. This behavior was seen over 100 times today on the following machines: [Machine name]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Process associated with digital currency mining detected**

+**Description**: Host data analysis detected the execution of a process that is normally associated with digital currency mining.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation, Execution

+**Severity**: Medium

+### **Python encoded downloader detected [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected the execution of encoded Python that downloads and runs code from a remote location. This might be an indication of malicious activity. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Screenshot taken on host [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected the user of a screen capture tool. Attackers might use these tools to access private data. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Low

+### **Shellcode detected [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected shellcode being generated from the command line. This process could be legitimate activity, or an indication that one of your machines has been compromised. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Successful SSH brute force attack**

+(VM_SshBruteForceSuccess)

+**Description**: Analysis of host data has detected a successful brute force attack. The IP %{Attacker source IP} was seen making multiple login attempts. Successful logins were made from that IP with the following user(s): %{Accounts used to successfully sign in to host}. This means that the host might be compromised and controlled by a malicious actor.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: High

+### **Suspicious Account Creation Detected**

+**Description**: Analysis of host data on %{Compromised Host} detected creation or use of a local account %{Suspicious account name} : this account name closely resembles a standard Windows account or group name '%{Similar To Account Name}'. This is potentially a rogue account created by an attacker, so named in order to avoid being noticed by a human administrator.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Suspicious kernel module detected [seen multiple times]**

+**Description**: Analysis of host data on %{Compromised Host} detected a shared object file being loaded as a kernel module. This could be legitimate activity, or an indication that one of your machines has been compromised. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Medium

+### **Suspicious password access [seen multiple times]**

+**Description**: Analysis of host data has detected suspicious access to encrypted user passwords on %{Compromised Host}. This behavior was seen [x] times today on the following machines: [Machine names]

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Informational

+### **Suspicious password access**

+**Description**: Analysis of host data has detected suspicious access to encrypted user passwords on %{Compromised Host}.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: -

+**Severity**: Informational

+### **Suspicious request to the Kubernetes Dashboard**

+(VM_KubernetesDashboard)

+**Description**: Machine logs indicate that a suspicious request was made to the Kubernetes Dashboard. The request was sent from a Kubernetes node, possibly from one of the containers running in the node. Although this behavior can be intentional, it might indicate that the node is running a compromised container.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: LateralMovement

+**Severity**: Medium

+### **Unusual config reset in your virtual machine**

+(VM_VMAccessUnusualConfigReset)

+**Description**: An unusual config reset was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+While this action might be legitimate, attackers can try utilizing VM Access extension to reset the configuration in your virtual machine and compromise it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Unusual user password reset in your virtual machine**

+(VM_VMAccessUnusualPasswordReset)

+**Description**: An unusual user password reset was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+While this action might be legitimate, attackers can try utilizing the VM Access extension to reset the credentials of a local user in your virtual machine and compromise it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Unusual user SSH key reset in your virtual machine**

+(VM_VMAccessUnusualSSHReset)

+**Description**: An unusual user SSH key reset was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.

+While this action might be legitimate, attackers can try utilizing VM Access extension to reset SSH key of a user account in your virtual machine and compromise it.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Credential Access

+**Severity**: Medium

+### **Suspicious installation of GPU extension in your virtual machine (Preview)**

+ (VM_GPUDriverExtensionUnusualExecution)

+**Description**: Suspicious installation of a GPU extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. Attackers might use the GPU driver extension to install GPU drivers on your virtual machine via the Azure Resource Manager to perform cryptojacking.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Impact

+**Severity**: Low

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Alerts for open-source relational databases

+description: This article lists the security alerts for open-source relational databases visible in Microsoft Defender for Cloud.

+ai-usage: ai-assisted

+# Alerts for open-source relational databases

+This article lists the security alerts you might get for open-source relational databases from Microsoft Defender for Cloud and any Microsoft Defender plans you enabled. The alerts shown in your environment depend on the resources and services you're protecting, and your customized configuration.

+> [!NOTE]

+> Some of the recently added alerts powered by Microsoft Defender Threat Intelligence and Microsoft Defender for Endpoint might be undocumented.

+[Learn how to respond to these alerts](managing-and-responding-alerts.yml).

+[Learn how to export alerts](continuous-export.md).

+> [!NOTE]

+> Alerts from different sources might take different amounts of time to appear. For example, alerts that require analysis of network traffic might take longer to appear than alerts related to suspicious processes running on virtual machines.

