Recommended
More Related Content
What's hot
What's hot (20)
Similar to Azure Sentinel Jan 2021 overview deck
Similar to Azure Sentinel Jan 2021 overview deck (20)
More from Matt Soseman
Recently uploaded
Recently uploaded (20)
Azure Sentinel Jan 2021 overview deck
- 1. What is Azure Sentinel?
- 2. What is Azure Sentinel?
- 3. Introducing Azure Sentinel Birds-eye view across the enterprise alleviating the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution time frames. Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds Detect previously undetected threats, and minimize false positives using Microsoft's analytics and unparalleled threat intelligence Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft Respond to incidents rapidly with built-in orchestration and automation of common tasks
- 4. About Azure Sentinel No infrastructure setup or maintenance SIEM+SOAR service available in Azure portal Scale automatically, put no limits to compute or storage resources Bring your own insights, machine learning models, and threat intelligence Tap into our security community to build on detections, threat intelligence, and response automation. Robust interactive dashboards to visualize and analyze data
- 5. Azure Sentinel at a glance © Microsoft Corporation Azure Microsoft Services Analyze & Detect Investigate & Hunt Automate & Orchestrate Response Visibility Data Ingestion Data Repository Data Search Enrichment IntegrateCollect
- 6. Multi-Tenant Capable (MSSP) Uses Azure Lighthouse to combine multiple tenants Manage your customers’ Sentinel resources directly from your own Azure tenant – without connecting to the customer’s tenant View incidents from all selected workspaces and tenants in a unified list Ensures data isolation between tenants Create cross-tenant Workbooks (dashboards), Playbooks (automation) and threat hunting queries
- 7. Traditional Pricing No infrastructure costs, only pay for what you use Bring your Office 365 Data at no cost Predictable Billing with capacity reservations Sentinel Cloud-native, scalable SIEMHardware setup Maintenance Software setup Azure Sentinel Pricing | Microsoft Azure
- 8. Forrester TEI study: Azure Sentinel delivers 201 percent ROI over 3 years and a payback of less than 6 months A three-year 201 percent return on investment (ROI) with a payback period of less than six months. A 48 percent reduction in costs compared to legacy SIEM solutions, saving on expenses like licensing, storage, and infrastructure costs. A 79 percent reduction in false positives and 80 percent reduction in the amount of labor associated with investigation, reducing mean time to resolution (MTTR) over three years. A 67 percent decrease in time to deployment compared to legacy on- premises SIEMs. Link to Forrester TEI Study
- 9. Integrate with existing tools, services & data sources
- 10. Collect security data from all sources across the organization Out-of-the-box integration with Microsoft solutions Connectors for many non-Microsoft solutions Standard log format support for all sources (CEF,Syslog,REST-API) Supports integrated threat intelligence platforms: MISP, Anomali, Palo Alto, ThreatConnect, ExlecticIQ, ThreatQ (Public Preview) Import your organization’s threat indicators More information: Connect data sources to Azure Sentinel
- 11. What can be ingested at no cost with Azure Sentinel? • Azure Activity Logs • Office 365 Audit Logs (all SharePoint activity and Exchange admin activity) • Microsoft Defender products • Azure Defender • Microsoft 365 Defender • Microsoft Defender for Office 365 • Microsoft Defender for Identity • Microsoft Defender for Endpoint • Azure Security Center • Microsoft Cloud App Security • Azure Information Protection can be ingested at no additional cost into both Azure Sentinel, and Azure Monitor Log Analytics. Note: Azure Active Directory (AAD) audit data is not free and is billed for ingestion into both Azure Sentinel, and Azure Monitor Log Analytics. Azure Sentinel Pricing
- 12. Detect threats out-of-the-box Out-of-the-box, built-in templates to create threat detection rules Identifies common attack vectors, suspicious activity escalation chains, known threats and more Advanced multi-stage attack detection using machine learning Create custom rules to search for specific behavior, suspicious activities, or criteria Alerts can be automatically correlated and added to incidents
- 13. Investigate threats with AI and hunt suspicious activities at scale Visualize context from raw data to Get prioritized alerts and automated expert guidance Visualize the entire attack and its impact Hunt for suspicious activities using pre-built queries and Azure Notebooks Correlates data to understand scope, identify root cause of potential threats
- 14. Visualize and monitor your data Create interactive custom dashboards and reports to bring new insights to your data Based on Azure Monitor Workbooks Dozens of pre-built out of the box workbooks Sentinel can also use PowerBI for dashboards and reports
- 15. Respond rapidly with built-in orchestration and automation Automatically or manually respond to an alert with a collection of procedures Integrate with triggers and actions across multiple Microsoft and 3rd party tools and services Based on Azure Logic Apps Examples: • Automatically create service desk tickets • Automatically isolate a device if suspicious behavior detected
- 17. Proactively hunt for threats across the organization Built-in queries to guide you in finding new anomalies that weren’t detected by security apps, using your existing data Developed and maintained by Microsoft security researchers on a continuous basis Get notified of potential or current threats to your organization via threat data feeds Aligns with MITRE ATT&CK
- 18. Jupyter notebooks to hunt for security threats Combines full programmability with huge collection of libraries for machine learning, visualization and data analysis Enrich data using external sources such as threat intelligence, and other network databases (e.g. VirusTotal, GeoIP,etc) Automate common investigative steps such as gathering additional host and network details, triggering host actions like collecting an investigative package, or running anti-virus scans. Use your own Machine Learning for data processing and analysis
- 19. User & Entity Behavior Analytics Builds baseline behavioral profiles of entities within the organization Clear understanding of anomalous activities in context in comparison of the baseline Identifies anomalous activity to determine if an asset has been compromised Evaluate potential impact (“blast radius”) Aligned with MITRE ATT&CK Types of entities include: users, hosts, IPs,files, processes, URLs, mailboxes, registry keys, domain names, SaaS apps and more!
