Skip to content

Commit 0ac4cfa

Browse files
Stacyrch140Stacyrch140
authored
Merge pull request #262612 from dcurwin/inbal-troubleshooting-jan7-2024
Inbal troubleshooting jan7 2024
2 parents 0f94727 + fbf1137 commit 0ac4cfa

1 file changed

Lines changed: 85 additions & 2 deletions

File tree

‎articles/defender-for-cloud/troubleshooting-guide.md‎

Lines changed: 85 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ ms.topic: conceptual
77
ms.custom: ignite-2022
88
ms.date: 06/18/2023
99
---
10+
1011
# Microsoft Defender for Cloud Troubleshooting Guide
1112

1213
This guide is for information technology (IT) professionals, information security analysts, and cloud administrators whose organizations need to troubleshoot Defender for Cloud related issues.
@@ -52,13 +53,95 @@ AWS connector issues:
5253
- Make sure that EKS clusters are successfully connected to Arc-enabled Kubernetes.
5354
- If you don't see AWS data in Defender for Cloud, make sure that the AWS resources required to send data to Defender for Cloud exist in the AWS account.
5455

56+
Defender API calls to AWS:
57+
58+
Cost impact: When you onboard your AWS single or management account, our Discovery service initiates an immediate scan of your environment by executing API calls to various service endpoints in order to retrieve all resources that we secure.
59+
60+
Following this initial scan, the service will continue to periodically scan your environment at the interval that you configured during onboarding. It's important to note that in AWS, each API call to the account generates a lookup event that is recorded in the CloudTrail resource.
61+
62+
The CloudTrail resource incurs costs, and the pricing details can be found in [AWS CloudTrail Pricing](https://aws.amazon.com/cloudtrail/pricing/).
63+
64+
Furthermore, if you have connected your CloudTrail to GuardDuty, you're also responsible for associated costs, which can be found in the [GuardDuty documentation](https://docs.aws.amazon.com/guardduty/latest/ug/monitoring_costs.html).
65+
66+
**Getting the number of native API calls executed by Defender for Cloud**:
67+
68+
There are two ways to get the number of calls made by Defender for Cloud and both rely on querying AWS CloudTrail logs:
69+
70+
- **CloudTrail and Athena tables**:
71+
72+
1. Use an existing or create a new *Athena table*. For more information, see [Querying AWS CloudTrail logs](https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html).
73+
74+
1. Navigate to the above Athena table and use one of the below predefined queries per your needs.
75+
76+
- **CloudTrail lake**:
77+
78+
1. Use an existing or create a new *Event Data Store*. For more information, see [Working with AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html).
79+
80+
1. Navigate to the above lake and use one of the below predefined queries per your needs.
81+
82+
Sample Queries:
83+
84+
- List the number of overall API calls by Defender for Cloud:
85+
86+
```sql
87+
SELECT COUNT(*) AS overallApiCallsCount FROM <TABLE-NAME>
88+
WHERE userIdentity.arn LIKE 'arn:aws:sts::<YOUR-ACCOUNT-ID>:assumed-role/CspmMonitorAws/MicrosoftDefenderForClouds_<YOUR-AZURE-TENANT-ID>'
89+
AND eventTime > TIMESTAMP '<DATETIME>'
90+
```
91+
92+
- List the number of overall API calls by Defender for Cloud aggregated by day:
93+
94+
```sql
95+
SELECT DATE(eventTime) AS apiCallsDate, COUNT(*) AS apiCallsCountByRegion FROM <TABLE-NAME>
96+
WHERE userIdentity.arn LIKE 'arn:aws:sts:: <YOUR-ACCOUNT-ID>:assumed-role/CspmMonitorAws/MicrosoftDefenderForClouds_<YOUR-AZURE-TENANT-ID>'
97+
AND eventTime > TIMESTAMP '<DATETIME>' GROUP BY DATE(eventTime)
98+
```
99+
100+
- List the number of overall API calls by Defender for Cloud aggregated by event name:
101+
102+
```sql
103+
SELECT eventName, COUNT(*) AS apiCallsCountByEventName FROM <TABLE-NAME>
104+
WHERE userIdentity.arn LIKE 'arn:aws:sts::<YOUR-ACCOUNT-ID>:assumed-role/CspmMonitorAws/MicrosoftDefenderForClouds_<YOUR-AZURE-TENANT-ID>'
105+
AND eventTime > TIMESTAMP '<DATETIME>' GROUP BY eventName
106+
```
107+
108+
- List the number of overall API calls by Defender for Cloud aggregated by region:
109+
110+
```sql
111+
SELECT awsRegion, COUNT(*) AS apiCallsCountByRegion FROM <TABLE-NAME>
112+
WHERE userIdentity.arn LIKE 'arn:aws:sts::120589537074:assumed-role/CspmMonitorAws/MicrosoftDefenderForClouds_<YOUR-AZURE-TENANT-ID>'
113+
AND eventTime > TIMESTAMP '<DATETIME>' GROUP BY awsRegion
114+
```
115+
116+
- The TABLE-NAME is Athena table or Event data store ID
117+
55118
GCP connector issues:
56119

