Getting Started with Azure Sentinel
•Download as PPTX, PDF•
1 like•118 views
Session 1: Getting Started with Azure Sentinel for the series : Zero to hero in azure sentinel for Microsoft-365-and-Power-Platform-User-group-India
Report
Share
Report
Share
Recommended
Azure Sentinel.pptx
Azure Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation and response (SOAR) solution that uses built-in machine learning to detect threats and allows security teams to automate responses. It collects security data from across an organization, including Microsoft 365 data for free. Azure Sentinel is scalable and has no infrastructure costs, with customers only paying for resources used. It integrates with existing security tools and data sources.
Azure sentinel
This document discusses how to use Azure Sentinel and Microsoft Defender ATP to catch cyber threats. It provides an overview of the Microsoft security ecosystem and capabilities of Azure Sentinel and Defender ATP. Specifically, it outlines how to enable various data sources, design detection rules, and conduct hunting queries using these solutions.
Microsoft Azure Sentinel
Azure Sentinel is a cloud-native security information and event management (SIEM) tool that uses built-in artificial intelligence and vast threat intelligence to detect threats across organizations. It collects security data from various sources at scale in the cloud with no infrastructure costs or limits. Azure Sentinel reduces alert fatigue by up to 90% through correlated rules and user entity behavior analysis integrated with Microsoft 365. It also allows security teams to investigate threats and hunt for suspicious activities assisted by AI.
Introduction to Azure Sentinel
Azure Sentinel is Microsoft cloud-native SIEM and SOAR. Say goodbye to 6 months SIEM solution setup and architecture - get started with visibility on you environement just now, and use the rich ecosystem of connectors to extend intelligence to your complete security suite.
Microsoft Defender and Azure Sentinel
Get comprehensive protection across all your platforms and clouds
Protect your organization from threats across devices, identities, apps, data and clouds. Get unmatched visibility into your multiplatform environment that unifies Security Information and Event Management (SIEM) and Extended Detection and Response (XDR). Simplify your security stack with Azure Sentinel and Microsoft Defender.
Azure Sentinel
The document discusses Security Incident and Event Management (SIEM) systems and Microsoft Sentinel. It provides an overview of what a SIEM system is and what functionality it typically includes, such as log management, alerting, visualization, and incident management. It then describes Microsoft Sentinel specifically and how it is a cloud-native SIEM system that security operations teams can use to collect security data from various sources, detect threats using machine learning and analytics, and investigate and respond to security incidents.
Microsoft Azure Security Overview
This document provides an overview of Microsoft Azure security features, including:
- Shared responsibility model where Microsoft secures the platform and customers secure their data and applications
- Identity and access management, encryption of data at rest and in transit, network security controls, and logging/monitoring capabilities
- Security Center provides visibility into threats and advanced analytics to detect attacks
- Operations Management Suite allows collecting logs from Azure, on-premises, and other clouds to analyze security events
- Microsoft works with partners to provide additional virtual network appliances and security solutions to customers
Recommended
Azure Sentinel.pptx
Azure Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation and response (SOAR) solution that uses built-in machine learning to detect threats and allows security teams to automate responses. It collects security data from across an organization, including Microsoft 365 data for free. Azure Sentinel is scalable and has no infrastructure costs, with customers only paying for resources used. It integrates with existing security tools and data sources.
Azure sentinel
This document discusses how to use Azure Sentinel and Microsoft Defender ATP to catch cyber threats. It provides an overview of the Microsoft security ecosystem and capabilities of Azure Sentinel and Defender ATP. Specifically, it outlines how to enable various data sources, design detection rules, and conduct hunting queries using these solutions.
Microsoft Azure Sentinel
Azure Sentinel is a cloud-native security information and event management (SIEM) tool that uses built-in artificial intelligence and vast threat intelligence to detect threats across organizations. It collects security data from various sources at scale in the cloud with no infrastructure costs or limits. Azure Sentinel reduces alert fatigue by up to 90% through correlated rules and user entity behavior analysis integrated with Microsoft 365. It also allows security teams to investigate threats and hunt for suspicious activities assisted by AI.
Introduction to Azure Sentinel
Azure Sentinel is Microsoft cloud-native SIEM and SOAR. Say goodbye to 6 months SIEM solution setup and architecture - get started with visibility on you environement just now, and use the rich ecosystem of connectors to extend intelligence to your complete security suite.
Microsoft Defender and Azure Sentinel
Get comprehensive protection across all your platforms and clouds
Protect your organization from threats across devices, identities, apps, data and clouds. Get unmatched visibility into your multiplatform environment that unifies Security Information and Event Management (SIEM) and Extended Detection and Response (XDR). Simplify your security stack with Azure Sentinel and Microsoft Defender.
Azure Sentinel
The document discusses Security Incident and Event Management (SIEM) systems and Microsoft Sentinel. It provides an overview of what a SIEM system is and what functionality it typically includes, such as log management, alerting, visualization, and incident management. It then describes Microsoft Sentinel specifically and how it is a cloud-native SIEM system that security operations teams can use to collect security data from various sources, detect threats using machine learning and analytics, and investigate and respond to security incidents.
Microsoft Azure Security Overview
This document provides an overview of Microsoft Azure security features, including:
- Shared responsibility model where Microsoft secures the platform and customers secure their data and applications
- Identity and access management, encryption of data at rest and in transit, network security controls, and logging/monitoring capabilities
- Security Center provides visibility into threats and advanced analytics to detect attacks
- Operations Management Suite allows collecting logs from Azure, on-premises, and other clouds to analyze security events
- Microsoft works with partners to provide additional virtual network appliances and security solutions to customers
Microsoft 365 Security Overview
This document summarizes Microsoft's security offerings and challenges in securing organizations. It discusses Microsoft surpassing $10 billion in security revenue due to comprehensive protection across devices, cloud services, and on-premises. Conditional access and multi-factor authentication are highlighted to maximize security and productivity. Microsoft provides many integrated security services like Azure Sentinel and Cloud App Security to detect threats using machine learning. The document encourages using default security settings and automation across Microsoft's security services.
Azure Sentinel
Microsoft Azure Sentinel is a new Cloud native SIEM service with built-in AI for analytics that removes the cost and complexity of achieving a central and focused near real-time view of the active threats in your environment.