- 20. Out-of-the-box and customizable SOC incident metrics Workbook template to measure SOC operational metrics: • Incidents created over time • Incidents created by closing classification, severity, owner, and status • Mean time to triage • Mean time to closure • Incidents created by severity, owner, status, product, and tactics over time • Time to triage percentiles • Time to closure percentiles • Mean time to triage per owner • Recent activities • Recent closing classifications
- 21. Watchlists (Preview) Investigating threats and responding to incidents quickly with the rapid import of IP addresses, file hashes, and other data. Use in alert rules, threat hunting, workbooks, notebooks, and general queries Importing business data as a watchlists. For example, import user lists with privileged system access, or terminated employees, and then use the watchlist to create allow and deny lists used to detect or prevent those users from logging in to the network Reducing alert fatigue Create allow lists to suppress alerts from a group of users, such as users from authorized IP addresses that perform tasks that would normally trigger the alert, and prevent benign events from becoming alerts Enriching event data. Use watchlists to enrich your event data with name-value combinations derived from external data sources Enables collection of data from external data sources for correlation with events in Sentinel
- 22. Wrap Up & Resources
- 23. Resources Sentinel Ninja Training (L400) Sentinel GitHub SecOps Community Technical Documentation
Editor's Notes
- Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution. Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Azure Sentinel is your birds-eye view across the enterprise alleviating the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution time frames. Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds. Detect previously undetected threats, and minimize false positives using Microsoft's analytics and unparalleled threat intelligence. Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft. Respond to incidents rapidly with built-in orchestration and automation of common tasks. Building on the full range of existing Azure services, Azure Sentinel natively incorporates proven foundations, like Log Analytics, and Logic Apps. Azure Sentinel enriches your investigation and detection with AI, and provides Microsoft's threat intelligence stream and enables you to bring your own threat intelligence. What is Azure Sentinel? | Microsoft Docs
- Ownership of data remains with each managed tenant. Supports requirements to store data within geographical boundaries. Ensures data isolation, since data for multiple customers isn't stored in the same workspace. Prevents data exfiltration from the managed tenants, helping to ensure data compliance. Related costs are charged to each managed tenant, rather than to the managing tenant. Data from all data sources and data connectors that are integrated with Azure Sentinel (such as Azure AD Activity Logs, Office 365 logs, or Microsoft Threat Protection alerts) will remain within each customer tenant. Reduces network latency. Easy to add or remove new subsidiaries or customers. Manage Azure Sentinel workspaces at scale - Azure Lighthouse | Microsoft Docs
- With Azure Sentinel you can aggregate all security data with built-in connectors, native integration of Microsoft signals and support for industry standard log formats. Microsoft 365 customers can import their Office 365 activity data for free to gain deeper insights. We continue to collaborate with many partners in the Microsoft Intelligent Security Association and support easy connectors and customizable dashboards for popular solutions including Palo Alto Networks, F5, Symantec, Fortinet and many more to come . Azure Sentinel is based on Azure Monitor that uses a proven and scalable log analytics database that ingests more than 10 petabytes everyday and provides a very fast query engine that can sort through millions of records in seconds. Azure Sentinel also integrates with Graph Security API to enable customers to import their own threat intelligence feeds. Connect data sources to Azure Sentinel | Microsoft Docs
- SIEM/SOC teams can be inundated with security alerts on a regular basis. The volume of alerts generated is so huge, that available security admins are overwhelmed. This results all too often in situations where many alerts can't be investigated, leaving the organization vulnerable to attacks that go unnoticed. Many, if not most, of these alerts conform to recurring patterns that can be addressed by specific and defined remediation actions. Azure Sentinel already enables you to define your remediation in playbooks. It is also possible to set real-time automation as part of your playbook definition to enable you to fully automate a defined response to particular security alerts. Using real-time automation, response teams can significantly reduce their workload by fully automating the routine responses to recurring types of alerts, allowing you to concentrate more on unique alerts, analyzing patterns, threat hunting, and more. Azure Monitor Workbooks Overview - Azure Monitor | Microsoft Docs
- Tutorial: Run a playbook in Azure Sentinel | Microsoft Docs
