SlideShare a Scribd company logo
Microsoft Sentinel - a cloud-native SIEM & SOAR
Knowledge Sharing Session
By
Kranthi Aragonda
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
Agenda:
• What is SOAR
• Important SOAR capabilities
• Benefits & Drawbacks
• SIEM vs SOAR
• Microsoft Sentinel
• Data Connectors
• Workbooks
• Analytics
• Security automation & orchestration
• Investigation
• Hunting
• Notebooks
• Resources & Certifications.
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
What is SOAR
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• SOAR is a stack of compatible software programs that enables an organization to collect data about security threats and respond to
security events without human assistance. SOAR platforms have three main components: security orchestration, security automation
and security response.
• The goal of using a SOAR platform is to improve the efficiency of physical and digital security operations.
Important SOAR capabilities
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Security incident response platforms, which include capabilities such as vulnerability management, case management, incident
management, workflows, incident knowledge base, auditing and logging capabilities, reporting and more;
• Security orchestration and automation, which include integrations, workflow automation, playbooks, playbook management, data
gathering, log analysis and account lifecycle management; and
• Threat intelligence platforms, which include threat intelligence aggregation, analysis and distribution, alert context enrichment and
threat intelligence visualization.
Benefits & drawbacks of SOAR tool
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• SOAR is not a replacement for other security tools, but rather is a complementary technology. SOAR platforms are also not a
replacement for human analysts, but instead augment their skills and workflows for more effective incident detection and response.
• Faster incident detection.
• Better threat context.
• Simplified management.
• Boosting analysts’ productivity.
Benefits Drawbacks
• failure to remediate a broader security strategy.
• conflated expectations.
• deployment and management complexity.
• lack of or limited metrics.
SIEM vs SOAR
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• SIEM systems collect data, identify deviations,
rank threats and generate alerts.
• SIEM systems only alert security analysts of a
potential event
SIEM SOAR
• SOAR systems also handle these tasks but have
additional capabilities.
• First, SOAR platforms integrate with a wider range
of internal and external applications, both security
and non-security.
• Second, SOAR platforms use automation, AI and
machine learning to provide greater context and
automated responses to those threats.
Microsoft Sentinel
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Microsoft Sentinel is a scalable, cloud-native, security information and event management (SIEM) and security orchestration,
automation, and response (SOAR) solution. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across
the enterprise, providing a single solution for attack detection, threat visibility, proactive hunting, and threat response.
• Collect data at cloud scale across all
users, devices, applications, and
infrastructure, both on-premises and in
multiple clouds.
• Respond to incidents rapidly with built-
in orchestration and automation of
common tasks.
• Detect previously undetected threats
and minimize false positives using
Microsoft's analytics and unparalleled
threat intelligence.
• Investigate threats with artificial
intelligence, and hunt for suspicious
activities at scale, tapping into years of
cyber security work at Microsoft.
Data Connectors
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Microsoft Sentinel comes with several connectors for Microsoft solutions, available and providing real-time integration, including
Microsoft 365 Defender solutions, and Microsoft 365 sources, including Office 365, Azure AD, Microsoft Defender for Identity, and
Microsoft Defender for Cloud Apps, and more.
• In addition, there are built-in connectors to the broader security ecosystem for non-Microsoft solutions. You can also use common
event format, Syslog or REST-API to connect your data sources with Microsoft Sentinel as well.
Data Connectors
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
Workbooks
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• we can monitor the data using the Microsoft Sentinel integration with Azure Monitor Workbooks, which provides
versatility in creating custom workbooks.
Workbooks
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Microsoft Sentinel Workbooks allow security analysts and admins to view data about security in their environment using graphical
displays.
Analytics
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
Microsoft Sentinel uses analytics to correlate alerts into incidents. Incidents are groups of related alerts that together create an
actionable possible-threat that you can investigate and resolve
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
Analytics
• Detect previously undetected threats and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.
Security automation & orchestration
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Automation of common tasks and simplify security orchestration with playbooks that integrate with Azure services and
existing tools
• Playbooks are intended for SOC engineers and analysts of all tiers, to automate and simplify tasks, including data
ingestion, enrichment, investigation, and remediation
Sample Playbook
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
Investigation
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
Microsoft Sentinel deep investigation tools helps to understand the scope and find the root cause, of a potential security threat. we can
choose an entity on the interactive graph to ask interesting questions for a specific entity, and drill down into that entity and its
connections to get to the root cause of the threat.
Hunting
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Microsoft Sentinel's hunting search-and-query tools, based on the MITRE framework, which enables to proactively hunt
for security threats across organization’s data sources, before an alert is triggered.
• After discovering which hunting query provides high-value insights into possible attacks, we can create custom detection
rules based on your query, and surface those insights as alerts to security incident responders
Notebooks
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Microsoft Sentinel notebooks are intended for threat hunters or Tier 2-3 analysts, incident investigators, data
scientists, and security researchers.
• Notebooks provide queries to both Microsoft Sentinel and external data, features for data enrichment, investigation,
visualization, hunting, machine learning, and big data analytics.
• Notebooks require a higher learning curve and coding knowledge and have limited automation support.
Resources & Certifications
Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
• Microsoft Sentinel documentation
• SC-900: Microsoft Security, Compliance, and Identity Fundamentals
• SC-200: Microsoft Security Operations Analyst
• Microsoft Sentinel Ninja: The complete level 400 training
N E W Y O R K | D U B A I | M U M B A I | P U N E | D E L H I | B E N G A L U R U | S I N G A P O R E
20
©2022 Network Intelligence. All Rights Reserved.

