Book Image

Microsoft Sentinel in Action - Second Edition

By : Richard Diver, Gary Bushey, John Perkins
Book Image

Microsoft Sentinel in Action - Second Edition

By: Richard Diver, Gary Bushey, John Perkins

Overview of this book

Microsoft Sentinel is a security information and event management (SIEM) tool developed by Microsoft that helps you integrate cloud security and artificial intelligence (AI). This book will teach you how to implement Microsoft Sentinel and understand how it can help detect security incidents in your environment with integrated AI, threat analysis, and built-in and community-driven logic. The first part of this book will introduce you to Microsoft Sentinel and Log Analytics, then move on to understanding data collection and management, as well as how to create effective Microsoft Sentinel queries to detect anomalous behaviors and activity patterns. The next part will focus on useful features, such as entity behavior analytics and Microsoft Sentinel playbooks, along with exploring the new bi-directional connector for ServiceNow. In the next part, you’ll be learning how to develop solutions that automate responses needed to handle security incidents and find out more about the latest developments in security, techniques to enhance your cloud security architecture, and explore how you can contribute to the security community. By the end of this book, you’ll have learned how to implement Microsoft Sentinel to fit your needs and protect your environment from cyber threats and other security issues.
Table of Contents (23 chapters)
1
Section 1: Design and Implementation
4
Section 2: Data Connectors, Management, and Queries
9
Section 3: Security Threat Hunting
15
Section 4: Integration and Automation
18
Section 5: Operational Guidance

Creating a workspace using the portal

This section will describe how to create the Log Analytics workspace using the Azure portal. This is a graphical representation of the PowerShell and CLI commands discussed later and, as such, may be the easiest way to start working with workspaces:

  1. In the Azure portal, enter Log Analytics workspaces in the search bar at the top of the screen. This will show a list of services that are related to the search term entered. Locate and click on the Log Analytics workspaces link.
  2. Click the Add button to create a new workspace:

    Figure 2.2 – Creating a new Log Analytics workspace

  3. Enter the required values in the new blade:

    A. Enter the name for the workspace.

    B. Select a Subscription where this will reside.

    C. Choose the Resource group for this workspace.

    D. Select the Location where this workspace will reside.

    E. For the Pricing tier option, Per GB (2018) will automatically be selected.

    The blade will look something like this:

    Figure 2...