Microsoft Certified: Azure Security Engineer AssociateManage security operationsMedium
A company is using Azure Monitor and Log Analytics to collect security logs from various Azure resources. They want to create a custom alert that triggers when more than 5 failed login attempts occur within a 10-minute window from the same source IP address against any virtual machine. Which component of Azure Monitor is best suited for defining and managing this type of alert?
- AAzure Activity Log Alerts
- BAzure Monitor Metrics
- CAzure Monitor Workbooks
- DLog Analytics Queries (KQL) and Alert Rules
Show answer & explanationAnswer & explanation
Correct answer: D. Log Analytics Queries (KQL) and Alert Rules
Log Analytics queries written in KQL (Kusto Query Language) can be used to analyze log data for specific patterns, such as multiple failed logins. These queries can then be integrated into Azure Monitor alert rules to trigger notifications when the specified conditions are met.
Why the other options are wrong
- A. Activity Log Alerts monitor events in the Azure Activity Log (control plane), not guest OS login attempts in Log Analytics workspaces.
- B. Metrics are numerical values collected at regular intervals, not typically used for complex log pattern analysis like failed logins.
- C. Workbooks are for data visualization and reporting, not for defining proactive alerts based on log patterns.
Log Alerts in Azure Monitor
Azure Monitor log alerts use Kusto Query Language (KQL) to evaluate resources logs at a specified frequency. If the query results indicate a specific condition, an alert is triggered, notifying users or initiating automated actions.
- Uses KQL for flexible log pattern matching.
- Evaluates logs from Log Analytics workspaces.
- Can trigger alerts based on count, average, minimum, maximum, total, or unique count.
- Supports various action groups for notifications and automation.
Memory trick: Monitor your logs with KQL and alert rules to catch anomalies.