More Related Content

What's hot

Azure Sentinel Jan 2021 overview deck
Azure Sentinel Jan 2021 overview deck Azure Sentinel Jan 2021 overview deck
Azure Sentinel Jan 2021 overview deck
Matt Soseman
 
Cybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architectureCybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architecture
Priyanka Aash
 
Azure Sentinel
Azure SentinelAzure Sentinel
Azure Sentinel
Cheah Eng Soon
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
AlienVault
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012  building a security operations center (soc)Rothke rsa 2012  building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
Ben Rothke
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
Jonathan Sinclair
 
Microsoft 365 Security and Compliance
Microsoft 365 Security and ComplianceMicrosoft 365 Security and Compliance
Microsoft 365 Security and Compliance
David J Rosenthal
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
CMR WORLD TECH
 
azure-security-overview-slideshare-180419183626.pdf
azure-security-overview-slideshare-180419183626.pdfazure-security-overview-slideshare-180419183626.pdf
azure-security-overview-slideshare-180419183626.pdf
BenAissaTaher1
 
Security operation center
Security operation centerSecurity operation center
Security operation center
MuthuKumaran267
 
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
CloudVillage
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
Sqrrl
 
5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)
5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)
5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)
Vijilan IT Security solutions
 
Microsoft Defender and Azure Sentinel
Microsoft Defender and Azure SentinelMicrosoft Defender and Azure Sentinel
Microsoft Defender and Azure Sentinel
David J Rosenthal
 
Azure Security Fundamentals
Azure Security FundamentalsAzure Security Fundamentals
Azure Security Fundamentals
Lorenzo Barbieri
 
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
IBM Security
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
Priyanka Aash
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
S.E. CTS CERT-GOV-MD
 
Azure sentinel
Azure sentinelAzure sentinel
Azure sentinel
Marius Sandbu
 

What's hot (20)

Azure Sentinel Jan 2021 overview deck
Azure Sentinel Jan 2021 overview deck Azure Sentinel Jan 2021 overview deck
Azure Sentinel Jan 2021 overview deck
 
Cybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architectureCybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architecture
 
Azure Sentinel
Azure SentinelAzure Sentinel
Azure Sentinel
 
Security Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SMESecurity Operations Center (SOC) Essentials for the SME
Security Operations Center (SOC) Essentials for the SME
 
Rothke rsa 2012 building a security operations center (soc)
Rothke rsa 2012  building a security operations center (soc)Rothke rsa 2012  building a security operations center (soc)
Rothke rsa 2012 building a security operations center (soc)
 
SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?SOC: Use cases and are we asking the right questions?
SOC: Use cases and are we asking the right questions?
 