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
This document provides an overview of Microsoft Sentinel, a cloud-native SIEM and SOAR solution. It discusses what SOAR is, important SOAR capabilities like security orchestration and automation. It also covers the benefits of SOAR like faster incident detection and boosting analyst productivity. The document then explains how Microsoft Sentinel collects data at cloud scale, responds to incidents with automation, and detects threats using analytics. It describes features like data connectors, workbooks, hunting, notebooks and certifications related to Microsoft Sentinel.
Microsoft Azure Security Overview - Microsoft - CSS Dallas Azure
This document provides an overview of security in Microsoft Azure. It discusses how Azure shares responsibility for security with customers and how it secures the platform through methods like preventing and assuming breaches, operational security practices, physical security of datacenters, and architecting for more secure multi-tenancy. The document also summarizes Azure's approach to identity and access management, incident response, data protection, and how customers maintain control over their data.
Azure security and Compliance
- Azure provides a unified platform for modern business with compute, data, storage, networking and application services across global Azure regions and a consistent hybrid cloud.
- Azure focuses on security and privacy with an emphasis on detection, response, and protection across infrastructure, platforms and applications.
- Security is a shared responsibility between Microsoft and customers, with Microsoft providing security controls and capabilities to help protect customer data and applications.
SEIM-Microsoft Sentinel.pptx
Microsoft Sentinel is a cloud-native security information and event management (SIEM) solution powered by AI and automation. It collects security data from various sources at cloud scale, uses machine learning to analyze the data and detect threats, provides visualizations to investigate incidents and related entities, and enables automating common security tasks and workflows through automation rules and playbooks. This increases security operations efficiency and helps organizations accelerate response to security threats.
Azure landing zones - Terraform module design considerations - Azure Architec...
Azure landing zones - Terraform module design considerations - Azure Architecture Center _ Microsoft Learn
azure-security-overview-slideshare-180419183626.pdf
This document provides information about Microsoft's security practices for its cloud services. It discusses Microsoft's certifications and compliance with standards like ISO 27001, SOC 1, SOC 2, FedRAMP, PCI DSS Level 1, and others. It also summarizes Microsoft's approach to security development, operations, data protection, identity and access management, patching, malware protection, and more. The document is intended to help customers understand how Microsoft secures its cloud platform and builds security into every layer from the physical infrastructure to the software development process.
Azure Security Fundamentals
Short session about Azure Security Fundamentals, from physical to infrastucture, network app and data security.
Azure Security Overview
here's where Microsoft has invested, across these areas: identity and access management, apps and data security, network security, threat protection, and security management.
We’ve put a tremendous amount of investment into these areas and the way it shows up is across a pretty broad array of product areas and features.
Our Identity and Access Management tools enable you to take an identity-based approach to security, and establish truly conditional access policies
Our App and Data Security help you protect your apps and your data as it moves around—both inside and outside your organization
Azure includes a robust networking infrastructure with built-in security controls for your application and service connectivity.
Our Threat Protection capabilities are built in and fully integrated, so you can strengthen both pre-breach protection with deep capabilities across e-mail, collaboration services, and end points including hardware based protection; and post-breach detection that includes memory and kernel based protection and response with automation.
And our Security Management tools give you the visibility and more importantly the guidance to manage policy centrally
Azure Security Center- Zero to Hero
This document provides an overview of Azure Security Center, which is a service that helps secure hybrid cloud environments. It discusses how Azure Security Center provides improved security across Azure subscriptions by delivering security recommendations, dashboards to monitor security state, and APIs to integrate with other security tools. The presentation includes an agenda that covers why cloud security is needed, how Azure Security Center addresses security as a shared responsibility, and demonstrations of its key capabilities like threat detection, secure score assessments, and recommendations for configuring security controls.
Azure Security Overview
This presentation walks through the Security and Compliance functionality to customers leveraging Azure as a compute environment. It includes deep-dive references to detailed information on each topic presented.
Azure - Identity as a service
This document summarizes Microsoft Azure Active Directory (Azure AD) and how it compares to on-premises Active Directory Domain Services (AD DS). Azure AD provides identity and access management in the cloud, while AD DS is installed on-premises. Key differences include Azure AD being multi-tenant, lacking group policy support, and using REST APIs instead of LDAP. The document also outlines integrating Azure AD and AD DS through synchronization and federation for single sign-on capabilities across cloud and on-premises applications and services.
Azure WAF
Azure WAF is a cloud-native web application firewall service that provides powerful protection for web apps with simple deployment, low maintenance costs, and automatic updates. It acts as a content delivery network and can defend against common attacks like command execution, SQL injection, cross-site scripting, and more, as demonstrated in a presentation where custom rules were set up to create an Azure WAF.
Microsoft Azure alerts
The document discusses different types of alerts and notifications that can be received in Azure. It describes how alert rules enable monitoring of Azure services based on metric values, and how notifications are sent by email when rules are triggered or alert conditions are resolved. It also discusses monitoring alerts for cloud services and metrics, and how the Azure Billing Alert Service allows creating customized billing alerts to monitor billing activity for Azure accounts.
7 Experts on Implementing Microsoft 365 Defender
The document provides an introduction to Microsoft 365 Defender, a suite of integrated security tools from Microsoft for protecting endpoints, Office 365 applications, identities, and cloud applications. It notes that while Microsoft makes these tools easy to deploy, properly configuring them to optimize operation and manage costs requires skill and effort. The document aims to provide basic, practical approaches to implementing Microsoft 365 Defender and suggestions for managing the tools to meet changing security requirements. Expert advice is solicited on transitioning to and optimizing the Microsoft 365 Defender suite.
Microsoft Azure Overview
David J. Rosenthal gave a presentation about Microsoft's Azure cloud platform. He discussed how Azure can help companies with digital transformation by engaging customers, empowering employees, and optimizing operations. He provided examples of how companies are using Azure services like AI, IoT, analytics and more to modernize applications, gain insights from data, and improve productivity. Rosenthal emphasized that Azure offers a secure, flexible cloud platform that businesses can use to innovate, grow and transform both today and in the future.
Threat Hunting on AWS using Azure Sentinel
This document provides information about an Azure Sentinel webinar on threat hunting on AWS using Azure Sentinel. It includes an agenda for the webinar with topics like AWS CloudTrail, customizable workbooks, built-in queries and analytics rules. It also provides links for questions, recordings, feedback and the community forum.
Microsoft Zero Trust
A Zero Trust approach should extend throughout the entire digital estate and serve as an integrated security philosophy and end to end strategy.
