Hey, what's up Cloud Gurus?
Welcome back to another episode of Azure Service Spotlight.
I'm Brian Roehm and today we'll be taking a look at another Azure service to
discover what it's all about. In this episode,
we'll be exploring Azure Sentinel.
The definition of a Sentinel is a soldier whose job it is to stand and keep
watch. And if you're like me, when you hear the word sentinel,
your mind immediately goes to futuristic robots with cool lasers that shoot from
their eyes, on guard to defend humanity. Well, I have some bad news.
Azure Sentinel does not involve lasers. Yet. However,
I also have some good news.
Sentinel is very much like a futuristic robot that always stands on guard to
keep your company's data safe. And how does it do this? Well,
in security speak Sentinel is a SIM? A SEM?
Swimmy, Swammi, Samsonite! That's it. No,
Sentinel is actually a SIEM, S I E M,
which means security information and event management solution.
A good security plan involves collecting information about the environment,
detecting anomalies or abnormalities, investigating those abnormalities,
like any good detective, and then responding appropriately.
If you do those four things, you have a solid security plan in place,
at least at the 50,000 foot view. Now, Sentinel does all of these things.
It collects information from sources inside Azure, other cloud providers,
which is multi-cloud, on-prem and hybrid solutions.
Sentinel can also collect information at scale from users and user devices,
making it a truly enterprise solution.
One of the biggest challenges security operations teams face is not a lack of
data, it's actually too much data.
SecOps teams are often buried under a mountain of alerts and have difficulty
prioritizing real critical events.
This can lead to team burnout and missed critical events,
causing vulnerabilities and breaches.
Sentinel can be used to solve these issues.
A good real-world example of this is LinkedIn.
They've leveraged Sentinel to solve some of these very issues.
They configured Sentinel's over 150 custom detections from 80 different sources
across their technology stack. Because of this integration,
they were able to drastically reduce investigation time and improve
effectiveness and response times. They recently stated that with Azure Sentinel,
we have significantly reduced operation overhead so we can spend more time
building other infrastructure to keep LinkedIn safe.
We've been able to redirect a lot of resources to vital things like threat
detection and incident response.
Sentinel helps correct prioritization issues by combining artificial
intelligence and traditional collect and analyze systems to help evaluate
real threats and eliminate that noise.
This allows organizations to maintain and scale more easily without putting
additional stress on overworked SecOps teams. In fact,
there are reports suggesting that organizations have seen a 90% drop in alert
fatigue by SecOp teams. Better news still,
Sentinel leverages all of these new tools without requiring a data scientist on
board to decipher the settings. Now, of course, if you want to,
you can bring your own machine learning to the platform by editing algorithms or
by creating your own machine learning models.
Once you've discovered an anomaly and evaluated it using Sentinel's
intelligence, scanning, and analysis,
you can respond using built-in orchestration and automation tools called
playbooks. And there's a host of predefined playbooks,
or of course you can create your own custom one to suit your organization's
needs. The real question though, is what does it cost?
Using pay-as-you-go pricing,
current billing runs $2 and 46 cents US dollars per gigabyte of
analyzed data. You will also need a Log Analytics workspace as well.
So make sure that you evaluate the cost of that and your expected throughput.
Now,
you can get a jump on this by leveraging a free 30 day trial to see how well
this fits in your organization. Of course,
as with almost every Azure service,
you can reserve capacity and save 50 to 60% based upon the amount reserved.
So now that you know a little bit about the benefits of Sentinel,
let's take a minute to see it in action.
So we've talked about Azure Sentinel,
but now it's time to actually take a look and see how it functions.
I've opened up a brand new Azure Sentinel instance in the Azure portal.
So I want to start off with this graphic here at the beginning,
which is what pops up when you open up Azure Sentinel for the first time.
Basically there's three main components of Azure Sentinel. The first,
collecting data,
we are going to connect different data sources like we talked about just a
minute ago. Once we've done that, we're going to create security alerts.
So in the middle of that step,
Azure Sentinel is going to be going and applying its machine learning to
determine anomalies. Once an anomaly happens,
it will go off of our pre-built security alerts to figure out what it should do,
and then the last step automate and orchestrate.