Microsoft 365 Security and Compliance
Microsoft 365 Security and ComplianceMicrosoft 365 Security and Compliance
Microsoft 365 Security and Compliance
 
Strategy considerations for building a security operations center
Strategy considerations for building a security operations centerStrategy considerations for building a security operations center
Strategy considerations for building a security operations center
 
azure-security-overview-slideshare-180419183626.pdf
azure-security-overview-slideshare-180419183626.pdfazure-security-overview-slideshare-180419183626.pdf
azure-security-overview-slideshare-180419183626.pdf
 
Security operation center
Security operation centerSecurity operation center
Security operation center
 
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
ATT&CKing the Sentinel – deploying a threat hunting capability on Azure Senti...
 
Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)Building a Next-Generation Security Operations Center (SOC)
Building a Next-Generation Security Operations Center (SOC)
 
5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)
5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)
5 BEST PRACTICES FOR A SECURITY OPERATION CENTER (SOC)
 
Microsoft Defender and Azure Sentinel
Microsoft Defender and Azure SentinelMicrosoft Defender and Azure Sentinel
Microsoft Defender and Azure Sentinel
 
Soc
SocSoc
Soc
 
Azure Security Fundamentals
Azure Security FundamentalsAzure Security Fundamentals
Azure Security Fundamentals
 
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
Building a Next-Generation Security Operation Center Based on IBM QRadar and ...
 
From SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity ChasmFrom SIEM to SOC: Crossing the Cybersecurity Chasm
From SIEM to SOC: Crossing the Cybersecurity Chasm
 
Building Security Operation Center
Building Security Operation CenterBuilding Security Operation Center
Building Security Operation Center
 
Azure sentinel
Azure sentinelAzure sentinel
Azure sentinel
 

Similar to Microsoft Sentinel- a cloud native SIEM & SOAR.pdf

SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
Ajit Wadhawan
 
How to Reduce the Financial Impact of Security Incidents by 90% or More with ...
How to Reduce the Financial Impact of Security Incidents by 90% or More with ...How to Reduce the Financial Impact of Security Incidents by 90% or More with ...
How to Reduce the Financial Impact of Security Incidents by 90% or More with ...
D3 Security
 
PKI.pptx
PKI.pptxPKI.pptx
PKI.pptx
Ajit Wadhawan
 
Daniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity storyDaniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity story
Microsoft Österreich
 
Secure the modern Enterprise
Secure the modern EnterpriseSecure the modern Enterprise
Secure the modern Enterprise
Microsoft Österreich
 
Protecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomwareProtecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomware
Cloudera, Inc.
 
Risk Assessment Solutions of H2020 IoT Security/Privacy Cluster Projects
Risk Assessment Solutions of H2020 IoT Security/Privacy Cluster ProjectsRisk Assessment Solutions of H2020 IoT Security/Privacy Cluster Projects
Risk Assessment Solutions of H2020 IoT Security/Privacy Cluster Projects
SecureIoT H2020 funded project
 
Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...
Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...
Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...
Draup3
 
IBM i Security: Identifying the Events That Matter Most
IBM i Security: Identifying the Events That Matter MostIBM i Security: Identifying the Events That Matter Most
IBM i Security: Identifying the Events That Matter Most
Precisely
 
Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...
Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...
Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...
SolarWinds
 
Microsoft Security adoptionguide for the enterprise
Microsoft Security adoptionguide for the enterpriseMicrosoft Security adoptionguide for the enterprise
Microsoft Security adoptionguide for the enterprise
ssuserd58af7
 
Azure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and complianceAzure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and compliance
Asaf Nakash
 