Identities. Identities whether they represent people, services, or IOT devices define the Zero Trust control plane. When an identity attempts to access a resource, we need to verify that identity with strong authentication, ensure access is compliant and typical for that identity, and follows least privilege access principles.
Devices. Once an identity has been granted access to a resource, data can flow to a variety of different devices From IoT devices to smartphones, BYOD to partner managed devices, and on premises workloads to cloud hosted servers. This diversity creates a massive attack surface area, requiring we monitor and enforce device health and compliance for secure access.
Applications. Applications and APIs provide the interface by which data is consumed. They may be legacy on premises, lift and shifted to cloud workloads, or modern SaaS applications. Controls and technologies should be applied to discover Shadow IT, ensure appropriate in-app permissions, gate access based on real-time analytics, monitor for abnormal behavior, control of user actions, and validate secure configuration options.
Data. Ultimately, security teams are focused on protecting data. Where possible, data should remain safe even if it leaves the devices, apps, infrastructure, and networks the organization controls. Data should be classified, labeled, and encrypted, and access restricted based on those attributes.
Infrastructure. Infrastructure (whether on premises servers, cloud based VMs, containers, or micro services) represents a critical threat vector. Assess for version, configuration, and JIT access to harden defense, use telemetry to detect attacks and anomalies, and automatically block and flag risky behavior and take protective actions.
Networks. All data is ultimately accessed over network infrastructure. Networking controls can provide critical “in pipe” controls to enhance visibility and help prevent attackers from moving laterally across the network. Networks should be segmented (including deeper in network micro segmentation) and real time threat protection, end to end encryption, monitoring, and analytics should be employed.
Each of these six foundational elements serves as a source of the signal, a control plane for enforcement, and a critical resource to defend. You should appropriately spread your investments across each of these elements for maximum protection.
Intro to azure logic apps
Jared Matfess is a Microsoft MVP and technology consultant at Slalom Consulting who is interested in craft beer. His areas of expertise include API apps, web apps, mobile apps, and logic apps built on Microsoft's App Service platform. Logic Apps allows users to automate business processes across SaaS and on-premises systems using a visual designer without writing code. It offers over a hundred templates to get started quickly on tasks like collecting data, automating approvals, and synchronizing files. Logic Apps is serverless and supports advanced scenarios with multiple steps, looping, branching conditions. It differs from Microsoft Flow in its focus on enterprise scenarios over self-service use cases.
Kåre Rude Andersen - Create a scombot – automate and monitor azure
Kåre Rude Andersen presented on automating and monitoring Azure resources using System Center Operations Manager (SCOM). The presentation covered automating SCOM installation and maintenance, monitoring internal SCOM components, setting up monitoring of Azure resources using the Azure management pack, and global service monitoring. Demonstrations showed automating SCOM agent installation and maintenance, monitoring Azure resources and internal SCOM rules, and configuring the global service monitor and advisor features.
NVS_Sentinel
Using Azure Sentinel to catch the bad guys covers how to use Azure Sentinel and other Microsoft security tools to detect threats. The document discusses the growing ransomware threat landscape, example attack methods like credential dumping and lateral movement, and important log sources in Azure like Azure Active Directory logs, Azure Network logs, and Windows event logs. It also covers setting up Azure Sentinel with data connectors, creating analytics rules and queries, and automating response with Logic Apps playbooks. Examples of hunting queries and using external threat intelligence are provided.
More Related Content
What's hot
Microsoft 365 Security Overview
This document summarizes Microsoft's security offerings and challenges in securing organizations. It discusses Microsoft surpassing $10 billion in security revenue due to comprehensive protection across devices, cloud services, and on-premises. Conditional access and multi-factor authentication are highlighted to maximize security and productivity. Microsoft provides many integrated security services like Azure Sentinel and Cloud App Security to detect threats using machine learning. The document encourages using default security settings and automation across Microsoft's security services.
Azure Sentinel
Microsoft Azure Sentinel is a new Cloud native SIEM service with built-in AI for analytics that removes the cost and complexity of achieving a central and focused near real-time view of the active threats in your environment.
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
This document provides an overview of Microsoft Sentinel, a cloud-native SIEM and SOAR solution. It discusses what SOAR is, important SOAR capabilities like security orchestration and automation. It also covers the benefits of SOAR like faster incident detection and boosting analyst productivity. The document then explains how Microsoft Sentinel collects data at cloud scale, responds to incidents with automation, and detects threats using analytics. It describes features like data connectors, workbooks, hunting, notebooks and certifications related to Microsoft Sentinel.
Microsoft Azure Security Overview - Microsoft - CSS Dallas Azure
This document provides an overview of security in Microsoft Azure. It discusses how Azure shares responsibility for security with customers and how it secures the platform through methods like preventing and assuming breaches, operational security practices, physical security of datacenters, and architecting for more secure multi-tenancy. The document also summarizes Azure's approach to identity and access management, incident response, data protection, and how customers maintain control over their data.
Azure security and Compliance
- Azure provides a unified platform for modern business with compute, data, storage, networking and application services across global Azure regions and a consistent hybrid cloud.
- Azure focuses on security and privacy with an emphasis on detection, response, and protection across infrastructure, platforms and applications.
- Security is a shared responsibility between Microsoft and customers, with Microsoft providing security controls and capabilities to help protect customer data and applications.
SEIM-Microsoft Sentinel.pptx
Microsoft Sentinel is a cloud-native security information and event management (SIEM) solution powered by AI and automation. It collects security data from various sources at cloud scale, uses machine learning to analyze the data and detect threats, provides visualizations to investigate incidents and related entities, and enables automating common security tasks and workflows through automation rules and playbooks. This increases security operations efficiency and helps organizations accelerate response to security threats.
Azure landing zones - Terraform module design considerations - Azure Architec...
Azure landing zones - Terraform module design considerations - Azure Architecture Center _ Microsoft Learn
azure-security-overview-slideshare-180419183626.pdf
This document provides information about Microsoft's security practices for its cloud services. It discusses Microsoft's certifications and compliance with standards like ISO 27001, SOC 1, SOC 2, FedRAMP, PCI DSS Level 1, and others. It also summarizes Microsoft's approach to security development, operations, data protection, identity and access management, patching, malware protection, and more. The document is intended to help customers understand how Microsoft secures its cloud platform and builds security into every layer from the physical infrastructure to the software development process.
Azure Security Fundamentals
Short session about Azure Security Fundamentals, from physical to infrastucture, network app and data security.
