You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains an instance of Azure Database for PostgreSQL. You…

Microsoft Defender for open-source relational databases is a specific plan within Microsoft Defender for Cloud designed to provide advanced threat protection for services like Azure Database for PostgreSQL. When enabled, it automatically detects anomalous database activities, including potential brute force attacks, without requiring manual rule configuration. It generates security alerts that can be configured to send email notifications directly from the Defender for Cloud settings. This is the most direct solution that meets the requirement to alert on brute force attacks with minimal administrative effort.

A. An Azure Monitor alert rule would require you to manually write and maintain a complex Kusto Query Language (KQL) query to analyze logs for brute force patterns, which contradicts the "minimize administrative effort" requirement.

C. The Azure Monitor activity log records subscription-level management events (e.g., creating or deleting resources). It does not contain the granular data-plane authentication logs needed to detect a database brute force attack.

D. The PostgreSQL Audit extension (pgAudit) only generates detailed audit logs. It does not, by itself, analyze these logs for threats or trigger alerts. You would still need another service, like Azure Monitor, to process the logs and create an alert, adding administrative overhead.

1. Microsoft Learn

Microsoft Defender for Cloud documentation. "Overview of Microsoft Defender for open-source relational databases". This document states

"Microsoft Defender for open-source relational databases detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases." It covers Azure Database for PostgreSQL.

2. Microsoft Learn

Microsoft Defender for Cloud documentation. "Reference table for all security alerts in Microsoft Defender for Cloud". Under the "Alerts for open-source relational databases" section

the alert A potential brute force attack is explicitly listed for Azure Database for PostgreSQL

confirming this capability is built-in.

3. Microsoft Learn

Microsoft Defender for Cloud documentation. "Configure email notifications for security alerts". This guide details the straightforward process of setting up email notifications for alerts generated by Defender for Cloud

stating

"You can specify an email address... to receive notifications for alerts on their subscription." This fulfills the email alert requirement with minimal configuration.

4. Microsoft Learn

Azure Database for PostgreSQL documentation. "Audit logging in Azure Database for PostgreSQL - Flexible Server". This document explains that pgAudit is used for logging and that "To analyze your pgAudit logs

you can use Azure Monitor Logs." This confirms that pgAudit is only a data source and requires a separate service for analysis and alerting.