+## Open-source relational databases alerts

+[Further details and notes](defender-for-databases-introduction.md)

+### **Suspected brute force attack using a valid user**

+(SQL.PostgreSQL_BruteForce

+SQL.MariaDB_BruteForce

+SQL.MySQL_BruteForce)

+**Description**: A potential brute force attack has been detected on your resource. The attacker is using the valid user (username), which has permissions to log in.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Suspected successful brute force attack**

+(SQL.PostgreSQL_BruteForce

+SQL.MySQL_BruteForce

+SQL.MariaDB_BruteForce)

+**Description**: A successful login occurred after an apparent brute force attack on your resource.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: High

+### **Suspected brute force attack**

+(SQL.PostgreSQL_BruteForce

+SQL.MySQL_BruteForce

+SQL.MariaDB_BruteForce)

+**Description**: A potential brute force attack has been detected on your resource.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+### **Attempted logon by a potentially harmful application**

+(SQL.PostgreSQL_HarmfulApplication

+SQL.MariaDB_HarmfulApplication

+SQL.MySQL_HarmfulApplication)

+**Description**: A potentially harmful application attempted to access your resource.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: High/Medium

+### **Login from a principal user not seen in 60 days**

+(SQL.PostgreSQL_PrincipalAnomaly

+SQL.MariaDB_PrincipalAnomaly

+SQL.MySQL_PrincipalAnomaly)

+**Description**: A principal user not seen in the last 60 days has logged into your database. If this database is new or this is expected behavior caused by recent changes in the users accessing the database, Defender for Cloud will identify significant changes to the access patterns and attempt to prevent future false positives.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: Low

+### **Login from a domain not seen in 60 days**

+(SQL.MariaDB_DomainAnomaly

+SQL.PostgreSQL_DomainAnomaly

+SQL.MySQL_DomainAnomaly)

+**Description**: A user has logged in to your resource from a domain no other users have connected from in the last 60 days. If this resource is new or this is expected behavior caused by recent changes in the users accessing the resource, Defender for Cloud will identify significant changes to the access patterns and attempt to prevent future false positives.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: Medium

+### **Log on from an unusual Azure Data Center**

+(SQL.PostgreSQL_DataCenterAnomaly

+SQL.MariaDB_DataCenterAnomaly

+SQL.MySQL_DataCenterAnomaly)

+**Description**: Someone logged on to your resource from an unusual Azure Data Center.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Probing

+**Severity**: Low

+### **Logon from an unusual cloud provider**

+(SQL.PostgreSQL_CloudProviderAnomaly

+SQL.MariaDB_CloudProviderAnomaly

+SQL.MySQL_CloudProviderAnomaly)

+**Description**: Someone logged on to your resource from a cloud provider not seen in the last 60 days. It's quick and easy for threat actors to obtain disposable compute power for use in their campaigns. If this is expected behavior caused by the recent adoption of a new cloud provider, Defender for Cloud will learn over time and attempt to prevent future false positives.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: Medium

+### **Log on from an unusual location**

+(SQL.MariaDB_GeoAnomaly

+SQL.PostgreSQL_GeoAnomaly

+SQL.MySQL_GeoAnomaly)

+**Description**: Someone logged on to your resource from an unusual Azure Data Center.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: Exploitation

+**Severity**: Medium

+### **Login from a suspicious IP**

+(SQL.PostgreSQL_SuspiciousIpAnomaly

+SQL.MariaDB_SuspiciousIpAnomaly

+SQL.MySQL_SuspiciousIpAnomaly)

+**Description**: Your resource has been accessed successfully from an IP address that Microsoft Threat Intelligence has associated with suspicious activity.

+**[MITRE tactics](alerts-reference.md#mitre-attck-tactics)**: PreAttack

+**Severity**: Medium

+> [!NOTE]

+> For alerts that are in preview: [!INCLUDE [Legalese](../../includes/defender-for-cloud-preview-legal-text.md)]

+## Next steps

+- [Security alerts in Microsoft Defender for Cloud](alerts-overview.md)

+- [Manage and respond to security alerts in Microsoft Defender for Cloud](managing-and-responding-alerts.yml)

+- [Continuously export Defender for Cloud data](continuous-export.md)

+ Title: Reference guide for security alerts

+description: This article links to the various security alerts visible in Microsoft Defender for Cloud.

+This article provides links to pages listing the security alerts you may receive from Microsoft Defender for Cloud and any enabled Microsoft Defender plans. The alerts displayed in your environment depend on the resources and services you are protecting and your customized configuration.

+This page also includes a table describing the Microsoft Defender for Cloud kill chain aligned with version 9 of the [MITRE ATT&CK matrix](https://attack.mitre.org/versions/v9/).