Azure Security Overview
here's where Microsoft has invested, across these areas: identity and access management, apps and data security, network security, threat protection, and security management.
We’ve put a tremendous amount of investment into these areas and the way it shows up is across a pretty broad array of product areas and features.
Our Identity and Access Management tools enable you to take an identity-based approach to security, and establish truly conditional access policies
Our App and Data Security help you protect your apps and your data as it moves around—both inside and outside your organization
Azure includes a robust networking infrastructure with built-in security controls for your application and service connectivity.
Our Threat Protection capabilities are built in and fully integrated, so you can strengthen both pre-breach protection with deep capabilities across e-mail, collaboration services, and end points including hardware based protection; and post-breach detection that includes memory and kernel based protection and response with automation.
And our Security Management tools give you the visibility and more importantly the guidance to manage policy centrally
Azure Security Center- Zero to Hero
This document provides an overview of Azure Security Center, which is a service that helps secure hybrid cloud environments. It discusses how Azure Security Center provides improved security across Azure subscriptions by delivering security recommendations, dashboards to monitor security state, and APIs to integrate with other security tools. The presentation includes an agenda that covers why cloud security is needed, how Azure Security Center addresses security as a shared responsibility, and demonstrations of its key capabilities like threat detection, secure score assessments, and recommendations for configuring security controls.
Azure Security Overview
This presentation walks through the Security and Compliance functionality to customers leveraging Azure as a compute environment. It includes deep-dive references to detailed information on each topic presented.
Azure - Identity as a service
This document summarizes Microsoft Azure Active Directory (Azure AD) and how it compares to on-premises Active Directory Domain Services (AD DS). Azure AD provides identity and access management in the cloud, while AD DS is installed on-premises. Key differences include Azure AD being multi-tenant, lacking group policy support, and using REST APIs instead of LDAP. The document also outlines integrating Azure AD and AD DS through synchronization and federation for single sign-on capabilities across cloud and on-premises applications and services.
Azure WAF
Azure WAF is a cloud-native web application firewall service that provides powerful protection for web apps with simple deployment, low maintenance costs, and automatic updates. It acts as a content delivery network and can defend against common attacks like command execution, SQL injection, cross-site scripting, and more, as demonstrated in a presentation where custom rules were set up to create an Azure WAF.
Microsoft Azure alerts
The document discusses different types of alerts and notifications that can be received in Azure. It describes how alert rules enable monitoring of Azure services based on metric values, and how notifications are sent by email when rules are triggered or alert conditions are resolved. It also discusses monitoring alerts for cloud services and metrics, and how the Azure Billing Alert Service allows creating customized billing alerts to monitor billing activity for Azure accounts.
7 Experts on Implementing Microsoft 365 Defender
The document provides an introduction to Microsoft 365 Defender, a suite of integrated security tools from Microsoft for protecting endpoints, Office 365 applications, identities, and cloud applications. It notes that while Microsoft makes these tools easy to deploy, properly configuring them to optimize operation and manage costs requires skill and effort. The document aims to provide basic, practical approaches to implementing Microsoft 365 Defender and suggestions for managing the tools to meet changing security requirements. Expert advice is solicited on transitioning to and optimizing the Microsoft 365 Defender suite.
Microsoft Azure Overview
David J. Rosenthal gave a presentation about Microsoft's Azure cloud platform. He discussed how Azure can help companies with digital transformation by engaging customers, empowering employees, and optimizing operations. He provided examples of how companies are using Azure services like AI, IoT, analytics and more to modernize applications, gain insights from data, and improve productivity. Rosenthal emphasized that Azure offers a secure, flexible cloud platform that businesses can use to innovate, grow and transform both today and in the future.
Threat Hunting on AWS using Azure Sentinel
This document provides information about an Azure Sentinel webinar on threat hunting on AWS using Azure Sentinel. It includes an agenda for the webinar with topics like AWS CloudTrail, customizable workbooks, built-in queries and analytics rules. It also provides links for questions, recordings, feedback and the community forum.
Microsoft Zero Trust
A Zero Trust approach should extend throughout the entire digital estate and serve as an integrated security philosophy and end to end strategy.
Identities. Identities whether they represent people, services, or IOT devices define the Zero Trust control plane. When an identity attempts to access a resource, we need to verify that identity with strong authentication, ensure access is compliant and typical for that identity, and follows least privilege access principles.
Devices. Once an identity has been granted access to a resource, data can flow to a variety of different devices From IoT devices to smartphones, BYOD to partner managed devices, and on premises workloads to cloud hosted servers. This diversity creates a massive attack surface area, requiring we monitor and enforce device health and compliance for secure access.
Applications. Applications and APIs provide the interface by which data is consumed. They may be legacy on premises, lift and shifted to cloud workloads, or modern SaaS applications. Controls and technologies should be applied to discover Shadow IT, ensure appropriate in-app permissions, gate access based on real-time analytics, monitor for abnormal behavior, control of user actions, and validate secure configuration options.
Data. Ultimately, security teams are focused on protecting data. Where possible, data should remain safe even if it leaves the devices, apps, infrastructure, and networks the organization controls. Data should be classified, labeled, and encrypted, and access restricted based on those attributes.
Infrastructure. Infrastructure (whether on premises servers, cloud based VMs, containers, or micro services) represents a critical threat vector. Assess for version, configuration, and JIT access to harden defense, use telemetry to detect attacks and anomalies, and automatically block and flag risky behavior and take protective actions.
Networks. All data is ultimately accessed over network infrastructure. Networking controls can provide critical “in pipe” controls to enhance visibility and help prevent attackers from moving laterally across the network. Networks should be segmented (including deeper in network micro segmentation) and real time threat protection, end to end encryption, monitoring, and analytics should be employed.
Each of these six foundational elements serves as a source of the signal, a control plane for enforcement, and a critical resource to defend. You should appropriately spread your investments across each of these elements for maximum protection.
Intro to azure logic apps
Jared Matfess is a Microsoft MVP and technology consultant at Slalom Consulting who is interested in craft beer. His areas of expertise include API apps, web apps, mobile apps, and logic apps built on Microsoft's App Service platform. Logic Apps allows users to automate business processes across SaaS and on-premises systems using a visual designer without writing code. It offers over a hundred templates to get started quickly on tasks like collecting data, automating approvals, and synchronizing files. Logic Apps is serverless and supports advanced scenarios with multiple steps, looping, branching conditions. It differs from Microsoft Flow in its focus on enterprise scenarios over self-service use cases.
