| Table of Contents | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Purpose
An analyst wants to detect abusive resource consumption in Azure Virtual Machines. Using the VM Metrics Azure collector to send CPU and disk usage to Devo, the analyst will find machines with too much resource usage. As a result, the analyst will remove the malicious mining programs, preventing them from degrading service and stealing compute.
...
Open Subscriptions.
Select the correct subscription and note the subscription ID.
Select Access control (IAM) in the left menu and click Add and Add role assignment.
Select the Monitoring Reader role. REPLACE SCREENSHOT
Click “Select members” and add the VM Metrics application.
...
In the Cloud Collector App, create an Azure Collector instance using this parameters template, replacing the values enclosed in < >.
| Code Block |
|---|
{
"inputs": {
"azure": {
"credentials": {
"client_id": "<CLIENT ID>",
"client_secret": "<SECRET>",
"subscription_id": "<SUBSCRIPTION>",
"tenant_id": "<TENANT>"
},
"enabled": true,
"id": "<UNIQUE ID>",
"services": {
"vm_metrics": {}
}
}
}
} |
The secret must be a secret value containing a tilde.
Secure It
Cryptominer
Detect excessive CPU usage , which may be caused by mining software that is stealing CPU.
...