So this is where those playbooks come in. And remember,
playbooks are just automation rules that help us to triage the incidents,
the things that happen in Azure Sentinel. Once we've triaged those incidents,
playbooks are going to be run using Azure logic apps.
And basically we can create a set of steps that it's going to run through
in the case of a trigger or an alert. Before we do that, though,
let's jump over and actually just connect a data source so you can see how easy
it is to do. So once we open up the connect section,
you can see that we have all sorts of different connectors that we can choose
from. For this case, I'm simply just going to choose something easy,
such as an Azure SQL database here. So let's just pick that.
We'll scroll down to the bottom and you can see,
we don't have anything at this point, open connector page.
The cool thing about Azure Sentinel,
it tells you exactly what you need to do to configure everything.
So once you complete those things,
you'll have your setup connected.
Now through the magic of video editing,
I have completed everything we need to do rather than make you watch it.
I went ahead and did that on my own,
but the cool thing is it actually only takes about three to four minutes in
order to actually finish all of those settings. Once you've done that,
we can just scoot back a step,
scroll up to the top and you'll see that we now have one connected service.
Even better, when we go into overview,
we'll start to see data coming into the system.
Going back into my Get Started, security alerts is the next step.
Simply click on create. And you can see there's already one created for us.
Want to create something beyond that? No problem.
Simply click on the create button and you can see that we can work with queries
or we can use our incident creation rule. Basically we give it a name.
We talk about specific alerts that we're interested in,
and then we create some automation rules of what's going to happen once we've
done that. Again, if we go into the query,
we can create rule logic and we can decide exactly how we want
this rule to be configured. So pretty self-explanatory,
usually drag and drop for most of the creation process.
You can get a little bit more creative and complicated if you want to,
but you don't have to. Finally,
the very last thing is coming back in and looking at
our automation and orchestration. Again, this uses Azure Logic Apps,
and I can create those playbooks by simply just coming down to my
automation section,
and I can begin to configure permissions and create playbooks.
When I click on that,
it's going to have me log in and then it's going to take me to Logic Apps
Designer. Again, through the magic of video editing, we're there.
When we're in Logic Apps Designer, there's all kinds of things that you can do.
There's prebuilt templates that I can choose from,
or you can come in and create custom logic apps to do something very specific
for your business. So with Azure Sentinel,
it takes a few minutes to get up and running.
Super easy to configure and get going. Again,
you can be as detailed as you want to be,
or you can jump in and just use some of the prebuilt alerts, pre-built rules,
pre-built playbooks to create some basic systems
and a basic alerts. Again,
all leveraging the amazing ability that Azure has created with machine learning
to help to pull back and give us true positives,
not false positives.
After seeing that you should be impressed.
You should be impressed at the ease of setup and the slick interface.
I know I was. So there's really only one question left. Should you invest,
evaluate or revisit?
Honestly,
this service is a little different than a lot of those that I've evaluated.
Normally I do a list of pros and cons, but to be honest,
I found it very hard to find cons for this service.
The only case that I could really see for not implementing Sentinel would be in
a training or a dev environment with little to no risk,
and little to no risk of data loss. In every other scenario,
I would highly recommend implementing Azure Sentinel.
The only note that I would add to that statement would be in deciding which
services to pull data from. As outlined earlier,
you were charged per gigabyte of data analyzed. So if cost is a factor,
I would recommend evaluating the risk of data breach in terms of likelihood and
criticality.
Once you have that list down and you can prioritize which services are analyzed
based upon the risk and the amount of data to be analyzed. Now,
if you aren't sure, or you don't want to take the time to figure all that out,
you just leverage the free month to see what the costs are. Just remember,
that's 30 days. So don't forget to adjust the flow. So to summarize,
just invest. There's almost no reason not to.
And the odds are that if you have even a medium data footprint size,
you'll save money in chasing down false negatives.
Your security operations team will thank you for it.
That's it for this Azure Service Spotlight. Till next time, stay awesome gurus.