What's hot (20)
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
Microsoft Sentinel- a cloud native SIEM & SOAR.pdf
Microsoft Azure Security Overview - Microsoft - CSS Dallas Azure
Microsoft Azure Security Overview - Microsoft - CSS Dallas Azure
Azure landing zones - Terraform module design considerations - Azure Architec...
Azure landing zones - Terraform module design considerations - Azure Architec...
azure-security-overview-slideshare-180419183626.pdf
azure-security-overview-slideshare-180419183626.pdf
Similar to Getting Started with Azure Sentinel
Kåre Rude Andersen - Create a scombot – automate and monitor azure
Kåre Rude Andersen presented on automating and monitoring Azure resources using System Center Operations Manager (SCOM). The presentation covered automating SCOM installation and maintenance, monitoring internal SCOM components, setting up monitoring of Azure resources using the Azure management pack, and global service monitoring. Demonstrations showed automating SCOM agent installation and maintenance, monitoring Azure resources and internal SCOM rules, and configuring the global service monitor and advisor features.
NVS_Sentinel
Using Azure Sentinel to catch the bad guys covers how to use Azure Sentinel and other Microsoft security tools to detect threats. The document discusses the growing ransomware threat landscape, example attack methods like credential dumping and lateral movement, and important log sources in Azure like Azure Active Directory logs, Azure Network logs, and Windows event logs. It also covers setting up Azure Sentinel with data connectors, creating analytics rules and queries, and automating response with Logic Apps playbooks. Examples of hunting queries and using external threat intelligence are provided.
O365Con18 - A Lap Around Monitoring, Auditing and Securing Microsoft Azure - ...
This document provides an overview of monitoring, managing, and securing Microsoft Azure. It discusses various Azure services for monitoring like Azure Monitor and Application Insights. It also covers managing Azure through tools like Azure Advisor, log analytics, and Azure governance features. Finally, it outlines steps for securing Azure such as using Azure Active Directory, Privileged Identity Management, and security-related services. The document provides guidance on skills needed for working with Azure and recommends certifications and additional learning resources.
SBA Security Meetup - Deploying and managing azure sentinel as code by Bojan ...
Deploying and Managing Azure Sentinel as Code
In this Meetup, Bojan Magusic will explore and demonstrate how to detect threats and respond smarter and faster and eliminate security risks using Azure Sentinel as Code. The talk will cover specifically:
- Security challenges that SOC teams are facing
- How can the public cloud help us manage those challenges
- What is a cloud-native next-generation SIEM
- Glimpse into a cloud native next-gen SIEM that is Azure Sentinel
- Using Infrastructure as Code to manage Azure Sentinel
Speaker:
Bojan Magusic (Cloud Solution Architect - Security & Compliance - Microsoft)
Talk language: English
About the Speaker:
*********************
Bojan Magusic is a Cloud Solution Architect - Security & Compliance, One Commercial Partner, Microsoft Ireland. He will explore and demonstrate how to detect threats and respond smarter and faster and eliminate security risk using Azure Sentinel as Code. Bojan acts as a technology expert for Microsoft partners in Western Europe, who are looking to build new solutions based on Microsoft’s Azure cloud platform technologies. He has a strong passion for cybersecurity, advancing women in tech, and professional development. He is very interested in building partnerships with other companies to learn how they support, advance, and retain their cyber talent. In addition to various technical certifications, he also has received certifications from INSEAD and Kellogg School of Management. Bojan resides in Dublin (Ireland), from where he is living the dream!
7.habits.every.azure.admin.must.have.v082020
The systems administrator role is perhaps one of the oldest in computer technology. However in this modern cloud computing world some of them will evolve into Cloud Administrators. As for those admins? It could be a case of how more things change, the more they stay the same. In their new role as an Azure Administrator they will be responsible for implementing, monitoring and maintaining Azure resources and use a complete new skill set. In this session you will learn 7 habits every new Azure admin must have. You will not only learn about Azure Cost Management, and Azure Governance, but also which tools you can use to connect securely to your Azure resources. So join us in this session to learn some tips, tricks and things you should keep in mind in this new job role.
December 2022 Microsoft 365 Need to Know Webinar
Slides from CIAOPS December 2021 webinar that provided Microsoft 365 news update, open Q & A as well as a focus session on Azure. Video recording is available at www.ciaopsacademy.com
Azure Saturday: Security + DevOps + Azure = Awesomeness
Slides from my presentation at Azure Saturday on 26.5.2018 in Munich.
In this session, I will cover the Secure DevOps Toolkit for Azure, a set of security-related tools, Powershell modules, extensions and automations for Azure. The session is a collection of lessons learned using the Toolkit from real-life projects.
After this sessions you will be able to improve the security of your Azure usage from IDE to Operations, regardless of your current state of security and level of cloud adoption.
IT Camp 19: Top Azure security fails and how to avoid them
As delivered at the IT Camp 19 in Cluj-Napoca, Romania.
Karl Ots has assessed the security of over 100 solutions built on the Microsoft Azure cloud. He has found that there are 6 key security pitfalls that are common across all industry verticals and company sizes. In this session, he will share what these security pitfalls are, why do they matter and how to mitigate them.
Get On Top of Azure Resource Security Using Secure DevOps Kit for Azure
In any cloud transformation journey, you must ensure that the security is automated and baked into all aspects of engineering. Learn how to use the new Secure DevOps Kit for Azure to tighten up the security of your Azure Resources and how to automate it as part of your DevOps Pipelines.
Building a Secure and Compliant Azure Virtual Data Center
Slides from ILTACON19 Session on Building a Secure and Compliance Infrastructure in Microsoft Azure
DevSum - Top Azure security fails and how to avoid them
As presented at the DevSum19 conference in Stockholm, Sweden.
Karl Ots has assessed the security of over 100 solutions built on the Microsoft Azure cloud. He has found that there are 6 key security pitfalls that are common across all industry verticals and company sizes. In this session, he will share what these security pitfalls are, why do they matter and how to mitigate them.
Power of the cloud - Introduction to azure security
Slides used during the session
Introduction to Microsoft Azure Security
Azure provides you with a wide array of configurable security options and the ability to control them so that you can customize security to meet the unique requirements of your organization’s deployments. This presentation helps you understand how Azure security capabilities can help you fulfill these requirements using options such as Azure AD, Azure Security Center, Azure Advisor, and Azure Monitor.
