This document discusses protecting Office 365 environments with Azure Sentinel. It begins with an agenda and introductions of the presenters. It then covers challenges with monitoring Microsoft 365 environments, how to connect Office 365 logs to Azure Sentinel for monitoring and threat detection. Analytics and workbooks in Azure Sentinel are demonstrated for analyzing the Office 365 data. Playbooks and automation rules in Azure Sentinel are shown for responding to threats. References are provided and there is a Q&A section.

1. 11 May, 2021
Protect Office 365 with Azure Sentinel
Nanddeep Nachan
@NanddeepNachan
Smita Nachan
@SmitaNachan

2. AGENDA
 Challenges with Microsoft 365 environment monitoring
 Monitor Office 365 Logs from Azure Sentinel
 Threat detection with Azure Sentinel analytics
 Respond to Threats
 Q&A

3. Office 365 Consultant
Speaker | Author | Blogger
Nanddeep Nachan
 Pune, India
 Twitter Handle: @NanddeepNachan
 LinkedIn: /in/NanddeepNachan
 Microsoft MVP, MCT
 SharePoint, Microsoft 365, MS Azure

4.  Pune, India
 Twitter Handle: @SmitaNachan
 LinkedIn: /in/SmitaNachan
 Microsoft MVP, MCT
 SharePoint, Microsoft 365
Lead Software Engineer @TietoEVRY
Speaker | Author
Smita Nachan

5. Challenges with Microsoft 365
environment monitoring

6.  With the increase in usage, it is essential to keep track of user activities
 Potential security risk with admin activities
 Audit logs in the compliance center
Monitoring Microsoft 365 environments

7. Demo
Audit log in the compliance center

8. License Retention period
Office 365 E5 or Microsoft 365 E5 1 Year
(non-E5) Office 365 or Microsoft 365 90 Days
O365 Audit logs retention

9.  Auditing & Historical purpose
 Compliance
 Legal
Why we need O365 logs?

10. Azure Sentinel
Cloud-native SIEM platform

11.  Security Information and Event Manager (SIEM)
 Security Orchestration Automated Response (SOAR)
Azure Sentinel Overview
Image reference: https://docs.microsoft.com/azure/sentinel/overview

12. Demo
Set up Azure Sentinel

13. Connect Office 365 logs to Azure Sentinel
O365 Audit
Logs
User / Admin
Activities
O365 Data
Connector
Azure Sentinel
Log Analytics
Workspace
Office 365

14.  Read and write permissions on your Azure Sentinel workspace.
 Global administrator or security administrator rights on Office 365 tenant.
 Office 365 deployment must be on the same tenant as your Azure Sentinel workspace.
Prerequisites

15. Demo
Connect Office 365 logs to Azure Sentinel

16. Workbooks
Monitor the data

17.  Monitor data using the Azure Sentinel integration with Azure Monitor Workbooks
 Create custom workbooks across your data
 Combine data from various data sources and data types
 Visualize related data in a single interactive report
Workbooks

18. Demo
Azure Sentinel Workbooks

19. Analytics
Monitor the data

20.  Detect, investigate, and remediate cyber security threats
 Analyzes data from various sources to identify correlations and anomalies
 Trigger alerts based on the attack techniques
 Get insights of attack
 Create rule from Rule templates
Analytics

21. Demo
Create Analytics Rule

22. Respond to Threats
Use playbooks with automation rules in Azure Sentinel

23.  Create an automation rule
 Create a playbook
 Add actions to a playbook
 Attach a playbook to an automation rule or an analytics rule to automate threat response
Automate your incident response

24. Demo
Use playbooks with automation rules

25.  Azure Sentinel
 https://docs.microsoft.com/en-us/azure/sentinel/overview
 Monitor Office 365 Logs from Azure Sentinel
 https://nanddeepnachanblogs.com/posts/2021-03-14-monitor-o365-logs-azure-sentinel/
 Threat detection with Azure Sentinel analytics
 https://nanddeepnachanblogs.com/posts/2021-04-15-threat-detection-with-azure-sentinel-analytics/
 Log analytics samples (KQL queries) by Brian T. Jackett
 https://github.com/BrianTJackett/log-analytics-samples
References

26. Q&A

27. Thank You!
@NanddeepNachan
/in/NanddeepNachan
Nanddeep Nachan
@SmitaNachan
/in/SmitaNachan
Smita Nachan