{"id":4954,"date":"2016-01-28T00:00:00","date_gmt":"2016-01-28T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/machine-learning-in-azure-security-center"},"modified":"2025-06-26T10:03:37","modified_gmt":"2025-06-26T17:03:37","slug":"machine-learning-in-azure-security-center","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/","title":{"rendered":"Machine Learning in Azure Security Center"},"content":{"rendered":"\n

At Microsoft, we analyze 300 billion user authentications and check 200 billion emails for spam and malware monthly. We also have unprecedented visibility into cloud infrastructure choices, platforms and the activity therein. Such visibility has no precedent in the on-premises world.<\/p>\n\n\n\n

Sounds great, right? But, how do you make sense of so much data and turn it into cyber security?<\/p>\n\n\n\n

With Azure Security Center<\/a>, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security. To make use of all this data, we extensively leverage data science, in particular Machine Learning, for threat prevention, detection and eventually investigation.<\/p>\n\n\n\n

Broadly speaking, we use Machine Learning to achieve two outcomes:<\/p>\n\n\n\n

    \n
  1. Next-generation detection<\/li>\n\n\n\n
  2. Simplified security management<\/li>\n<\/ol>\n\n\n\n

    Next-generation detection<\/h1>\n\n\n\n

    Attackers are increasingly automated and sophisticated. They use data science too. They reverse-engineer protections and build systems that support mutations in behavior. They masquerade their activities as noise, and learn quickly from mistakes. Machine learning helps us respond to these developments.<\/p>\n\n\n\n

    Machine Learning strengthens rule-based detections<\/a><\/h3>\n\n\n\n

    Take, for example, a security rules that locks an account after X failed logins. For a developer machine, X should be low, but for a busy server, it should be high. Machine Learning helps us automatically determine the right X a given resource should tolerate, without developing custom analysis for each individual resource.<\/p>\n\n\n\n

    Supervised Machine Learning models<\/h3>\n\n\n\n

    We train supervised Machine Learning models by presenting them with malicious and benign examples. The model then generalizes the examples into an algorithm. These examples are very hard to find and analyze. However, Microsoft can take advantage of its vast global threat intelligence and security expertise to develop highly tuned models using a wealth of analyzed examples.<\/p>\n\n\n\n

    Machine Learning quickly adapts to moving targets<\/h3>\n\n\n\n

    Once blocked, attackers will slightly change their behavior in order to go under the radar. Our machine learning models react to these changes automatically.<\/p>\n\n\n\n

    Unsupervised Machine Learning models can work in the absence of examples<\/h3>\n\n\n\n

    For example, if a database typically exhibits a certain network imprint, but one day we see something else, Azure Security Center can flag the activity as suspicious.<\/p>\n\n\n\n

    Simplifying security<\/h1>\n\n\n\n

    Making effective security decisions is not easy. It requires security experience and expertise. While some large organizations have such experts on staff, many companies don\u2019t. We use Machine Learning to enable customers to benefit from the wisdom of other organizations when making security decisions.<\/p>\n\n\n\n

    Actionable recommendations<\/h3>\n\n\n\n

    We can give customers actionable recommendations based on Machine Learning models that compare them to a reference group with similar needs, deployments, security events, etc.\u2014without compromising privacy. Our aim is to help customers know what their security performance is and what to do in order to address their own pain points.<\/p>\n\n\n\n

    Noise reduction<\/h3>\n\n\n\n

    Security appliances are notoriously noisy. It can take an expert to distinguish important alerts from noise. We employ several mechanisms to automate noise reduction as much as possible, providing better security insights to the non-expert.<\/p>\n\n\n\n