Must have tools for windows azure
Must have tools for Windows Azure : During our AzureUG.SG meeting i cover variety of the third-party tools available in the Windows Azure ecosystem. Included are tools for both developers and IT professionals. We look at tools that will help manage storage and resources, migration, scaling, diagnostics and software components that will help you build cloud applications.
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
Speaker 1: Olaf Hartong
Speaker 2: Edoardo Gerosa
Azure Sentinel, Microsoft's new cloud SIEM solution, was recently released on the market. Notwithstanding its strengths Sentinel offers limited threat hunting capabilities out of the box and setting up an effective hunting solution is not straightforward. The Sentinel ATT&CK GitHub project is designed to provide guidance on setting up an ATT&CK-driven process monitoring solution within Sentinel; giving DFIR professionals a tool to effectively hunt in the Azure cloud.
The project, building on previous work from the open source DFIR community, provides instructions on how to properly configure Sysmon to monitor and detect specific processes in alignment with MITRE's ATT&CK framework. Secondly it provides clarity on how to onboard Sysmon logs from Windows virtual machines, shedding light on some poorly documented areas, while also offering an open source parser to correctly ingest Sysmon data in conformity with the Open Source Security Event Metadata information model. Thirdly it offers around 120 open source Kusto Query Language alerts ready for deployment; each mapped to a unique MITRE ATT&CK technique. Fourthly it provides a dedicated threat hunting dashboard to help DFIR professionals monitor their environment and execute precise hunts. Finally, Sentinel ATT&CK provides ready-made hunting queries to be leveraged when responding to alert notifications raised by the threat hunting dashboard.
This talk delivers an overview of how the Sentinel ATT&CK project can help organisations establish an effective threat hunting capability in Azure as well as an opportunity to share with the community the strengths and shortcomings of Sentinel when it comes to hunting adversaries within the Microsoft cloud.
SUGCON: The Agile Nirvana of DevSecOps and Containerization
Sitecore deployments are traditionally relatively expensive due to the technological and architectural limitations. The introduction of a containerized hosting model is a game-changer in the Sitecore DevOps story. It allows DevOps teams to enable delivery security features, and reduce deployment cycles through automation, by activating DevSecOps strategies. This flexibility or cost-efficiency of containerized deployments allows DevOps and engineering teams to focus on and align around business value, rather than being handicapped by the legacy technology and systems. In this session we will walk the attendees through the benefits of a DevSecOps pipeline to IT, development teams, and their business leadership and show what it takes to migrate to the AKS-hosted infrastructure from an on-premise setup. We will present a reference design for an automated DevSecOps pipeline that focuses on security, quality, and speed. The session will cover the learnings from a major healthcare technology and research company that has gone through this shift and highlight the impact they experienced on the infrastructure, solution architecture, DevOps pipeline, processes and internal resources - Infrastructure: we will provide a feature overview of Azure vs AWS as it relates to a containerized Sitecore implementation, covering risks, cons, and pros associated with each and the cost estimation process for AKS. Sitecore Topology: we will cover the steps for changing Sitecore default AKS topology for maximum cost efficiency, and flexibility. DevOps pipeline: we will cover the automation that is required to move towards DevSecOps with environment creation via Infrastructure as Code, disaster recovery, and zero-downtime fully automated deployments to production. Processes and team changes: We will present how the new DevSecOps pipeline will affect internal processes and what internal support team changes are required to continue managing the new infrastructure and release pipeline.
Using Security to Build with Confidence in AWS - Trend Micro
Using Security to Build with Confidence in AWS - Trend Micro
Singapore
Presented by Sasha Pavlovic
Director, Cloud and Datacenter Security | APAC
CloudBrew 2017 - Security + DevOps + Azure = Awesomeness
Presentation at the CloudBRew 2017 conference in in 25th of November 2017 in Mechelen, Belgium.
In this session, I will cover the Secure DevOps Toolkit for Azure, a set of security-related tools, Powershell modules, extensions and automations for Azure. The session is a collection of lessons learned using the Toolkit from real-life projects. After this sessions you will be able to improve the security of your Azure usage from IDE to Operations, regardless of your current state of security and level of cloud adoption.
aOS Monaco 2019 - A7 - Sécurisez votre SI et vos services Office 365 partie 2...
This document discusses Microsoft threat protection services, including Azure Advanced Threat Protection (AATP), Azure Security Center, and Azure Sentinel. It provides an overview of how each service detects and protects against threats. AATP monitors user behavior and activities to detect compromised identities and insider threats. Azure Security Center continuously assesses security state, manages policies and compliance, and provides recommendations to optimize security. Azure Sentinel provides log analytics and security automation across data sources to detect threats and support investigations.
SharePoint Saturday Ottawa 2014 - Microsoft Azure : Central component of your...
The Cloud can help you and your organization to maximize your investments and to simplify your business processes for all your SharePoint activities. Microsoft Azure can offer you a lot of services that can allow you to transform your infrastructures, your development paradigm and your IT teams to start thinking in terms of DevOps. In this session, our goal will be to show you how to use the Azure platform in an enterprise where SharePoint is used as an application platform. Subjects covered will be :
- Microsoft Azure as IaaS
- Microsoft Azure as CDN
- Microsoft Azure as hub for all your ALM with Visual Studio Online
- Microsoft Azure as an application layer for all your SharePoint Apps
- Microsoft Azure as a complex integration environment
- Microsoft Azure as a deployment framework
The cloud and Microsoft Azure to help the SharePoint platform, it's possible! By Sebastien Levert and Julien Stroheker - Twitter: @sebastienlevert and @Ju_Stroh
CIAOPS Need to Know Azure Webinar - January 2018
This webinar provided an overview of Azure Active Directory (Azure AD) and how it compares to on-premises Active Directory. Azure AD can centrally manage user identities and access for modern devices connected to the cloud. It also integrates with on-premises domains and includes options like Azure AD Premium for advanced capabilities. The webinar demonstrated Azure AD and provided resources for learning more about identity management in the cloud.
Similar to Getting Started with Azure Sentinel (20)
Kåre Rude Andersen - Create a scombot – automate and monitor azure
Kåre Rude Andersen - Create a scombot – automate and monitor azure
O365Con18 - A Lap Around Monitoring, Auditing and Securing Microsoft Azure - ...
