Journey to Azure Sentinel

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

www.techconnect.io
Journey to Azure Sentinel
Eng Soon Cheah, Microsoft MVP
@CheahEngSoon

Setup Azure Sentinel

Login to the Azure Portal.
Search at the top for Azure Sentinel. Click Add to setup the Azure Sentinel workspace.

Click Create a new workspace. (You could also add to an existing one if desired.)

Name your new workspace and place in the proper Resource Group.
NOTE: The Azure Sentinel Preview is currently Free. Micros...

On the next page click the new workspace you created and click Add Azure Sentinel.

Click on the new workspace. Click the Getting Started tab and you will see the overview of the setup.

Setup Azure Sentinel Data Collection

Click on the Connect for step 1 we will need to setup Sentinel to collect data from on-prem and cloud locations.

Click through any you wish to setup… each Data Collection plugin has step by step instructions. For example the Azure
Acti...

Setup Azure Sentinel Dashboards

Once you have Data Collection setup go to Dashboards, select the pre-made dashboards for your Collectors and
click Install...

Setup Azure Sentinel Analytics –
Alert Rules

Select Analytics and then Add.

AzureActivity
| where OperationName == “Create or Update Virtual Machine” or
OperationName == “Create Deployment”
| where ...

Click Create.

Next Select the Community tab under configuration and select Go to Azure Sentinel community.

From this community GitHub you can find many useful alerts to setup in you Azure Sentinel Preview.

Enable Fusion

az resource update –ids /subscriptions/{Subscription
Guid}/resourceGroups/{Log analytics resource Group
Name}/providers/Mi...

References
Blogs:
https://dev.to/cheahengsoon
YouTube:
https://www.youtube.com/c/engsooncheah

www.techconnect.io

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

1 of 23 Ad

1 of 23 Ad