- If you're an investigator who wants to be proactive about looking for security threats, Azure Sentinel powerful hunting search and query tools to hunt for security threats across your organization's data sources. But your systems and security appliances generate mountains of data that can be difficult to parse and filter into meaningful events. To help security analysts look proactively for new anomalies that weren't detected by your security apps, Azure Sentinel' built-in hunting queries guide you into asking the right questions to find issues in the data you already have on your network. For example, one built-in query provides data about the most uncommon processes running on your infrastructure - you wouldn't want an alert about each time they are run, they could be entirely innocent, but you might want to take a look at the query on occasion to see if there's anything unusual. With Azure Sentinel hunting, you can take advantage of the following capabilities: Built-in queries: To get you started, a starting page provides preloaded query examples designed to get you started and get you familiar with the tables and the query language. These built-in hunting queries are developed by Microsoft security researchers on a continuous basis, adding new queries, and fine-tuning existing queries to provide you with an entry point to look for new detections and figure out where to start hunting for the beginnings of new attacks. Powerful query language with IntelliSense: Built on top of a query language that gives you the flexibility you need to take hunting to the next level. Create your own bookmarks: During the hunting process, you may come across matches or findings, dashboards, or activities that look unusual or suspicious. In order to mark those items so you can come back to them in the future, use the bookmark functionality. Bookmarks let you save items for later, to be used to create an incident for investigation. For more information about bookmarks, see Use bookmarks in hunting. Use notebooks to automate investigation: Notebooks are like step-by-step playbooks that you can build to walk through the steps of an investigation and hunt. Notebooks encapsulate all the hunting steps in a reusable playbook that can be shared with others in your organization. Query the stored data: The data is accessible in tables for you to query. For example, you can query process creation, DNS events, and many other event types. Links to community: Leverage the power of the greater community to find additional queries and data sources. Hunting capabilities in Azure Sentinel | Microsoft Docs
- The foundation of Azure Sentinel is the data store; it combines high-performance querying, dynamic schema, and scales to massive data volumes. The Azure portal and all Azure Sentinel tools use a common API to access this data store. The same API is also available for external tools such as Jupyter notebooks and Python. While many common tasks can be carried out in the portal, Jupyter extends the scope of what you can do with this data. It combines full programmability with a huge collection of libraries for machine learning, visualization, and data analysis. These attributes make Jupyter a compelling tool for security investigation and hunting. Use notebooks with Azure Sentinel for security hunting | Microsoft Docs
- Identifying threats inside your organization and their potential impact - whether a compromised entity or a malicious insider - has always been a time-consuming and labor-intensive process. Sifting through alerts, connecting the dots, and active hunting all add up to massive amounts of time and effort expended with minimal returns, and the possibility of sophisticated threats simply evading discovery. Particularly elusive threats like zero-day, targeted, and advanced persistent threats can be the most dangerous to your organization, making their detection all the more critical. The UEBA capability in Azure Sentinel eliminates the drudgery from your analysts’ workloads and the uncertainty from their efforts, and delivers high-fidelity, actionable intelligence, so they can focus on investigation and remediation. As Azure Sentinel collects logs and alerts from all of its connected data sources, it analyzes them and builds baseline behavioral profiles of your organization’s entities (users, hosts, IP addresses, applications etc.) across time and peer group horizon. Using a variety of techniques and machine learning capabilities, Sentinel can then identify anomalous activity and help you determine if an asset has been compromised. Not only that, but it can also figure out the relative sensitivity of particular assets, identify peer groups of assets, and evaluate the potential impact of any given compromised asset (its “blast radius”). Armed with this information, you can effectively prioritize your investigation and incident handling. Identify advanced threats with User and Entity Behavior Analytics (UEBA) in Azure Sentinel | Microsoft Docs
- As a Security Operations Center (SOC) manager, you need to have overall efficiency metrics and measures at your fingertips to gauge the performance of your team. You'll want to see incident operations over time by many different criteria, like severity, MITRE tactics, mean time to triage, mean time to resolve, and more. Azure Sentinel now makes this data available to you with the new SecurityIncident table and schema in Log Analytics and the accompanying Security operations efficiency workbook. You'll be able to visualize your team's performance over time and use this insight to improve efficiency. You can also write and use your own KQL queries against the incident table to create customized workbooks that fit your specific auditing needs and KPIs. Manage your SOC better with incident metrics in Azure Sentinel | Microsoft Docs
- Azure Sentinel watchlists enable the collection of data from external data sources for correlation with the events in your Azure Sentinel environment. Once created, you can use watchlists in your search, detection rules, threat hunting, and response playbooks. Watchlists are stored in your Azure Sentinel workspace as name-value pairs and are cached for optimal query performance and low latency. Use Azure Sentinel watchlists | Microsoft Docs