O365Con18 - A Lap Around Monitoring, Auditing and Securing Microsoft Azure - ...
SBA Security Meetup - Deploying and managing azure sentinel as code by Bojan ...
SBA Security Meetup - Deploying and managing azure sentinel as code by Bojan ...
Azure Saturday: Security + DevOps + Azure = Awesomeness
Azure Saturday: Security + DevOps + Azure = Awesomeness
IT Camp 19: Top Azure security fails and how to avoid them
IT Camp 19: Top Azure security fails and how to avoid them
Get On Top of Azure Resource Security Using Secure DevOps Kit for Azure
Get On Top of Azure Resource Security Using Secure DevOps Kit for Azure
Building a Secure and Compliant Azure Virtual Data Center
Building a Secure and Compliant Azure Virtual Data Center
DevSum - Top Azure security fails and how to avoid them
DevSum - Top Azure security fails and how to avoid them
Power of the cloud - Introduction to azure security
Power of the cloud - Introduction to azure security
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
SUGCON: The Agile Nirvana of DevSecOps and Containerization
SUGCON: The Agile Nirvana of DevSecOps and Containerization
Using Security to Build with Confidence in AWS - Trend Micro
Using Security to Build with Confidence in AWS - Trend Micro
CloudBrew 2017 - Security + DevOps + Azure = Awesomeness
CloudBrew 2017 - Security + DevOps + Azure = Awesomeness
aOS Monaco 2019 - A7 - Sécurisez votre SI et vos services Office 365 partie 2...
aOS Monaco 2019 - A7 - Sécurisez votre SI et vos services Office 365 partie 2...
SharePoint Saturday Ottawa 2014 - Microsoft Azure : Central component of your...
SharePoint Saturday Ottawa 2014 - Microsoft Azure : Central component of your...
Recently uploaded
How to Manage Your Lost Opportunities in Odoo 17 CRM
Odoo 17 CRM allows us to track why we lose sales opportunities with "Lost Reasons." This helps analyze our sales process and identify areas for improvement. Here's how to configure lost reasons in Odoo 17 CRM
Main Java[All of the Base Concepts}.docx
This is part 1 of my Java Learning Journey. This Contains Custom methods, classes, constructors, packages, multithreading , try- catch block, finally block and more.
RPMS TEMPLATE FOR SCHOOL YEAR 2023-2024 FOR TEACHER 1 TO TEACHER 3
RPMS Template 2023-2024 by: Irene S. Rueco
BÀI TẬP BỔ TRỢ TIẾNG ANH 8 CẢ NĂM - GLOBAL SUCCESS - NĂM HỌC 2023-2024 (CÓ FI...
BÀI TẬP BỔ TRỢ TIẾNG ANH 8 CẢ NĂM - GLOBAL SUCCESS - NĂM HỌC 2023-2024 (CÓ FI...Nguyen Thanh Tu Collection
https://app.box.com/s/y977uz6bpd3af4qsebv7r9b7s21935vdHow to Setup Warehouse & Location in Odoo 17 Inventory
In this slide, we'll explore how to set up warehouses and locations in Odoo 17 Inventory. This will help us manage our stock effectively, track inventory levels, and streamline warehouse operations.
Walmart Business+ and Spark Good for Nonprofits.pdf
"Learn about all the ways Walmart supports nonprofit organizations.
You will hear from Liz Willett, the Head of Nonprofits, and hear about what Walmart is doing to help nonprofits, including Walmart Business and Spark Good. Walmart Business+ is a new offer for nonprofits that offers discounts and also streamlines nonprofits order and expense tracking, saving time and money.
The webinar may also give some examples on how nonprofits can best leverage Walmart Business+.
The event will cover the following::
Walmart Business + (https://business.walmart.com/plus) is a new shopping experience for nonprofits, schools, and local business customers that connects an exclusive online shopping experience to stores. Benefits include free delivery and shipping, a 'Spend Analytics” feature, special discounts, deals and tax-exempt shopping.
Special TechSoup offer for a free 180 days membership, and up to $150 in discounts on eligible orders.
Spark Good (walmart.com/sparkgood) is a charitable platform that enables nonprofits to receive donations directly from customers and associates.
Answers about how you can do more with Walmart!"
ISO/IEC 27001, ISO/IEC 42001, and GDPR: Best Practices for Implementation and...
Denis is a dynamic and results-driven Chief Information Officer (CIO) with a distinguished career spanning information systems analysis and technical project management. With a proven track record of spearheading the design and delivery of cutting-edge Information Management solutions, he has consistently elevated business operations, streamlined reporting functions, and maximized process efficiency.
Certified as an ISO/IEC 27001: Information Security Management Systems (ISMS) Lead Implementer, Data Protection Officer, and Cyber Risks Analyst, Denis brings a heightened focus on data security, privacy, and cyber resilience to every endeavor.
His expertise extends across a diverse spectrum of reporting, database, and web development applications, underpinned by an exceptional grasp of data storage and virtualization technologies. His proficiency in application testing, database administration, and data cleansing ensures seamless execution of complex projects.
What sets Denis apart is his comprehensive understanding of Business and Systems Analysis technologies, honed through involvement in all phases of the Software Development Lifecycle (SDLC). From meticulous requirements gathering to precise analysis, innovative design, rigorous development, thorough testing, and successful implementation, he has consistently delivered exceptional results.
Throughout his career, he has taken on multifaceted roles, from leading technical project management teams to owning solutions that drive operational excellence. His conscientious and proactive approach is unwavering, whether he is working independently or collaboratively within a team. His ability to connect with colleagues on a personal level underscores his commitment to fostering a harmonious and productive workplace environment.
Date: May 29, 2024
Tags: Information Security, ISO/IEC 27001, ISO/IEC 42001, Artificial Intelligence, GDPR
-------------------------------------------------------------------------------
Find out more about ISO training and certification services
Training: ISO/IEC 27001 Information Security Management System - EN | PECB
ISO/IEC 42001 Artificial Intelligence Management System - EN | PECB
General Data Protection Regulation (GDPR) - Training Courses - EN | PECB
Webinars: https://pecb.com/webinars
Article: https://pecb.com/article
-------------------------------------------------------------------------------
For more information about PECB:
Website: https://pecb.com/
LinkedIn: https://www.linkedin.com/company/pecb/
Facebook: https://www.facebook.com/PECBInternational/
Slideshare: http://www.slideshare.net/PECBCERTIFICATION
The Diamonds of 2023-2024 in the IGRA collection
A review of the growth of the Israel Genealogy Research Association Database Collection for the last 12 months. Our collection is now passed the 3 million mark and still growing. See which archives have contributed the most. See the different types of records we have, and which years have had records added. You can also see what we have for the future.
