Downloaded 172 times
Uploaded byMohit Chhabra
Azure Sentinel.pptx
Azure Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation and response (SOAR) solution that uses built-in machine learning to detect threats and allows security teams to automate responses. It collects security data from across an organization, including Microsoft 365 data for free. Azure Sentinel is scalable and has no infrastructure costs, with customers only paying for resources used. It integrates with existing security tools and data sources.
More Related Content
Similar to Azure Sentinel.pptx
Azure Sentinel.pptx
- 1. Secure your Infrastructure withAzure Sentinel Mohit Chhabra Microsoft Azure MVP Configit |Germany https://www.linkedin.com/company/pdcconf @PDCConf https://www.facebook.com/pdcconf
- 2. Thank you toall our generous sponsors Supported by Powered by Organized by Sponsored by
- 3. Mohit Chhabra S Twitter username LinkedInusername Powered By September 16th & 17th Online Event International Conference Speaker
- 4. Security Operations Team Expandingdigital estate
- 5. Too many disconnected products High volume ofnoisy alerts Security skills in short supply Lack of automation Rising infrastructure costs and upfront investment IT deployment & maintenance Sophistication of threats Traditional SOC Challenges
- 6. Cloud + ArtificialIntelligence Security Operations Team Azure Sentinel is a cloud-native SIEM
- 7. Introducing Microsoft AzureSentinel Azure Sentinel Cloud-native SIEM + SOAR (Security Orchestration, Automation and Response) for intelligent security analytics for your entire enterprise Respond Rapidly and automate protection Detect Threats with vast threat intelligence and AI Investigate Collect Security data across your enterprise Critical incidents guided by AI Limitless cloud speed and scale Bring your Office 365 data for Free Easy integration with your existing tools Faster threat protection with AI by your side
- 8. Azure Sentinel –Across Security Center © Microsoft Corporation Azure
- 9. Connectors - https://techcommunity.microsoft.com/t5/Azure-Sentinel/bg-p/AzureSentinelBlog ©Microsoft Corporation Azure
- 10. Azure Sentinel –Cloud Native SIEM + SOAR Azure Sentinel is a true cloud native software as a service solution for SIEM+SOAR (Security information and event management + Security orchestration and automated response) with automatic scalability, no server installation, maintenance, or complex configuration. It lets your SecOps team focus on the most important tasks- defending against threats to your organization. Microsoft Azure Sentinel is a PaaS service started with ArcSite with using Azure Data Explorer using LogicApps as it’s built in Automation engine. It uses Azure Log Analytics our log platform, in the background for it’s data.
- 11. Focus on security,unburden SecOps from IT tasks © Microsoft Corporation Azure No infrastructure setup or maintenance SIEM Service available in Azure portal Scale automatically, put no limits to compute or storage resources
- 12. Traditional Reduce security andIT costs- Get a cost effective SIEM No infrastructure costs, Only pay for what you use Bring your Office 365 Data for free Predictable Billing with capacity reservations Flexible model, no annual commitments Sentinel Cloud-native, scalable SIEM Hardware setup Maintenance Software setup
- 13. Integrate with existing tools &data sources
- 14. Collect security dataat cloud scale from all sources across your enterprise © Microsoft Corporation Azure Pre-wired integration with Microsoft solutions Connectors for many partner solutions Standard log format support for all sources Proven log platform with more than 10 petabytes of daily ingestion
- 15. Optimize for yourneeds © Microsoft Corporation Azure Bring your own insights, machine learning models, and threat intelligence Tap into our security community to build on detections, threat intelligence, and response automation. Bring your own ML Models & Threat Intelligence Security Community
- 16. Live Demo © MicrosoftCorporation Azure • Mohit Chhabra
- 17. Azure Sentinel –Data Connectors © Microsoft Corporation Azure
- 18. Azure Sentinel –Data Connectors © Microsoft Corporation Azure
- 19. Azure Sentinel –Overview Dashboard © Microsoft Corporation Azure
- 20. Sentinel is backby Log Analytics Workspace © Microsoft Corporation Azure
- 21. Sentinel – News& Guides © Microsoft Corporation Azure
- 22. Sentinel – ThreatManagement - Incidents © Microsoft Corporation Azure
- 23. Sentinel – ThreatManagement - Workbooks © Microsoft Corporation Azure
- 24. Sentinel – ThreatManagement - Hunting © Microsoft Corporation Azure
- 25. Sentinel – ThreatManagement - Notebooks © Microsoft Corporation Azure
- 26. Sentinel – Configuration– Data Connectors © Microsoft Corporation Azure
- 27. Sentinel – Configuration- Analytics © Microsoft Corporation Azure
- 28. Sentinel – Configuration- Playbooks © Microsoft Corporation Azure
- 29. Sentinel – Configuration- Community © Microsoft Corporation Azure
- 30. Sentinel – Configuration- Settings © Microsoft Corporation Azure
- 31.
- 32. AI by yourside
- 33. Detect threats andanalyze security data quickly with AI © Microsoft Corporation Azure ML models based on decades of Microsoft security experience and learnings Millions of signals filtered to few correlated and prioritized incidents Insights based on vast Microsoft threat intelligence and your own TI Reduce alert fatigue by up to 90% Correlated rules User Entity Behavior Analysis integrated with Microsoft 365 Bring your own ML models Pre-built Machine Learning models Threat Detection and Analysis
- 34. Respond rapidly withbuilt-in orchestration and automation Build automated and scalable playbooks that integrate across tools ! Security Products Ticketing Systems (ServiceNow) Additional tools
- 35. How it works ©Microsoft Corporation Azure Microsoft Services Analyze & Detect Investigate & Hunt Automate & Orchestrate Response Visibility Data Ingestion Data Repository Data Search Enrichment Integrate Collect
- 36. Investigate threats withAI and hunt suspicious activities at scale © Microsoft Corporation Azure Get prioritized alerts and automated expert guidance Visualize the entire attack and its impact Hunt for suspicious activities using pre-built queries and Azure Notebooks
- 37. Threat detection, investigationand response © Microsoft Corporation Azure
- 38. Azure Sentinel Data store Automation Userinterface Rules Machine learning Search & investigation On Premises Other Clouds & SaaS Apps Customer’s Tenant
- 39. Customer’s Tenant Azure Sentinel (Optional) Collector Proxy Azure Sentinelon-premises collection options: 1. Agent 2. CEF/Syslog 3. WEF 4. Native Collection 5. Logic Apps 6. Direct API + Logstash All methods can be applied to Cloud IaaS. OS events, DNS, Windows FW, DHCP agent agent CEF or Syslog connector Syslog (TLS, TCP, UDP) Branch Office Auto deployed cloud CEF of Syslog connector WEF Connector HTTPS WEC Direct Integration for supported sources
- 40. Basics: Windows Events Linux Syslog Extras: DNS events (DCs) Windows Firewall events IIS events Local files FluentD plug-ins
- 41. • Windows orLinux • Automated install in Azure • Central management • Proxy support • Additional Azure management functions • Well documented
- 42. Syslog/CEF Collection Azure SentinelSyslog Collector (Dedicated Linux VM)
- 43. Azure Syslog/CEF Collection: Cloudbased collector Azure Sentinel Syslog Collector (Dedicated VM)
- 44. On Prem Syslog/CEF Collection:On-prem based collector Azure Sentinel Syslog Collector (Dedicated VM)
- 45. Windows Event Forwarding* AzureSentinel Syslog Collector (Dedicated Windows VM)
- 46.