Using m365 defender to protect against solorigate
Using m365 defender to protect against solorigateUsing m365 defender to protect against solorigate
Using m365 defender to protect against solorigate
Matt Soseman
 
QRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdfQRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdf
ssuserf5beb3
 
Cybersecurity Series SEIM Log Analysis
Cybersecurity Series  SEIM Log AnalysisCybersecurity Series  SEIM Log Analysis
Cybersecurity Series SEIM Log Analysis
Jim Kaplan CIA CFE
 
Microsoft Sentinel and Its Components.pptx
Microsoft Sentinel and Its Components.pptxMicrosoft Sentinel and Its Components.pptx
Microsoft Sentinel and Its Components.pptx
Infosectrain3
 
SAM05_Barber PW (7-9-15)
SAM05_Barber PW (7-9-15)SAM05_Barber PW (7-9-15)
SAM05_Barber PW (7-9-15)Norm Barber
 
Planning and implementing. Unveiling the advanced technology of Microsoft Azu...
Planning and implementing. Unveiling the advanced technology of Microsoft Azu...Planning and implementing. Unveiling the advanced technology of Microsoft Azu...
Planning and implementing. Unveiling the advanced technology of Microsoft Azu...
Prometix Pty Ltd
 
Digitalstakeout Scout Overview
Digitalstakeout Scout OverviewDigitalstakeout Scout Overview
Digitalstakeout Scout Overview
DigitalStakeout
 

Similar to Microsoft Sentinel- a cloud native SIEM & SOAR.pdf (20)

SOAR and SIEM.pptx
SOAR and SIEM.pptxSOAR and SIEM.pptx
SOAR and SIEM.pptx
 
How to Reduce the Financial Impact of Security Incidents by 90% or More with ...
How to Reduce the Financial Impact of Security Incidents by 90% or More with ...How to Reduce the Financial Impact of Security Incidents by 90% or More with ...
How to Reduce the Financial Impact of Security Incidents by 90% or More with ...
 
PKI.pptx
PKI.pptxPKI.pptx
PKI.pptx
 
Daniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity storyDaniel Grabski | Microsofts cybersecurity story
Daniel Grabski | Microsofts cybersecurity story
 
cb-EDR-V7_a4_Digital
cb-EDR-V7_a4_Digitalcb-EDR-V7_a4_Digital
cb-EDR-V7_a4_Digital
 
Secure the modern Enterprise
Secure the modern EnterpriseSecure the modern Enterprise
Secure the modern Enterprise
 
Protecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomwareProtecting health and life science organizations from breaches and ransomware
Protecting health and life science organizations from breaches and ransomware
 
Risk Assessment Solutions of H2020 IoT Security/Privacy Cluster Projects
Risk Assessment Solutions of H2020 IoT Security/Privacy Cluster ProjectsRisk Assessment Solutions of H2020 IoT Security/Privacy Cluster Projects
Risk Assessment Solutions of H2020 IoT Security/Privacy Cluster Projects
 
Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...
Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...
Securing the Digital Frontier - An Analysis of Cybersecurity Landscape and Tr...
 
IBM i Security: Identifying the Events That Matter Most
IBM i Security: Identifying the Events That Matter MostIBM i Security: Identifying the Events That Matter Most
IBM i Security: Identifying the Events That Matter Most
 
Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...
Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...
Government and Education Webinar: How to Reduce Vulnerabilities and Harden yo...
 
Microsoft Security adoptionguide for the enterprise
Microsoft Security adoptionguide for the enterpriseMicrosoft Security adoptionguide for the enterprise
Microsoft Security adoptionguide for the enterprise
 
Azure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and complianceAzure Operation Management Suite - security and compliance
Azure Operation Management Suite - security and compliance
 
Using m365 defender to protect against solorigate
Using m365 defender to protect against solorigateUsing m365 defender to protect against solorigate
Using m365 defender to protect against solorigate
 
QRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdfQRadar-XDR-Solution.pdf
QRadar-XDR-Solution.pdf
 
