Microsoft Azure Sentinel can now detect Apache Log4j vulnerabilities

Reading time icon 1 min. read

Readers help support MSPoweruser. When you make a purchase using links on our site, we may earn an affiliate commission. Tooltip Icon

Read the affiliate disclosure page to find out how can you help MSPoweruser effortlessly and without spending any money. Read more

Microsoft Azure Sentinel is Microsoft’s native Security Information and Event Management (SIEM) tool built within Azure. Azure Sentinel enables SecOps teams to see and stop threats before they cause any harm to the organizations. Azure Sentinel is powered by AI to reduce noise and Microsoft claims that you can see an overall reduction of up to 90 percent in alert fatigue.

Microsoft’s security research teams has been tracking threats taking advantage of the remote code execution (RCE) vulnerability in Apache Log4j 2 referred to as “Log4Shell” and tracked as CVE-2021-44228. The vulnerability allows unauthenticated remote code execution and is triggered when a specially crafted string provided by the attacker through a variety of different input vectors is parsed and processed by the Log4j 2 vulnerable component.

The company has now announced that a new Microsoft Sentinel solution has been added to the Content Hub that provides content to monitor, detect and investigate signals related to exploitation of the recently disclosed Log4j vulnerability.

For technical and mitigation information about the vulnerability, please read:

Guidance for preventing, detecting, and hunting for CVE-2021-44228 Log4j 2 exploitation.

via RedMondMag

More about the topics: Apache Log4j, Azure Sentinel, microsoft, Microsoft Azure Sentinel, security

Leave a Reply

Your email address will not be published. Required fields are marked *