What's changed: Deepened AZ-500 Chapter 4 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
4.1Logging, Monitoring, and Security Alerts
Understand Azure Monitor, the Log Analytics workspace, and diagnostic settings as the foundation of security operations. Recording what happened and collecting/analyzing/retaining logs is the prerequisite for detection and investigation.
To detect and investigate attacks, you first need records of "what happened." In Azure, diagnostic settings route each resource’s logs into a Log Analytics workspace for analysis.
4.1.1Collecting and analyzing logs
- Log Analytics workspace: the store that aggregates/retains logs and is queried with KQL (Kusto Query Language).
- Diagnostic settings: route each resource’s logs/metrics to a workspace, storage, or Event Hub.
- Activity log: records operations in the subscription (who changed what).
- Alerts: fire on metric or log-query conditions and notify/automate via action groups.
Common on AZ-500: aggregate logs and analyze with KQL = Log Analytics workspace, decide where resource logs go = diagnostic settings, who changed what = activity log, fire on conditions and notify = alerts + action groups. Sentinel also runs on this workspace.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.