    We are incredibly excited about the potential that Machine Learning has to help you improve the security of your resources in Azure\u2014both today and in the future as we develop increasingly advanced models. If the techniques I described here have piqued your interest, try Azure Security Center today by clicking Browse and typing \u201csecurity\u201d in your Azure portal<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ms_queue_id":[],"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","_alt_title":"","footnotes":"","msx_community_cta_settings":[]},"categories":[1454,1459],"tags":[],"audience":[3057,3055,3053,3056],"content-type":[1511],"product":[1798],"tech-community":[],"topic":[],"coauthors":[967],"class_list":["post-4954","post","type-post","status-publish","format-standard","hentry","category-ai-machine-learning","category-security","audience-data-professionals","audience-developers","audience-it-decision-makers","audience-it-implementors","content-type-best-practices","product-azure-security-center","review-flag-lever-1680286579-649","review-flag-machi-1680286585-314","review-flag-partn-1680286579-901"],"yoast_head":"\nMachine Learning in Azure Security Center | Microsoft Azure Blog<\/title>\n<meta name=\"description\" content=\"With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Machine Learning in Azure Security Center | Microsoft Azure Blog\" \/>\n<meta property=\"og:description\" content=\"With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Azure Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/microsoftazure\" \/>\n<meta property=\"article:published_time\" content=\"2016-01-28T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-26T17:03:37+00:00\" \/>\n<meta name=\"author\" content=\"Royi Ronen\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@azure\" \/>\n<meta name=\"twitter:site\" content=\"@azure\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Royi Ronen\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\"},\"author\":[{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/dr-royi-ronen\/\",\"@type\":\"Person\",\"@name\":\"Royi Ronen\"}],\"headline\":\"Machine Learning in Azure Security Center\",\"datePublished\":\"2016-01-28T00:00:00+00:00\",\"dateModified\":\"2025-06-26T17:03:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\"},\"wordCount\":555,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization\"},\"articleSection\":[\"AI + machine learning\",\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\",\"name\":\"Machine Learning in Azure Security Center | Microsoft Azure Blog\",\"isPartOf\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#website\"},\"datePublished\":\"2016-01-28T00:00:00+00:00\",\"dateModified\":\"2025-06-26T17:03:37+00:00\",\"description\":\"With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.\",\"breadcrumb\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog home\",\"item\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI + machine learning\",\"item\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/category\/ai-machine-learning\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Machine Learning in Azure Security Center\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#website\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/\",\"name\":\"Microsoft Azure Blog\",\"description\":\"Get the latest Azure news, updates, and announcements from the Azure blog. From product updates to hot topics, hear from the Azure experts.\",\"publisher\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization\",\"name\":\"Microsoft Azure Blog\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp\",\"contentUrl\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Azure Blog\"},\"image\":{\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/microsoftazure\",\"https:\/\/x.com\/azure\",\"https:\/\/www.instagram.com\/microsoftdeveloper\/\",\"https:\/\/www.linkedin.com\/company\/16188386\",\"https:\/\/www.youtube.com\/user\/windowsazure\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/person\/c702e5edd662b328b49b7e1180cab117\",\"name\":\"shakir\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/9342c7c05bb16548741bc5cd3a3e3b7ee0c8e746844ad2cc582db5beb5514c6f?s=96&d=mm&r=g7664e653ea371ce16eaf75e9fa8952c4\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/9342c7c05bb16548741bc5cd3a3e3b7ee0c8e746844ad2cc582db5beb5514c6f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/9342c7c05bb16548741bc5cd3a3e3b7ee0c8e746844ad2cc582db5beb5514c6f?s=96&d=mm&r=g\",\"caption\":\"shakir\"},\"sameAs\":[\"https:\/\/azure.microsoft.com\"],\"url\":\"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/shakir\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Machine Learning in Azure Security Center | Microsoft Azure Blog","description":"With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/","og_locale":"en_US","og_type":"article","og_title":"Machine Learning in Azure Security Center | Microsoft Azure