# Cloud monitoring

# Cloud monitoring

Cloud is inline's CSPM — cloud security posture management. It scans your Azure subscription for security, reliability, cost, and operational issues; triages them with AI; and tracks resources, secure score, and spend over time. It's provider-agnostic by design (Azure first), and it stores **zero customer secrets**.

Optional per-org module, off by default.

## How it reads Azure

Nine collectors run against Azure's management APIs, each isolated so one failing doesn't sink the scan:

| Collector | Looks at |
| --- | --- |
| **inventory** | Full resource inventory via Resource Graph. |
| **defender** | Microsoft Defender secure score + unhealthy assessments. |
| **advisor** | Azure Advisor recommendations (all five pillars). |
| **policy** | Azure Policy non-compliance. |
| **rbac** | Owner sprawl, service principals with Owner. |
| **appservice** | HTTPS-only, min TLS, FTPS, always-on, cert expiry. |
| **containerapp** | Failed/stopped apps, insecure ingress. |
| **network** | NSGs exposing sensitive ports to the internet, orphaned public IPs. |
| **cost** | Daily spend spikes (>1.5× the prior 7-day average). |

## Zero stored secrets

inline authenticates with a **client-credentials grant against your tenant**, using inline's own multi-tenant Entra app — so inline holds only its own app secret, never a per-customer credential. Onboarding is one script you paste into Azure Cloud Shell: it registers inline's app in your tenant and grants it **Monitoring Reader + Security Reader** at the subscription scope (both free, read-only CSPM roles). Then you return to the portal and click **Validate**, which probes access and kicks off the first scan.

## The scan pipeline

The worker sweeps due connections, claims a scan, and runs: collect → upsert resources → reconcile findings (dedup by fingerprint; auto-resolve anything a healthy collector no longer reports) → AI passes.

**Two-tier AI triage** keeps it cheap:

- A fast model batches findings and assigns a priority 1–4, suppressing obvious false positives.
- A more capable model runs deep analysis on the top new high-priority findings only (capped per scan), producing an `az` CLI remediation runbook and risk context.

Findings dedup by a stable fingerprint across scans, so a re-seen issue updates rather than duplicating, and one that disappears auto-resolves.

## The portal

- **Overview** — posture cards, a secure-score dial, and a spend trend.
- **Findings** — filterable, with AI priority, summary, and remediation; dismiss or suppress.
- **Resources** — the live inventory.
- **Connections** — the connect wizard and per-connection scan controls.

## Configuration

Per-org settings: AI triage on/off, deep analysis on/off, **Severity floor**, **Scan interval** (default 6h), email alerts.

**Azure RBAC required (in your subscription):** Monitoring Reader + Security Reader.