How can I find if intruders has attacked on my Azure VM's

Question

Hi Team,

We have been reported of a brute force attack targeting 2 servers. This has been happening since at least march 8th.

More than 3500 unique usernames were observed being used.

Please note that there isn’t any evidence that points to attack being successful; all observed events were unsuccessful login attempts. as reported by our Cyber Defense team.

Answer 1

If it's a Windows VM you could monitor the Windows security audit logs for failed sign in attempts.

I wrote a blog post on this a few years back - https://azurealan.ie/2019/11/12/monitoring-failed-login-attempts-to-your-azure-virtual-machines/