Category: Microsoft Sentinel

Microsoft Entra ID Security Features and Best Practices

As organizations continue their cloud transformation journey, securing identities and access management is more critical than ever. Microsoft Entra ID provides powerful tools for authentication, access control, and monitoring to safeguard cloud resources. This post covers the core capabilities of…

Continue Reading Microsoft Entra ID Security Features and Best Practices

Exploring Microsoft Azure’s Security Technical Capabilities

Why security is important? In today’s digital landscape, securing cloud environments is more critical than ever. Microsoft Azure provides a comprehensive set of security capabilities designed to help organizations protect their workloads, data, and identities. From identity management to threat…

Continue Reading Exploring Microsoft Azure’s Security Technical Capabilities

Unify SIEM and XDR for Enhanced Threat Detection

Now when you open Defender portal (https://security.microsoft.com) you will see the above displayed, this feature is now in Public preview and let’s how the process works. Defender XDR and Sentinel: Working Together This table summarizes the key functionalities and considerations…

Continue Reading Unify SIEM and XDR for Enhanced Threat Detection

Section 15 – Hunt for threats using Microsoft Sentinel

Create custom hunting queries Like stated in the last part, all Gallery content has been Centralized to Content hub. You will see the following notification under Custom hunting rules. https://learn.microsoft.com/en-us/azure/sentinel/sentinel-content-centralize If you need inspiration based on MITRE Framework for your…

Continue Reading Section 15 – Hunt for threats using Microsoft Sentinel

Section 14 – Use Microsoft Sentinel workbooks to analyze and interpret data

Activate and customize Microsoft Sentinel workbook templates When we are talking about templates, it’s important to see the following information, you will see this inside your Sentinel workspace. Once you Click on Continue, it will start the migration and show…

Continue Reading Section 14 – Use Microsoft Sentinel workbooks to analyze and interpret data

Section 13 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel incidents

Triage incidents in Microsoft Sentinel What is Triaging? The SOC’s initial level is triaging. Triaging incoming security situations and assessing their seriousness are the responsibilities of Tier 1 employees. This entails figuring out the incident’s origin, estimating its size, and…

Continue Reading Section 13 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel incidents

Section 13 – Mitigate threats using Microsoft Sentinel – Configure Security Orchestration, Automation, and Response (SOAR)

13th section starting and this time were are learning on automation, alerts and remediation. Configure automation rules By centrally managing automation rules for event management, users may streamline complicated incident orchestration procedures. Automation rules are triggered by the creation of…

Continue Reading Section 13 – Mitigate threats using Microsoft Sentinel – Configure Security Orchestration, Automation, and Response (SOAR)

Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization

12th section starting with more Sentinel. This time we are classifying Entities, creating custom log in Log Analytics and parsing the content. So let’s do some designs and configurations. Classify and analyze data by using entities You can do the…

Continue Reading Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization

Section 11 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel analytics rules

11th section starting with more and more Sentinel. Already in this series we saw that how the different pieces are connected and helping you SOC teams to proactively work on threats. So let’s do some designs and configurations. Design and…

Continue Reading Section 11 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel analytics rules