Cloud monitoring
Cloud is inline’s CSPM — cloud security posture management. It scans your Azure subscription for security, reliability, cost, and operational issues; triages them with AI; and tracks resources, secure score, and spend over time. It’s provider-agnostic by design (Azure first), and it stores zero customer secrets.
Optional per-org module, off by default.
# How it reads Azure
Nine collectors run against Azure’s management APIs, each isolated so one failing doesn’t sink the scan:
| Collector | Looks at |
|---|---|
| inventory | Full resource inventory via Resource Graph. |
| defender | Microsoft Defender secure score + unhealthy assessments. |
| advisor | Azure Advisor recommendations (all five pillars). |
| policy | Azure Policy non-compliance. |
| rbac | Owner sprawl, service principals with Owner. |
| appservice | HTTPS-only, min TLS, FTPS, always-on, cert expiry. |
| containerapp | Failed/stopped apps, insecure ingress. |
| network | NSGs exposing sensitive ports to the internet, orphaned public IPs. |
| cost | Daily spend spikes (>1.5× the prior 7-day average). |
# Zero stored secrets
inline authenticates with a client-credentials grant against your tenant, using inline’s own multi-tenant Entra app — so inline holds only its own app secret, never a per-customer credential. Onboarding is one script you paste into Azure Cloud Shell: it registers inline’s app in your tenant and grants it Monitoring Reader + Security Reader at the subscription scope (both free, read-only CSPM roles). Then you return to the portal and click Validate, which probes access and kicks off the first scan.
# The scan pipeline
The worker sweeps due connections, claims a scan, and runs: collect → upsert resources → reconcile findings (dedup by fingerprint; auto-resolve anything a healthy collector no longer reports) → AI passes.
Two-tier AI triage keeps it cheap:
- A fast model batches findings and assigns a priority 1–4, suppressing obvious false positives.
- A more capable model runs deep analysis on the top new high-priority findings only (capped per scan), producing an
azCLI remediation runbook and risk context.
Findings dedup by a stable fingerprint across scans, so a re-seen issue updates rather than duplicating, and one that disappears auto-resolves.
# The portal
- Overview — posture cards, a secure-score dial, and a spend trend.
- Findings — filterable, with AI priority, summary, and remediation; dismiss or suppress.
- Resources — the live inventory.
- Connections — the connect wizard and per-connection scan controls.
# Configuration
Per-org settings: AI triage on/off, deep analysis on/off, Severity floor, Scan interval (default 6h), email alerts.
Azure RBAC required (in your subscription): Monitoring Reader + Security Reader.