azure-defender-for-cloud

# Azure Defender For Cloud Skill

This skill provides expert guidance for Azure Defender For Cloud. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

## How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:
- **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
- **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

## Category Index

| Category | Lines | Description |
|----------|-------|-------------|
| Troubleshooting | L37-L72 | Diagnosing and fixing Defender for Cloud issues across Kubernetes, APIs, storage, databases, SQL, AWS/GCP connectors, alerts, incidents, and deployment or configuration problems. |
| Best Practices | L73-L99 | Hands-on guidance for investigating, prioritizing, and remediating Defender for Cloud security findings (CSPM, containers, VMs, APIs, endpoints, secrets, networking, attack paths) |
| Decision Making | L100-L118 | Guidance for planning and choosing Defender for Cloud plans, costs, portals, integrations, and migrations (e.g., Storage, Servers, Containers, agents, and regional/plan availability). |
| Architecture & Design Patterns | L119-L127 | Architectural guidance for Defender for Servers/Containers: agentless VM malware scanning, data collection design, workspace/data residency planning, and deployment/topology patterns. |
| Limits & Quotas | L128-L137 | Limits, quotas, and constraints for Defender for Cloud: data ingestion and extensions, portal and DevOps feature limits, alert export caps, and free trial scope/prerequisites. |
| Security | L138-L219 | Configuring and managing Defender for Cloud security: alerts, recommendations, permissions/RBAC, CIEM, AI/API/Kubernetes/container/SQL/storage protections, and secure access, scanning, and policies across clouds. |
| Configuration | L220-L289 | Configuring Defender for Cloud features: enabling plans, scanners, alerts, policies, exports, integrations, and tuning coverage/scope for servers, containers, storage, databases, DevOps, and APIs. |
| Integrations & Coding Patterns | L290-L325 | Patterns and APIs for integrating Defender for Cloud with CI/CD, DevOps, SIEM, ITSM (ServiceNow), partner tools, SQL VA, Power BI, and multi-cloud logging, plus automation via CLI/PowerShell/ARG. |
| Deployment | L326-L345 | Guides for deploying, enabling, migrating, and safely removing Defender for Cloud components (Servers, SQL, Storage, Containers), including CI/CD, policy/CLI/REST/PowerShell, and support matrices. |

### Troubleshooting
| Topic | URL |
|-------|-----|
| Understand and validate Kubernetes alerts in Defender for Containers | https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-containers |
| Investigate sensitive data risks with Defender | https://learn.microsoft.com/en-us/azure/defender-for-cloud/data-security-review-risks |
| Validate and test Microsoft Defender for APIs alerts | https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-apis-validation |
| Troubleshoot Defender for Containers deployment and findings issues | https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-troubleshoot |
| Respond to Microsoft Defender for DNS security alerts | https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-dns-alerts |
| Investigate and remediate Defender for Resource Manager alerts | https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-resource-manager-usage |
| Reference deprecated Defender for Cloud alert IDs | https://learn.microsoft.com/en-us/azure/defender-for-cloud/deprecated-alerts |
| Remediate Defender for Cloud endpoint detection gaps | https://learn.microsoft.com/en-us/azure/defender-for-cloud/endpoint-detection-response-solution-recommendations |
| Troubleshoot and understand Defender for Containers protection | https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-containers |
| Resolve common issues with Defender for Databases | https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-databases |
| Resolve common issues in Defender for DevOps security | https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-devops |
| Resolve common issues with Defender for Storage | https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-storage |
| Troubleshoot Defender for Storage classic behavior | https://learn.microsoft.com/en-us/azure/defender-for-cloud/faq-defender-for-storage-classic |
| Identify MMA-protected SQL Servers before Azure Arc migration | https://learn.microsoft.com/en-us/azure/defender-for-cloud/identify-sql-servers-protected-by-monitor-agent |
| Investigate and triage Defender for Cloud incidents | https://learn.microsoft.com/en-us/azure/defender-for-cloud/incidents |
| Use Defender for Cloud incident reference catalog | https://learn.microsoft.com/en-us/azure/defender-for-cloud/incidents-reference |
| Handle malware alerts on Kubernetes nodes in Defender | https://learn.microsoft.com/en-us/azure/defender-for-cloud/kubernetes-nodes-malware