Azure Sentinel.pptx
•Télécharger en tant que PPTX, PDF•
0 j'aime•1,456 vues
Presented at PDC Conference
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Azure Sentinel.pptx
Similaire à Azure Sentinel.pptx (20)
Plus de Mohit Chhabra
Plus de Mohit Chhabra (19)
Dernier
Dernier (20)
Azure Sentinel.pptx
- 1. Secure your Infrastructure with Azure Sentinel Mohit Chhabra Microsoft Azure MVP Configit |Germany https://www.linkedin.com/company/pdcconf @PDCConf https://www.facebook.com/pdcconf
- 2. Thank you to all our generous sponsors Supported by Powered by Organized by Sponsored by
- 3. Mohit Chhabra S Twitter username LinkedIn username Powered By September 16th & 17th Online Event International Conference Speaker
- 4. Security Operations Team Expanding digital estate
- 5. Too many disconnected products High volume of noisy alerts Security skills in short supply Lack of automation Rising infrastructure costs and upfront investment IT deployment & maintenance Sophistication of threats Traditional SOC Challenges
- 6. Cloud + Artificial Intelligence Security Operations Team Azure Sentinel is a cloud-native SIEM
- 7. Introducing Microsoft Azure Sentinel Azure Sentinel Cloud-native SIEM + SOAR (Security Orchestration, Automation and Response) for intelligent security analytics for your entire enterprise Respond Rapidly and automate protection Detect Threats with vast threat intelligence and AI Investigate Collect Security data across your enterprise Critical incidents guided by AI Limitless cloud speed and scale Bring your Office 365 data for Free Easy integration with your existing tools Faster threat protection with AI by your side
- 8. Azure Sentinel – Across Security Center © Microsoft Corporation Azure
- 9. Connectors - https://techcommunity.microsoft.com/t5/Azure-Sentinel/bg-p/AzureSentinelBlog © Microsoft Corporation Azure
- 10. Azure Sentinel – Cloud Native SIEM + SOAR Azure Sentinel is a true cloud native software as a service solution for SIEM+SOAR (Security information and event management + Security orchestration and automated response) with automatic scalability, no server installation, maintenance, or complex configuration. It lets your SecOps team focus on the most important tasks- defending against threats to your organization. Microsoft Azure Sentinel is a PaaS service started with ArcSite with using Azure Data Explorer using LogicApps as it’s built in Automation engine. It uses Azure Log Analytics our log platform, in the background for it’s data.
- 11. Focus on security, unburden SecOps from IT tasks © Microsoft Corporation Azure No infrastructure setup or maintenance SIEM Service available in Azure portal Scale automatically, put no limits to compute or storage resources
- 12. Traditional Reduce security and IT costs- Get a cost effective SIEM No infrastructure costs, Only pay for what you use Bring your Office 365 Data for free Predictable Billing with capacity reservations Flexible model, no annual commitments Sentinel Cloud-native, scalable SIEM Hardware setup Maintenance Software setup
- 13. Integrate with existing tools & data sources
- 14. Collect security data at cloud scale from all sources across your enterprise © Microsoft Corporation Azure Pre-wired integration with Microsoft solutions Connectors for many partner solutions Standard log format support for all sources Proven log platform with more than 10 petabytes of daily ingestion
- 15. Optimize for your needs © Microsoft Corporation Azure Bring your own insights, machine learning models, and threat intelligence Tap into our security community to build on detections, threat intelligence, and response automation. Bring your own ML Models & Threat Intelligence Security Community
- 16. Live Demo © Microsoft Corporation Azure • Mohit Chhabra
- 17. Azure Sentinel – Data Connectors © Microsoft Corporation Azure
- 18. Azure Sentinel – Data Connectors © Microsoft Corporation Azure
- 19. Azure Sentinel – Overview Dashboard © Microsoft Corporation Azure
- 20. Sentinel is back by Log Analytics Workspace © Microsoft Corporation Azure
- 21. Sentinel – News & Guides © Microsoft Corporation Azure
- 22. Sentinel – Threat Management - Incidents © Microsoft Corporation Azure
- 23. Sentinel – Threat Management - Workbooks © Microsoft Corporation Azure
- 24. Sentinel – Threat Management - Hunting © Microsoft Corporation Azure
- 25. Sentinel – Threat Management - Notebooks © Microsoft Corporation Azure
- 26. Sentinel – Configuration – Data Connectors © Microsoft Corporation Azure
- 27. Sentinel – Configuration - Analytics © Microsoft Corporation Azure
- 28. Sentinel – Configuration - Playbooks © Microsoft Corporation Azure
- 29. Sentinel – Configuration - Community © Microsoft Corporation Azure
- 30. Sentinel – Configuration - Settings © Microsoft Corporation Azure
- 31. GitHub © Microsoft Corporation Azure
- 32. AI by your side
- 33. Detect threats and analyze security data quickly with AI © Microsoft Corporation Azure ML models based on decades of Microsoft security experience and learnings Millions of signals filtered to few correlated and prioritized incidents Insights based on vast Microsoft threat intelligence and your own TI Reduce alert fatigue by up to 90% Correlated rules User Entity Behavior Analysis integrated with Microsoft 365 Bring your own ML models Pre-built Machine Learning models Threat Detection and Analysis
- 34. Respond rapidly with built-in orchestration and automation Build automated and scalable playbooks that integrate across tools ! Security Products Ticketing Systems (ServiceNow) Additional tools
- 35. How it works © Microsoft Corporation Azure Microsoft Services Analyze & Detect Investigate & Hunt Automate & Orchestrate Response Visibility Data Ingestion Data Repository Data Search Enrichment Integrate Collect
- 36. Investigate threats with AI and hunt suspicious activities at scale © Microsoft Corporation Azure Get prioritized alerts and automated expert guidance Visualize the entire attack and its impact Hunt for suspicious activities using pre-built queries and Azure Notebooks
- 37. Threat detection, investigation and response © Microsoft Corporation Azure
- 38. Azure Sentinel Data store Automation User interface Rules Machine learning Search & investigation On Premises Other Clouds & SaaS Apps Customer’s Tenant
- 39. Customer’s Tenant Azure Sentinel (Optional) Collector Proxy Azure Sentinel on-premises collection options: 1. Agent 2. CEF/Syslog 3. WEF 4. Native Collection 5. Logic Apps 6. Direct API + Logstash All methods can be applied to Cloud IaaS. OS events, DNS, Windows FW, DHCP agent agent CEF or Syslog connector Syslog (TLS, TCP, UDP) Branch Office Auto deployed cloud CEF of Syslog connector WEF Connector HTTPS WEC Direct Integration for supported sources
- 40. Basics: Windows Events Linux Syslog Extras: DNS events (DCs) Windows Firewall events IIS events Local files FluentD plug-ins
- 41. • Windows or Linux • Automated install in Azure • Central management • Proxy support • Additional Azure management functions • Well documented
- 42. Syslog/CEF Collection Azure Sentinel Syslog Collector (Dedicated Linux VM)
- 43. Azure Syslog/CEF Collection: Cloud based collector Azure Sentinel Syslog Collector (Dedicated VM)
- 44. On Prem Syslog/CEF Collection: On-prem based collector Azure Sentinel Syslog Collector (Dedicated VM)
- 45. Windows Event Forwarding* Azure Sentinel Syslog Collector (Dedicated Windows VM)
- 46. Thank you!