Cybersecurity Series SEIM Log Analysis
Cybersecurity Series  SEIM Log AnalysisCybersecurity Series  SEIM Log Analysis
Cybersecurity Series SEIM Log Analysis
 
Microsoft Sentinel and Its Components.pptx
Microsoft Sentinel and Its Components.pptxMicrosoft Sentinel and Its Components.pptx
Microsoft Sentinel and Its Components.pptx
 
SAM05_Barber PW (7-9-15)
SAM05_Barber PW (7-9-15)SAM05_Barber PW (7-9-15)
SAM05_Barber PW (7-9-15)
 
Planning and implementing. Unveiling the advanced technology of Microsoft Azu...
Planning and implementing. Unveiling the advanced technology of Microsoft Azu...Planning and implementing. Unveiling the advanced technology of Microsoft Azu...
Planning and implementing. Unveiling the advanced technology of Microsoft Azu...
 
Digitalstakeout Scout Overview
Digitalstakeout Scout OverviewDigitalstakeout Scout Overview
Digitalstakeout Scout Overview
 

Recently uploaded

Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
Product School
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
James Anderson
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
Thijs Feryn
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
Elena Simperl
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
Safe Software
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
Guy Korland
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
Alan Dix
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
Elena Simperl
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
Kari Kakkonen
 
Search and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical FuturesSearch and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical Futures
Bhaskar Mitra
 

Recently uploaded (20)

Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
From Daily Decisions to Bottom Line: Connecting Product Work to Revenue by VP...
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdfFIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf
 
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
 
Knowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and backKnowledge engineering: from people to machines and back
Knowledge engineering: from people to machines and back
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
Essentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with ParametersEssentials of Automations: Optimizing FME Workflows with Parameters
Essentials of Automations: Optimizing FME Workflows with Parameters
 
GraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge GraphGraphRAG is All You need? LLM & Knowledge Graph
GraphRAG is All You need? LLM & Knowledge Graph
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
Epistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI supportEpistemic Interaction - tuning interfaces to provide information for AI support
Epistemic Interaction - tuning interfaces to provide information for AI support
 
FIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdfFIDO Alliance Osaka Seminar: Overview.pdf
FIDO Alliance Osaka Seminar: Overview.pdf
 
When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...When stars align: studies in data quality, knowledge graphs, and machine lear...
When stars align: studies in data quality, knowledge graphs, and machine lear...
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
DevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA ConnectDevOps and Testing slides at DASA Connect
DevOps and Testing slides at DASA Connect
 
Search and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical FuturesSearch and Society: Reimagining Information Access for Radical Futures
Search and Society: Reimagining Information Access for Radical Futures
 

