Adam ochs sentinel
- 1. Investigate and Respond to security events in the cloud with Azure Sentinel
- 2. Introducing Microsoft Azure Sentinel Cloud-native SIEM for intelligent security analytics for your entire enterprise Limitless Office 365 + M365 Alerts for Free existing tools AI by your side Respond Rapidly and automate protection Detect Threats with vast threat intelligence & AI Collect Security data across your enterprise Investigate Critical incidents guided by AI Azure Sentinel Cloud-native SIEM+SOAR
- 3. How it works Microsoft Services Analyze & Detect Investigate & Hunt Automate & Orchestrate Response Visibility Data Ingestion Data Repository Data Search Enrichment Azure Monitor Integrate Dashboard Machine learning, Pre-defined Queries, Azure Notebook Playbooks Collect Security solutions Apps, users, infrastructure Public Clouds ServiceNow Community Other tools
- 4. Security Operations Challenges Expanding digital estate
- 5. Too many disconnected products 76% report increasing security data* 3.5M unfilled security jobs in 2021 Lack of automation 44% of alerts are never investigated IT deployment & maintenance Sophistication of threats Security operations challenges
- 6. Introducing Azure Sentinel INTELLIGENT, CLOUD-NATIVE SIEM Delivers instant value to your defenders
- 7. Scales to support your growing digital estate Introducing Azure Sentinel INTELLIGENT, CLOUD-NATIVE SIEM Delivers instant value to your defenders
- 8. Uses AI and automation to improve effectiveness Scales to support your growing digital estate Introducing Azure Sentinel INTELLIGENT, CLOUD-NATIVE SIEM Delivers instant value to your defenders
- 9. Analytics End-to-end solution for security operations DetectCollect Incidents AutomationVisibility Hunting Investigate Respond Powered by community + backed by Microsoft’s security experts
- 10. 10 steps to Modernize your SIEM
- 11. Visibility
- 12. Collect security data at cloud scale from any source1
- 13. Choose from a gallery of workbooks Customize or create your own workbooks using queries Take advantage of rich visualization options Gain insight into one or more data sources Use workbooks to power interactive dashboards2
- 14. New data connectors and workbooks announced at ignite Barracuda CloudGen Firewall Citrix Analytics ExtraHop Reveal(x) F5 Firewall One Identity Safeguard TrendMicro Deep Security Zscaler Internet Access Threat Intelligence TAXII Servers (supporting STIX format)
- 15. Workspace Design (Single Tenant)
- 16. DEMO Linking with O365 (mine is linked… but lets take a look!) And Workbooks!
- 17. All the ways data gets in Workspace Azure Sentinel Custom App Appliances (Integrated) Azure Services (Diagnostic Logs) AAD, AAD IP, Azure Activity, AIP, ASC, AzWAF, … Threat Intelligence (via Graph Security API) MISP, Palo Alto…. Logic App – Send Data Connector Cloud Services w/ Connector O365, MCAS, AATP, MDATP, AWS Windows Agent Linux Agent Linux Agent – Configured for CEF Appliances (CEF) P U S H P U S H P U S H P U L L Rest API P U S H
- 18. Data Collectors (Quick Wins) Enable 1st Party Connectors that are running in the environment Most are free O365 Azure Activity 1st Party Alerts – MCAS, AATP, MDATP, AAD IP Connect AWS Connect / Configure Azure Diagnostic Logs (Policy) Deploy Windows/Linux Agent in Azure (built-in Policy)
- 19. Data Collectors (Next Steps) Deploy Windows/Linux Agent on-prem / other clouds Deploy CEF Collection Configure CEF collector using configuration script Configure source devices – ensure they support RFC and CEF. See the “Grand List” https://techcommunity.microsoft.com/t5/Azure- Sentinel/Azure-Sentinel-The-Syslog-and-CEF-source- configuration-grand/ba-p/803891 Integrate Threat Intelligence Ask vendors to directly integrate!
- 20. CEF architecture On prem Syslog Over UDP, TCP, or TLS default port: 514
- 21. Leverage analytics to detect threats Choose from more than 100 built-in analytics rules Customize and create your own rules using KQL queries Correlate events with your threat intelligence and now with Microsoft URL intelligence Trigger automated playbooks 3
- 22. Analytics You got data… now what? Create Analytics to detect suspicious activity Enable Microsoft Security rules Enable built-in rules Use Github Build custom detections
- 23. Tap into the power of ML increase your catch rate without increasing noise Use built–in models – no ML experience required Detects anomalies using transferred learning Fuses data sources to detect threats that span the kill chain Simply connect your data and learning begins Bring your own ML models (coming soon) 3a
- 24. Start hunting over security data with fast, flexible queries Run built-in threat hunting queries - no prior query experience required Customize and create your own hunting queries using KQL Integrate hunting and investigations 4
- 25. Use bookmarks and live stream to manage your hunts Bookmark notable data Start an investigation from a bookmark or add to an existing incident Monitor a live stream of new threat related activity 5
- 26. Use Jupyter notebooks for advanced hunting Run in the Azure cloud Save as sharable HTML/JSON Query Azure Sentinel data Bring external data sources Use your language of choice - Python, SQL, KQL, R, … 6
- 29. Start and track investigations from prioritized, actionable security incidents Use incident to collect related alerts, events, and bookmarks Manage assignments and track status Add tags and comments Trigger automated playbooks 7
- 30. Visualize the entire attack to determine scope and impact Navigate the relationships between related alerts, bookmarks, and entities Expand the scope using exploration queries View a timeline of related alerts, events, and bookmarks Gain deep insights into related entities – users, domains, and more 8
- 31. Gain deeper insight with built-in automated detonation Configure URL Entities in analytics rules Automatically trigger URL detonation Enrich alerts with Verdicts, Final URLs and Screen Shots (e.g. for phishing sites) 9
- 32. Automate and orchestrate security operations using integrated Azure Logic Apps Build automated and scalable playbooks that integrate across tools Choose from a library of samples Create your own playbooks using 200+ built-in connectors Trigger a playbook from an alert or incident investigation 10
- 33. Example playbooks Assign an Incident to an Analyst Open a Ticket (ServiceNow/Jira) Keep Incident Status in Sync Post in a Teams or Slack Channel Lookup Geo for an IP Trigger Defender ATP Investigation Send Validation Email to User Block an IP Address Block User Access Trigger Conditional Access Isolate Machine Incident Management Enrichment + Investigation Remediation
- 34. Delivered Since Public Preview Coming Soon Additional Data Connectors – More Microsoft Services, Logstash, … New Built-In Detections – Rule-Based and ML Additional Detections Powered by Microsoft Threat Intelligence Bring Your Own ML Models Threat Intelligence Research, Including Full STIX Objects Entity Pages – Users, Domains, IPs And much more… Roadmap Microsoft and 3P Data Connectors – Defender ATP, Cloud App Security, Zscaler, and More 100+ Build-In Detections – Rule-Based and ML Investigation Graph and Entities Workbooks with Improved Data Visualizations Support for Incident Automation Embedded Azure Notebooks Live Stream Monitoring of Notable Events GitHub Integration URL Detonation
- 35. Take actions today—Get started with Azure Sentinel To learn more, visit https://aka.ms/AzureSentinel Create Azure Sentinel instance Connect data sources Start Microsoft Azure trial