Tag: kql

Azure
0
AzureTracks.com - Using Threat Intelligence in Analytics Rules with Sentinel - Image shows a robot surrounded by technology and swirls of data.

Integrating Threat Intelligence in Microsoft Sentinel

Join me in exploring the essential topic of integrating Microsoft threat intelligence within Microsoft Sentinel.  In an era where cyber threats are becoming increasingly sophisticated, having a robust strategy to ingest and leverage threat intelligence is crucial for any SOC team.  Understanding how to implement and utilize threat intelligence in Sentinel, you can significantly enhance your security posture, enabling faster detection and mitigation of potential threats before they escalate.

Posted on 6:55 am
Azure
0
AzureTracks.com Microsoft Sentinel Health Check

How to Check the Health State of Microsoft Sentinel

Now that you have it deployed and collecting data, how to you monitor the health state of all the connectors and rules? One of the challenges with Sentinel is that this is often overlooked and data connectors can go days or weeks missing valuable logs without detection. In this post, we look at how to make your data collection more robust and create a way to tell you about broken tooling.

Posted on 7:05 am
Azure
0
Belgian Malinois IT Security Dog

Microsoft Sentinel Governance Deep-Dive Part 2

This week continues our look at an ongoing set of Governance tasks that we can do to keep our Sentinel instances working smoothly and helping our SOC team stay focused on handling Incidents and threat hunting. Today we continue our detailed look at not only what to review, but walking through the steps together. In today’s article we will review even more deep-dive details on how to optimize and maintain your Sentinel instances in a meaningful and optimized fashion. This week, we talk data management, automations, and RBAC.

Posted on 7:10 am
Azure
0
KQL to show records and data size to estimate costs of Sentinel data storage

Cost Management & Microsoft Sentinel

Let’s talk about Microsoft Sentinel and managing costs. With cost being foundational pillar of Microsoft’s Well Architected Framework, part of good governance, and a major driver for product selection of SIEMs; let’s see if we can take some of mystery out of how to get started with managing costs in our favourite SIEM solution!

Posted on 7:35 am
Automation
0
AzureTracks - Microsoft Sentinel Logo

Sentinel & Log Analytics – How to Create Incidents to Test with – Part 2 – The Automation Rule

Today, I’d like to talk about using Microsoft Sentinel and address a common question that many teams have when they are starting to work with the Sentinel SIEM/SOAR solution….Part 2 of How do I create incidents to test with? Today we look at the automation rule and how we can use it trigger our Playbook or other automation that needs to be tested.

Posted on 7:35 am