Security management on a large scale can benefit from a dedicated security
information and event management.
Or a SIEM system.
A SIEM system aggregate security data from many different sources as long as those
sources support an open standard logging format.
It also provides capabilities for threat detection and response.
Azure sentinel is Microsofts cloud based SIEM system,
it uses intelligence security analytics and threat analysis Azure sentinel
enables you to collect cloud data at scale across all users, devices,
applications and infrastructure both on premises and from multiple clouds.
Detect previously undetected threats while minimizing false positives by using
Microsoft's Comprehensive Analytics and Threat Intelligence.
Investigate threats with artificial intelligence and
examined suspicious activities at scale.
Tapping into years of cybersecurity experience from Microsoft.
Respond to incidents rapidly by utilizing, built in orchestration and
automation of common tasks.
Let's go back to the tailwind traders case study.
In this instance,
Tailwind decides to explore the capabilities of Azure Sentinel.
First, the company identifies and connects its data sources.
Azure Sentinel supports a number of data sources,
which it can analyze for security events.
Thes connections are handled by built in connectors are industry standard log
formats and APIce Connectors provide real time integration for
services like Microsoft Threat Protection Solutions.
Microsoft 365 sources, including office 365 Azure Active Directory and
Windows Defender Firewall connectors are available for
common non Microsoft services and solutions, including AWS Cloud Trail,
Citrix Analytics, Sophos, Extra Firewall, VM Ware, Carbon Black Cloud and Okta SSO.
Azure sentinel supports data from other sources that use the common of informal
messaging standard.
SIS Log Arrest API,
tailwind traders needs to be notified when something suspicious occurs,
it decides to use both built in analytics and custom rules to detect threats.
Built in analytics use templates designed by Microsoft's team of security experts
and analysts.
They're based unknown threats, common attack vectors and
escalation chains for suspicious activity.
Thes templates can be customized and search across the environment for
any activity that looks suspicious.
Some templates use machine learning behavioral analytics that are based on
Microsoft proprietary algorithms.
Custom analytics are rules that you create to search for
specific criteria within your environment.
You can preview the number of results that the query would generate based on past log
events, and set a schedule for the query to run.
You can also set an alert threshold when Azure Sentinel detect suspicious events,
tailwind traders can investigate specific alerts are incidents.
Incidents are a group of related alerts.
This is what an investigation graph looks like in Azure Sentinel.
With the investigation graph, the company can review information from entities
directly connected to the alert and
see common exploration queries to help guide the investigation.
You can also use Azure monitor workbooks to automate responses to threats.
Workbooks can run manually or automatically.
When a rule triggers an alert, For example, it can set an alert that looks
for malicious IP addresses that access the network and
create a workbook that does the following steps.
When the alert is triggered, it opens a ticket in the IT ticketing system.
Then it sends a message to the Security Operations channel.
In Microsoft,
teams are slack to make sure the security analysts are aware of the incident.
Next, it sends all of the information in the alert to the senior network admin and
to the security admin.
The email message includes two user option buttons, block or ignore.
When an admin chooses block the IP address is blocked in the firewall,
and the user is disabled in azure Active directory.
When an admin chooses ignore, the alert is closed in Azure Sentinel, and
the incident is closed in the IT ticketing system,
The workbook continues to run after it receives a response from the admins.