57120
- Make sure that the GCP Cloud Shell script completed successfully.
58121
- Make sure that GKE clusters are successfully connected to Arc-enabled Kubernetes.
59122
- Make sure that Azure Arc endpoints are in the firewall allowlist. The GCP connector makes API calls to these endpoints to fetch the necessary onboarding files.
60123
- If the onboarding of GCP projects failed, make sure you have “compute.regions.list” permission and Microsoft Entra permission to create the service principle used as part of the onboarding process. Make sure that the GCP resources `WorkloadIdentityPoolId`, `WorkloadIdentityProviderId`, and `ServiceAccountEmail` are created in the GCP project.
61124

125+
Defender API calls to GCP:
126+
127+
When you onboard your GCP single project or organization, our Discovery service initiates an immediate scan of your environment by executing API calls to various service endpoints in order to retrieve all resources that we secure.
128+
129+
Following this initial scan, the service will continue to periodically scan your environment at the interval that you configured during onboarding.
130+
131+
**Getting the number of native API calls executed by Defender for Cloud**:
132+
133+
1. Go to **Logging** -> **Log Explorer**
134+
135+
1. Filter the dates as you wish (for example, 1d)
136+
137+
1. To show API calls executed by Defender for Cloud, run this query:
138+
139+
```json
140+
protoPayload.authenticationInfo.principalEmail : "microsoft-defender"
141+
```
142+
143+
Refer to the histogram to see the number of calls over time.
144+
62145
## Troubleshooting the Log Analytics agent
63146

64147
Defender for Cloud uses the Log Analytics agent to [collect and store data](./monitoring-components.md#log-analytics-agent). The information in this article represents Defender for Cloud functionality after transition to the Log Analytics agent.
@@ -148,9 +231,9 @@ If you are not able to onboard your Azure DevOps organization, follow the follow
148231
- It is important to know which account you are logged in to when you authorize the access, as that will be the account that is used. Your account can be associated with the same email address but also associated with different tenants. You should [check which account](https://app.vssps.visualstudio.com/profile/view) you are currently logged in on and ensure that the right account and tenant combination is selected.
149232
150233
1. On your profile page, select the drop-down menu to select another account.
151-
234+
152235
:::image type="content" source="./media/troubleshooting-guide/authorize-select-tenant.png" alt-text="Screenshot of the Azure DevOps profile page that is used to select an account.":::
153-
236+
154237
1. After selecting the correct account/tenant combination, navigate to **Environment settings** in Defender for Cloud and edit your Azure DevOps connector. You will have the option to Re-authorize the connector, which will update the connector with the correct account/tenant combination. You should then see the correct list of organizations from the drop-down selection menu.
155238
156239
- Ensure you have **Project Collection Administrator** role on the Azure DevOps organization you wish to onboard.

0 commit comments

Comments
 (0)