Recommended
Recommended
More Related Content
Similar to TechTalksUtah-Sentinel-20191108.pptx
Similar to TechTalksUtah-Sentinel-20191108.pptx (20)
More from JustineGarcia32
More from JustineGarcia32 (7)
Recently uploaded
Recently uploaded (20)
TechTalksUtah-Sentinel-20191108.pptx
- 2. • 12:45 PM – Check-in / Food /Networking • 1:00 PM– Welcome/Kickoff • 2:45 PM – Q&A Agenda:
- 3. • Restrooms – out the front door past the elevators to your right • WiFi • SSID: MSFTGUEST • Password: msevent993gx Facilities:
- 4. What are Microsoft Tech Talks? • Microsoft Tech Talks is a Technical Community event, designed to bring IT leaders in the local area together at a Microsoft facility, for deep Microsoft- technology based discussions, and • An opportunity to network and share with local Microsoft Services Professionals and other IT professionals. • A Microsoft Services presenter delivers a technically-rich presentation covering a product, product feature, or service that Microsoft offers, • Our presenters are world-class Subject Matter Experts and trusted advisors to our highly-valued customers. • Our meetings are a great opportunity to 'ask the experts' questions about their given field of expertise. • Subjects vary from session to session and attempt to be at the leading edge, showcasing our latest features and products available. • These communities now collectively have over 2500 members that have joined one of the local meetup groups. • We are constantly expanding to a region near you, your friends / colleagues….. https://aka.ms/mttmap
- 5. We are on meetup!!! • Join Us to keep up to date on our latest events • https://www.meetup.com/mttutah/ • RSVP Closed does not mean Closed! • Look for the Microsoft Events sign-up link! • Tell all your friends / colleagues • Join our Microsoft Community Site for ALL Tech Talk Events throughout the country • PowerPoint Decks are Posted here • https://aka.ms/MTTCommunity
- 6. Survey https://aka.ms/UtahSurvey VERY Short…8 questions! Please be aware that your feedback is extremely valued and important to us, as in addition to improving the quality of our events, it helps us to justify the time, effort and money in hosting, funding and organizing these events.
- 7. Azure Security & Sentinel Services Security: Azure Sentinel – Fundamentals Security: Azure Security Center – Fundamentals Security: Cloud App Security Security: Advanced Threat Detection Workshop+: Microsoft Azure: Security Best Practices
- 9. Introductions 1. Name • Linda Chapman 2. Role • Azure Technical Trainer – MS WWL • Microsoft Certified Trainer - 1996 • Senior Enterprise Architect - 1996 3. Experience • 33 years experience • Developer – 7 years • Infrastructure, Security, Architecture • Cloud Architect since 2010 Azure & AWS Architecture and Migrations – 20 years Azure, O365, ASR, CAS, ATP, SQL, Oracle, ServiceNow, VMware, Citrix, AWS AZ-300/301, WS-500, DP-200, DP-201, AZ- 103, AI-100, M365 Gamer 6Nerds.com 4 Children 4 dogs 7 cats Utah/Texas https://www.linkedin.com/in/LindaChapman https://blogs.technet.microsoft.com/lindachapman/
- 10. Security Operations Team Expanding digital estate
- 11. Too many disconnected products High volume of noisy alerts Security skills in short supply Lack of automation Rising infrastructure costs and upfront investment IT deployment & maintenance Sophistication of threats Traditional SOC Challenges
- 12. Cloud + Artificial Intelligence Security Operations Team Azure Sentinel is a cloud-native SIEM
- 13. Introducing Microsoft Azure Sentinel Azure Sentinel Cloud-native SIEM + SOAR (Security Orchestration, Automation and Response) for intelligent security analytics for your entire enterprise Respond Rapidly and automate protection Detect Threats with vast threat intelligence and AI Investigate Collect Security data across your enterprise Critical incidents guided by AI Limitless cloud speed and scale Bring your Office 365 data for Free Easy integration with your existing tools Faster threat protection with AI by your side
- 14. Azure Sentinel – Across Security Center © Microsoft Corporation Azure
- 15. Connectors - https://techcommunity.microsoft.com/t5/Azure-Sentinel/bg-p/AzureSentinelBlog © Microsoft Corporation Azure
- 16. Azure Sentinel – Cloud Native SIEM + SOAR Azure Sentinel is a true cloud native software as a service solution for SIEM+SOAR (Security information and event management + Security orchestration and automated response) with automatic scalability, no server installation, maintenance, or complex configuration. It lets your SecOps team focus on the most important tasks- defending against threats to your organization. Microsoft Azure Sentinel is a PaaS service started with ArcSite with using Azure Data Explorer using LogicApps as it’s built in Automation engine. It uses Azure Log Analytics our log platform, in the background for it’s data.
