Where this collector family fits
Microsoft and Azure collectors cover cloud changes, assets, identity activity, risk signals, productivity audit records, security findings, and incident sources. Coverage can be combined to support both cloud-security and security-operations evaluations.
- Azure activity, assets, network flow, and posture
- Microsoft Entra sign-in, audit, provisioning, and identity-risk review
- Microsoft 365 audit visibility
- Defender and Sentinel alert and incident context
Supported collectors in this family
Nova currently implements 29 collectors in this family. Each entry names the source and the customer outcome it supports.
- Azure AKS Assets
- Keeps Azure AKS Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure Activity Logs
- Brings Azure Activity Logs activity into Nova for security monitoring, investigation, and audit review.
- Azure Blob Storage
- Keeps Azure Blob Storage current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure Container Registry Assets
- Keeps Azure Container Registry Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure Event Hubs Logs
- Brings Azure Event Hubs Logs activity into Nova for security monitoring, investigation, and audit review.
- Azure Firewall Logs
- Brings Azure Firewall Logs activity into Nova for security monitoring, investigation, and audit review.
- Azure Key Vault Assets
- Keeps Azure Key Vault Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure Log Analytics Query
- Brings Azure Log Analytics Query activity into Nova for security monitoring, investigation, and audit review.
- Azure Policy and Defender Findings
- Brings Azure Policy and Defender Findings findings into Nova for triage, investigation, prioritization, and posture review.
- Azure RBAC and Network Relationships
- Maps Azure RBAC and Network Relationships in Nova for access analysis, exposure review, and attack-path investigation.
- Azure Resource Graph Assets
- Keeps Azure Resource Graph Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure SQL Assets
- Keeps Azure SQL Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure Subscriptions Assets
- Keeps Azure Subscriptions Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure VM Inventory
- Keeps Azure VM Inventory current in Nova for inventory, ownership, exposure, and security-posture review.
- Azure Virtual Network Flow Logs
- Brings Azure Virtual Network Flow Logs activity into Nova for security monitoring, investigation, and audit review.
- Azure WAF Logs
- Brings Azure WAF Logs activity into Nova for security monitoring, investigation, and audit review.
- Microsoft 365 Audit Log
- Brings Microsoft 365 Audit Log activity into Nova for security monitoring, investigation, and audit review.
- Microsoft 365 Identity Assets
- Keeps Microsoft 365 Identity Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Microsoft Defender Incidents
- Brings Microsoft Defender Incidents security signals into Nova for triage, investigation, prioritization, and response review.
- Microsoft Defender for Cloud Alerts
- Brings Microsoft Defender for Cloud Alerts security signals into Nova for triage, investigation, prioritization, and response review.
- Microsoft Defender for Endpoint Assets
- Keeps Microsoft Defender for Endpoint Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Microsoft Entra ID Assets
- Keeps Microsoft Entra ID Assets current in Nova for inventory, ownership, exposure, and security-posture review.
- Microsoft Entra ID Audit Logs
- Brings Microsoft Entra ID Audit Logs activity into Nova for security monitoring, investigation, and audit review.
- Microsoft Entra ID Provisioning Logs
- Brings Microsoft Entra ID Provisioning Logs activity into Nova for security monitoring, investigation, and audit review.
- Microsoft Entra ID Risk Detections
- Brings Microsoft Entra ID Risk Detections activity into Nova for identity monitoring, access investigation, and account-risk analysis.
- Microsoft Entra ID Risky Users
- Brings Microsoft Entra ID Risky Users findings into Nova for triage, investigation, prioritization, and posture review.
- Microsoft Entra ID Sign-in Logs
- Brings Microsoft Entra ID Sign-in Logs activity into Nova for security monitoring, investigation, and audit review.
- Microsoft Graph Security Alerts
- Brings Microsoft Graph Security Alerts security signals into Nova for triage, investigation, prioritization, and response review.
- Microsoft Sentinel Incidents
- Brings Microsoft Sentinel Incidents security signals into Nova for triage, investigation, prioritization, and response review.
How the evidence supports customer work
Nova keeps collected data linked to its source as it is used for asset inventory, cloud security, detection, investigation or Threat Hunting. Collecting data does not by itself prove a threat or authorize a response action.
Source coverage is not assumed to be complete. Nova keeps collection health, freshness, gaps, and partial results visible so teams can judge whether the evidence is suitable for the decision at hand.
Questions to answer during evaluation
- Which named sources are required for the use case, and which are optional context?
- What history, accounts, subscriptions, organizations, projects, or devices are available to the source product?
- What delay, volume, and missing-data conditions are acceptable for the intended decision?
- Which customer team owns source access, data interpretation, and ongoing health review?