Microsoft Sentinel- a cloud native SIEM & SOAR.pdf

  • 1. Microsoft Sentinel - a cloud-native SIEM & SOAR Knowledge Sharing Session By Kranthi Aragonda Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
  • 2. Agenda: • What is SOAR • Important SOAR capabilities • Benefits & Drawbacks • SIEM vs SOAR • Microsoft Sentinel • Data Connectors • Workbooks • Analytics • Security automation & orchestration • Investigation • Hunting • Notebooks • Resources & Certifications. Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
  • 3. What is SOAR Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • SOAR is a stack of compatible software programs that enables an organization to collect data about security threats and respond to security events without human assistance. SOAR platforms have three main components: security orchestration, security automation and security response. • The goal of using a SOAR platform is to improve the efficiency of physical and digital security operations.
  • 4. Important SOAR capabilities Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Security incident response platforms, which include capabilities such as vulnerability management, case management, incident management, workflows, incident knowledge base, auditing and logging capabilities, reporting and more; • Security orchestration and automation, which include integrations, workflow automation, playbooks, playbook management, data gathering, log analysis and account lifecycle management; and • Threat intelligence platforms, which include threat intelligence aggregation, analysis and distribution, alert context enrichment and threat intelligence visualization.
  • 5. Benefits & drawbacks of SOAR tool Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • SOAR is not a replacement for other security tools, but rather is a complementary technology. SOAR platforms are also not a replacement for human analysts, but instead augment their skills and workflows for more effective incident detection and response. • Faster incident detection. • Better threat context. • Simplified management. • Boosting analysts’ productivity. Benefits Drawbacks • failure to remediate a broader security strategy. • conflated expectations. • deployment and management complexity. • lack of or limited metrics.
  • 6. SIEM vs SOAR Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • SIEM systems collect data, identify deviations, rank threats and generate alerts. • SIEM systems only alert security analysts of a potential event SIEM SOAR • SOAR systems also handle these tasks but have additional capabilities. • First, SOAR platforms integrate with a wider range of internal and external applications, both security and non-security. • Second, SOAR platforms use automation, AI and machine learning to provide greater context and automated responses to those threats.
  • 7. Microsoft Sentinel Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Microsoft Sentinel is a scalable, cloud-native, security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for attack detection, threat visibility, proactive hunting, and threat response. • Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds. • Respond to incidents rapidly with built- in orchestration and automation of common tasks. • Detect previously undetected threats and minimize false positives using Microsoft's analytics and unparalleled threat intelligence. • Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.
  • 8. Data Connectors Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Microsoft Sentinel comes with several connectors for Microsoft solutions, available and providing real-time integration, including Microsoft 365 Defender solutions, and Microsoft 365 sources, including Office 365, Azure AD, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps, and more. • In addition, there are built-in connectors to the broader security ecosystem for non-Microsoft solutions. You can also use common event format, Syslog or REST-API to connect your data sources with Microsoft Sentinel as well.
  • 9. Data Connectors Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
  • 10. Workbooks Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • we can monitor the data using the Microsoft Sentinel integration with Azure Monitor Workbooks, which provides versatility in creating custom workbooks.
  • 11. Workbooks Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Microsoft Sentinel Workbooks allow security analysts and admins to view data about security in their environment using graphical displays.
  • 12. Analytics Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved Microsoft Sentinel uses analytics to correlate alerts into incidents. Incidents are groups of related alerts that together create an actionable possible-threat that you can investigate and resolve
  • 13. Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved Analytics • Detect previously undetected threats and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.
  • 14. Security automation & orchestration Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Automation of common tasks and simplify security orchestration with playbooks that integrate with Azure services and existing tools • Playbooks are intended for SOC engineers and analysts of all tiers, to automate and simplify tasks, including data ingestion, enrichment, investigation, and remediation
  • 15. Sample Playbook Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved
  • 16. Investigation Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved Microsoft Sentinel deep investigation tools helps to understand the scope and find the root cause, of a potential security threat. we can choose an entity on the interactive graph to ask interesting questions for a specific entity, and drill down into that entity and its connections to get to the root cause of the threat.
  • 17. Hunting Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Microsoft Sentinel's hunting search-and-query tools, based on the MITRE framework, which enables to proactively hunt for security threats across organization’s data sources, before an alert is triggered. • After discovering which hunting query provides high-value insights into possible attacks, we can create custom detection rules based on your query, and surface those insights as alerts to security incident responders
  • 18. Notebooks Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Microsoft Sentinel notebooks are intended for threat hunters or Tier 2-3 analysts, incident investigators, data scientists, and security researchers. • Notebooks provide queries to both Microsoft Sentinel and external data, features for data enrichment, investigation, visualization, hunting, machine learning, and big data analytics. • Notebooks require a higher learning curve and coding knowledge and have limited automation support.
  • 19. Resources & Certifications Privileged & Confidential |©2022, Network Intelligence. All Rights Reserved • Microsoft Sentinel documentation • SC-900: Microsoft Security, Compliance, and Identity Fundamentals • SC-200: Microsoft Security Operations Analyst • Microsoft Sentinel Ninja: The complete level 400 training
  • 20. N E W Y O R K | D U B A I | M U M B A I | P U N E | D E L H I | B E N G A L U R U | S I N G A P O R E 20 ©2022 Network Intelligence. All Rights Reserved.