Blog","og_description":"With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.","og_url":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/","og_site_name":"Microsoft Azure Blog","article_publisher":"https:\/\/www.facebook.com\/microsoftazure","article_published_time":"2016-01-28T00:00:00+00:00","article_modified_time":"2025-06-26T17:03:37+00:00","author":"Royi Ronen","twitter_card":"summary_large_image","twitter_creator":"@azure","twitter_site":"@azure","twitter_misc":{"Written by":"Royi Ronen","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#article","isPartOf":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/"},"author":[{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/dr-royi-ronen\/","@type":"Person","@name":"Royi Ronen"}],"headline":"Machine Learning in Azure Security Center","datePublished":"2016-01-28T00:00:00+00:00","dateModified":"2025-06-26T17:03:37+00:00","mainEntityOfPage":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/"},"wordCount":555,"commentCount":0,"publisher":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization"},"articleSection":["AI + machine learning","Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/","name":"Machine Learning in Azure Security Center | Microsoft Azure Blog","isPartOf":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#website"},"datePublished":"2016-01-28T00:00:00+00:00","dateModified":"2025-06-26T17:03:37+00:00","description":"With Azure Security Center, we deeply analyze a wealth of data, from a variety of Microsoft and partner solutions to help you achieve greater security.","breadcrumb":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/machine-learning-in-azure-security-center\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog home","item":"https:\/\/azure.microsoft.com\/en-us\/blog\/"},{"@type":"ListItem","position":2,"name":"AI + machine learning","item":"https:\/\/azure.microsoft.com\/en-us\/blog\/category\/ai-machine-learning\/"},{"@type":"ListItem","position":3,"name":"Machine Learning in Azure Security Center"}]},{"@type":"WebSite","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#website","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/","name":"Microsoft Azure Blog","description":"Get the latest Azure news, updates, and announcements from the Azure blog. From product updates to hot topics, hear from the Azure experts.","publisher":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/azure.microsoft.com\/en-us\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#organization","name":"Microsoft Azure Blog","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp","contentUrl":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-content\/uploads\/2024\/06\/microsoft_logo.webp","width":512,"height":512,"caption":"Microsoft Azure Blog"},"image":{"@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/microsoftazure","https:\/\/x.com\/azure","https:\/\/www.instagram.com\/microsoftdeveloper\/","https:\/\/www.linkedin.com\/company\/16188386","https:\/\/www.youtube.com\/user\/windowsazure"]},{"@type":"Person","@id":"https:\/\/azure.microsoft.com\/en-us\/blog\/#\/schema\/person\/c702e5edd662b328b49b7e1180cab117","name":"shakir","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9342c7c05bb16548741bc5cd3a3e3b7ee0c8e746844ad2cc582db5beb5514c6f?s=96&d=mm&r=g7664e653ea371ce16eaf75e9fa8952c4","url":"https:\/\/secure.gravatar.com\/avatar\/9342c7c05bb16548741bc5cd3a3e3b7ee0c8e746844ad2cc582db5beb5514c6f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9342c7c05bb16548741bc5cd3a3e3b7ee0c8e746844ad2cc582db5beb5514c6f?s=96&d=mm&r=g","caption":"shakir"},"sameAs":["https:\/\/azure.microsoft.com"],"url":"https:\/\/azure.microsoft.com\/en-us\/blog\/author\/shakir\/"}]}},"msxcm_display_generated_audio":false,"msxcm_animated_featured_image":null,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Azure Blog","distributor_original_site_url":"https:\/\/azure.microsoft.com\/en-us\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/4954","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/comments?post=4954"}],"version-history":[{"count":1,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/4954\/revisions"}],"predecessor-version":[{"id":43897,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/posts\/4954\/revisions\/43897"}],"wp:attachment":[{"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/media?parent=4954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/categories?post=4954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/tags?post=4954"},{"taxonomy":"audience","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/audience?post=4954"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/content-type?post=4954"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/product?post=4954"},{"taxonomy":"tech-community","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/tech-community?post=4954"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/topic?post=4954"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/azure.microsoft.com\/en-us\/blog\/wp-json\/wp\/v2\/coauthors?post=4954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}