- 17. Focus on security, unburden SecOps from IT tasks © Microsoft Corporation Azure No infrastructure setup or maintenance SIEM Service available in Azure portal Scale automatically, put no limits to compute or storage resources
- 18. Traditional Reduce security and IT costs- Get a cost effective SIEM No infrastructure costs, Only pay for what you use Bring your Office 365 Data for free Predictable Billing with capacity reservations Flexible model, no annual commitments Sentinel Cloud-native, scalable SIEM Hardware setup Maintenance Software setup
- 19. Integrate with existing tools & data sources
- 20. Collect security data at cloud scale from all sources across your enterprise © Microsoft Corporation Azure Pre-wired integration with Microsoft solutions Connectors for many partner solutions Standard log format support for all sources Proven log platform with more than 10 petabytes of daily ingestion
- 21. Optimize for your needs © Microsoft Corporation Azure Bring your own insights, machine learning models, and threat intelligence Tap into our security community to build on detections, threat intelligence, and response automation. Bring your own ML Models & Threat Intelligence Security Community
- 22. Linda Chapman Live Demo © Microsoft Corporation Azure
- 23. Azure Sentinel – Data Connectors © Microsoft Corporation Azure
- 24. Azure Sentinel – Data Connectors © Microsoft Corporation Azure
- 25. Azure Sentinel – Overview Dashboard © Microsoft Corporation Azure
- 26. Sentinel is back by Log Analytics Workspace © Microsoft Corporation Azure
- 27. Sentinel – News & Guides © Microsoft Corporation Azure
- 28. Sentinel – Threat Management - Incidents © Microsoft Corporation Azure
- 29. Sentinel – Threat Management - Workbooks © Microsoft Corporation Azure
- 30. Sentinel – Threat Management - Hunting © Microsoft Corporation Azure
- 31. Sentinel – Threat Management - Notebooks © Microsoft Corporation Azure
- 32. Sentinel – Configuration – Data Connectors © Microsoft Corporation Azure
- 33. Sentinel – Configuration - Analytics © Microsoft Corporation Azure
- 34. Sentinel – Configuration - Playbooks © Microsoft Corporation Azure
- 35. Sentinel – Configuration - Community © Microsoft Corporation Azure
- 36. Sentinel – Configuration - Settings © Microsoft Corporation Azure
- 37. GitHub © Microsoft Corporation Azure
- 38. AI by your side
- 39. Detect threats and analyze security data quickly with AI © Microsoft Corporation Azure ML models based on decades of Microsoft security experience and learnings Millions of signals filtered to few correlated and prioritized incidents Insights based on vast Microsoft threat intelligence and your own TI Reduce alert fatigue by up to 90% Correlated rules User Entity Behavior Analysis integrated with Microsoft 365 Bring your own ML models Pre-built Machine Learning models Threat Detection and Analysis
- 40. Respond rapidly with built-in orchestration and automation Build automated and scalable playbooks that integrate across tools ! Security Products Ticketing Systems (ServiceNow) Additional tools
- 41. How it works © Microsoft Corporation Azure Microsoft Services Analyze & Detect Investigate & Hunt Automate & Orchestrate Response Visibility Data Ingestion Data Repository Data Search Enrichment Integrate Collect
- 42. Investigate threats with AI and hunt suspicious activities at scale © Microsoft Corporation Azure Get prioritized alerts and automated expert guidance Visualize the entire attack and its impact Hunt for suspicious activities using pre-built queries and Azure Notebooks
- 43. Threat detection, investigation and response © Microsoft Corporation Azure
- 44. Azure Sentinel Data store Automation User interface Rules Machine learning Search & investigation On Premises Other Clouds & SaaS Apps Customer’s Tenant
- 45. Customer’s Tenant Azure Sentinel (Optional) Collector Proxy Azure Sentinel on-premises collection options: 1. Agent 2. CEF/Syslog 3. WEF 4. Native Collection 5. Logic Apps 6. Direct API + Logstash All methods can be applied to Cloud IaaS. OS events, DNS, Windows FW, DHCP agent agent CEF or Syslog connector Syslog (TLS, TCP, UDP) Branch Office Auto deployed cloud CEF of Syslog connector WEF Connector HTTPS WEC Direct Integration for supported sources
- 46.
- 48. Azure Sentinel Syslog Collector (Dedicated Linux VM)
- 49. Azure Azure Sentinel Syslog Collector (Dedicated VM)
- 50. On Prem Azure Sentinel Syslog Collector (Dedicated VM)
- 51. Azure Sentinel Syslog Collector (Dedicated Windows VM)
- 52. Closing - Get started with Azure Sentinel To learn more, visit https://aka.ms/AzureSentinel Connect data sources Start Microsoft Azure trial Open Azure Sentinel dashboard in Azure Portal
- 54. Survey https://aka.ms/UtahSurvey VERY Short…8 questions! Please be aware that your feedback is extremely valued and important to us, as in addition to improving the quality of our events, it helps us to justify the time, effort and money in hosting, funding and organizing these events.