DRUGS AND ITS classification slide share
Any substance (other than food) that is used to prevent, diagnose, treat, or relieve symptoms of a
disease or abnormal condition
Natural birth techniques - Mrs.Akanksha Trivedi Rama University
Natural birth techniques - Mrs.Akanksha Trivedi Rama UniversityAkanksha trivedi rama nursing college kanpur.
Natural birth techniques are various type such as/ water birth , alexender method, hypnosis, bradley method, lamaze method etcবাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
বাংলাদেশের অর্থনৈতিক সমীক্ষা ২০২৪ [Bangladesh Economic Review 2024 Bangla.pdf] কম্পিউটার , ট্যাব ও স্মার্ট ফোন ভার্সন সহ সম্পূর্ণ বাংলা ই-বুক বা pdf বই " সুচিপত্র ...বুকমার্ক মেনু 🔖 ও হাইপার লিংক মেনু 📝👆 যুক্ত ..
আমাদের সবার জন্য খুব খুব গুরুত্বপূর্ণ একটি বই ..বিসিএস, ব্যাংক, ইউনিভার্সিটি ভর্তি ও যে কোন প্রতিযোগিতা মূলক পরীক্ষার জন্য এর খুব ইম্পরট্যান্ট একটি বিষয় ...তাছাড়া বাংলাদেশের সাম্প্রতিক যে কোন ডাটা বা তথ্য এই বইতে পাবেন ...
তাই একজন নাগরিক হিসাবে এই তথ্য গুলো আপনার জানা প্রয়োজন ...।
বিসিএস ও ব্যাংক এর লিখিত পরীক্ষা ...+এছাড়া মাধ্যমিক ও উচ্চমাধ্যমিকের স্টুডেন্টদের জন্য অনেক কাজে আসবে ...
Chapter 4 - Islamic Financial Institutions in Malaysia.pptx
Chapter 4 - Islamic Financial Institutions in Malaysia.pptxMohd Adib Abd Muin, Senior Lecturer at Universiti Utara Malaysia
This slide is special for master students (MIBS & MIFB) in UUM. Also useful for readers who are interested in the topic of contemporary Islamic banking.
Advanced Java[Extra Concepts, Not Difficult].docx
This is part 2 of my Java Learning Journey. This contains Hashing, ArrayList, LinkedList, Date and Time Classes, Calendar Class and more.
South African Journal of Science: Writing with integrity workshop (2024)
South African Journal of Science: Writing with integrity workshop (2024)Academy of Science of South Africa
A workshop hosted by the South African Journal of Science aimed at postgraduate students and early career researchers with little or no experience in writing and publishing journal articles.Recently uploaded (20)
How to Manage Your Lost Opportunities in Odoo 17 CRM
How to Manage Your Lost Opportunities in Odoo 17 CRM
RPMS TEMPLATE FOR SCHOOL YEAR 2023-2024 FOR TEACHER 1 TO TEACHER 3
RPMS TEMPLATE FOR SCHOOL YEAR 2023-2024 FOR TEACHER 1 TO TEACHER 3
BÀI TẬP BỔ TRỢ TIẾNG ANH 8 CẢ NĂM - GLOBAL SUCCESS - NĂM HỌC 2023-2024 (CÓ FI...
BÀI TẬP BỔ TRỢ TIẾNG ANH 8 CẢ NĂM - GLOBAL SUCCESS - NĂM HỌC 2023-2024 (CÓ FI...
How to Setup Warehouse & Location in Odoo 17 Inventory
How to Setup Warehouse & Location in Odoo 17 Inventory
Walmart Business+ and Spark Good for Nonprofits.pdf
Walmart Business+ and Spark Good for Nonprofits.pdf
ISO/IEC 27001, ISO/IEC 42001, and GDPR: Best Practices for Implementation and...
ISO/IEC 27001, ISO/IEC 42001, and GDPR: Best Practices for Implementation and...
Natural birth techniques - Mrs.Akanksha Trivedi Rama University
Natural birth techniques - Mrs.Akanksha Trivedi Rama University
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
বাংলাদেশ অর্থনৈতিক সমীক্ষা (Economic Review) ২০২৪ UJS App.pdf
Film vocab for eal 3 students: Australia the movie
Film vocab for eal 3 students: Australia the movie
Chapter 4 - Islamic Financial Institutions in Malaysia.pptx
Chapter 4 - Islamic Financial Institutions in Malaysia.pptx
South African Journal of Science: Writing with integrity workshop (2024)
South African Journal of Science: Writing with integrity workshop (2024)
Getting Started with Azure Sentinel
- 1. Getting stated with Azure Sentinel (Cloud Native SIEM) SAMIK ROY Bangalore, India. @roy_samik linkedin.com/in/roysamik https://github.com/samikroy Samik.n.roy@gmail.com 🐱👤 ➡️ 🛡🛡 @ Open Systems | Community 🔈 October 2nd , 2021 Microsoft 365 , Power Platform & cloud Security UG-India
- 2. AGENDA Why Azure Sentinel 🤔 Walkthrough 🚶 QnA 🙋 What Next 😊
- 4. Why Azure Sentinel 🤔 Security Operations Challenges Expanding digital estate
- 5. Why Azure Sentinel 🤔 • It is new ear SIEM which privilges security team to have a cycle of a • Data collection • Anomaly / Threat Detection • Investigate / Hunting • Respond & Remediate • And the tool is laid out in sections as • General • Threat Management • Configuration • Now, lets a have a look in the portal.
- 6. Walkthrough🚶
- 7. Various MS Sec Products
- 8. QnA 🙋
- 9. What Next 😊
- 10. What Next🤔 • Set up azure sentinel for your tenant on your own: • https://www.youtube.com/watch?v=Cyd16wVwxZc • Plan for long term data storage: • https://www.linkedin.com/pulse/howto-configure-azure-sentinel-data-export-long- term-storage-lauren/ • Resources • KQL Cheat Sheet • https://techcommunity.microsoft.com/t5/azure-data-explorer/azure-data-explorer- kql-cheat-sheets/ba-p/1057404 • Community • https://github.com/Azure/Azure-Sentinel
- 11. Thank you 🙏