Microsoft Sentinel SOAR
Microsoft Sentinel is a cloud-native SIEM and SOAR solution. It utilizes the power of Microsoft Azure to scale SIEM/SOAR demands, even for the biggest customers. Microsoft Sentinel collects data from various systems such as first-party Microsoft solutions, Syslog, Common Event Forwarding (CEF), and Application Programming Interfaces (APIs). All the data collected is stored in a Microsoft Azure solution called Log Analytics Workspace (LAW). Microsoft Sentinel is enabled on top of LAW and is directly connected to it via a relationship – Microsoft Sentinel can be connected to only one LAW, and vice versa.
Microsoft Sentinel utilizes incidents and alerts for detection. Incidents are the primary investigation mechanism, while alerts can be seen as evidence that some incident has happened. One incident can contain between 1 and 150 alerts. The detection mechanisms in Microsoft Sentinel are as follows:
- Scheduled analytic rules: These are written...