Protect Office 365 with Azure Sentinel
Download as PPTX, PDF0 likes138 views
This document discusses protecting Office 365 environments with Azure Sentinel. It begins with an agenda and introductions of the presenters. It then covers challenges with monitoring Microsoft 365 environments, how to connect Office 365 logs to Azure Sentinel for monitoring and threat detection. Analytics and workbooks in Azure Sentinel are demonstrated for analyzing the Office 365 data. Playbooks and automation rules in Azure Sentinel are shown for responding to threats. References are provided and there is a Q&A section.
Protect Office 365 with Azure Sentinel
- 1. 11 May, 2021 Protect Office 365 with Azure Sentinel Nanddeep Nachan @NanddeepNachan Smita Nachan @SmitaNachan
- 2. AGENDA Challenges with Microsoft 365 environment monitoring Monitor Office 365 Logs from Azure Sentinel Threat detection with Azure Sentinel analytics Respond to Threats Q&A
- 3. Office 365 Consultant Speaker | Author | Blogger Nanddeep Nachan Pune, India Twitter Handle: @NanddeepNachan LinkedIn: /in/NanddeepNachan Microsoft MVP, MCT SharePoint, Microsoft 365, MS Azure
- 4. Pune, India Twitter Handle: @SmitaNachan LinkedIn: /in/SmitaNachan Microsoft MVP, MCT SharePoint, Microsoft 365 Lead Software Engineer @TietoEVRY Speaker | Author Smita Nachan
- 5. Challenges with Microsoft 365 environment monitoring
- 6. With the increase in usage, it is essential to keep track of user activities Potential security risk with admin activities Audit logs in the compliance center Monitoring Microsoft 365 environments
- 7. Demo Audit log in the compliance center
- 8. License Retention period Office 365 E5 or Microsoft 365 E5 1 Year (non-E5) Office 365 or Microsoft 365 90 Days O365 Audit logs retention
- 9. Auditing & Historical purpose Compliance Legal Why we need O365 logs?
- 10. Azure Sentinel Cloud-native SIEM platform
- 11. Security Information and Event Manager (SIEM) Security Orchestration Automated Response (SOAR) Azure Sentinel Overview Image reference: https://docs.microsoft.com/azure/sentinel/overview
- 12. Demo Set up Azure Sentinel
- 13. Connect Office 365 logs to Azure Sentinel O365 Audit Logs User / Admin Activities O365 Data Connector Azure Sentinel Log Analytics Workspace Office 365
- 14. Read and write permissions on your Azure Sentinel workspace. Global administrator or security administrator rights on Office 365 tenant. Office 365 deployment must be on the same tenant as your Azure Sentinel workspace. Prerequisites
- 15. Demo Connect Office 365 logs to Azure Sentinel
- 17. Monitor data using the Azure Sentinel integration with Azure Monitor Workbooks Create custom workbooks across your data Combine data from various data sources and data types Visualize related data in a single interactive report Workbooks
- 20. Detect, investigate, and remediate cyber security threats Analyzes data from various sources to identify correlations and anomalies Trigger alerts based on the attack techniques Get insights of attack Create rule from Rule templates Analytics
- 22. Respond to Threats Use playbooks with automation rules in Azure Sentinel
- 23. Create an automation rule Create a playbook Add actions to a playbook Attach a playbook to an automation rule or an analytics rule to automate threat response Automate your incident response
- 24. Demo Use playbooks with automation rules
- 25. Azure Sentinel https://docs.microsoft.com/en-us/azure/sentinel/overview Monitor Office 365 Logs from Azure Sentinel https://nanddeepnachanblogs.com/posts/2021-03-14-monitor-o365-logs-azure-sentinel/ Threat detection with Azure Sentinel analytics https://nanddeepnachanblogs.com/posts/2021-04-15-threat-detection-with-azure-sentinel-analytics/ Log analytics samples (KQL queries) by Brian T. Jackett https://github.com/BrianTJackett/log-analytics-samples References
- 26. Q&A
Editor's Notes
- #11: https://docs.microsoft.com/en-us/azure/sentinel/overview
- #17: https://docs.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview
- #23: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook