- Coming up we take a look at Microsoft Azure Sentinel,
our new Cloud native SIEM service
with built-in AI for analytics.
It removes the cost and complexity
of achieving the central and focused near real-time view
of the active threats in your environment.
And just like any other service in Azure,
the service scales automatically to your needs.
Azure Sentinel works by correlating the security logs
and signals from all sources across your apps,
services, infrastructure, networks and users,
whether they reside on-premises in Azure or any other cloud.
Our built in AI leverages Microsoft threat intelligence
that analyzes trillions of signals every day.
And our machine learning models refined through decades
of security experience filter through the noise from alerts,
drilling into it analyzing thousands of anomalous events,
to return a view of threats
that really require your attention.
For example, here in the overview dashboard,
we give you bird's eye perspective
of the events going on in your environment.
You can see how many events were collected,
active cases and their status,
as well as trends across events and cases.
We also leverage built in AI capabilities in Azure,
to detect anomalies in events from different sources.
And by leveraging signals from Microsoft Threat Intelligence
Azure Sentinel identifies attacks based on your data
and places them on a map,
so you can analyze malicious traffic.
To get to Azure Sentinel,
just search for it in the Azure Portal.
One tip here, to store your activity logs,
you'll need to use an existing workspace
or create a new one to get going.
Then to get started,
you'll first need to connect your security sources.
In the data collection page, we have a number of connectors
for Microsoft solutions available out of the box,
including Microsoft Threat Protection Solutions.
And we're working with a broader security eco-system
to create built-in connectors for non Microsoft solutions.
Of course you can use common event format,
SYSLOG or Rest-API,
to connect your data sources with Azure Sentinel as well.
For example, here I want to connect Azure Active Directory.
I can use the connector and in just a few clicks,
I can get sign-in and audit logs directly from Azure AD.
You can additionally choose from a gallery
of expertly created dashboards
that surface insights based on your data.
These dashboards can be easily customized
to your needs as well.
Now Azure Sentinel leverages the proven foundation
of Azure Monitor,
with more than 10 petabytes of log data ingested daily.
As a security analyst, once your data sources are connected
you can start analyzing your data
with a rich query language
that enables you to create advanced and complex queries
in just a few lines.
Let's run a simple query,
to monitor my firewall trends week over week.
Once it returns the results I can easily visualize them
by selecting a chart type.
And now I can see a week over week trend
of my firewall logs.
I can also leverage built-in analytics
and machine learning in Azure, to detect anomalies.
Here I'm analyzing the amount of sign-in logs
in the last 24 hours.
The arrow on the chart points to anomalies
found by the service.
Let's click on it to learn more.
We consider the machine learning algorithm
found a pattern that correlates with the spike we have seen,
and generated a query automatically
to decipher why this point in time
was different compared to normal patterns.
All without me having to write a complex query.
Now another area that you may spend a lot of your time
is in our cases page, which you can see here.
Think of a case as a container filled with alerts
and entities on a specific threat in your organization.
A case is generated by an alert.
And these can come from several sources
such as security solutions
that you have connected to Azure Sentinel,
correlation rules that you may have set up
to detect specific activities,
or anomalies tagged by our machine learning models.
You can also manage the full lifecycle of the case
and its associated alerts.
You can assign cases to an individual
or a group on your team,
with the expertise to investigate these alerts.
You can update the status of the alert,
and you can also change the severity based on your findings.
Next you can use the investigation tool
that helps you understand the scope
and identify the root cause of a potential security threat.
In the graph we can see a user
and a host related to this alert.
Now you can select an entity and ask Azure Sentinel
to analyze the data,
to find additional insights and connections
on the entities extracted from these alerts.
In this example, I will ask Azure Sentinel
to show me all the related alerts to this specific user.
Once it gets the results,
I can see all the connections
between the entities associated with this specific user.
I can also ask Azure Sentinel
to get me all the top-five host
this specific user logged in to in the last 24 hours.
You can see that a graph really helps me
to understand the scope of the attack.
Beyond investigation you can also build
and run security playbooks
to automate security operations against given alert.
Azure Sentinel is natively integrated with the Azure Portal
which allows you to take advantage of built-in services.
Playbooks can be triggered on demand for a given alert
by selecting the Run button,
or you can configure real-time automation
while offering a correlation rule,
by selecting which playbook should run automatically,
when alert is being fired.
Playbooks are simple to create in the logic app designer
and there are no developer skills required.
I've already created one that you can see here
which creates an incident in our ticketing system
which in this case happens to be Service Now.
It will then post a message to the SOC Channel
in Microsoft Teams, generate and send an approval email
that gives an elected person the ability
to decide using interactive buttons
for the appropriate action.
In this case, if the user approves,
the playbook will block the user in Azure AD
and add a rule to my firewall that blocks this malicious IP.
Users are entities you need to monitor closely.
Therefore, Azure Sentinel seamlessly integrates
with Azure Advanced Threat Protection
to analyze a user's behavior
and prioritize which users you should investigate first,
based on their alerts and suspicious activity patterns
from Azure Sentinel and Microsoft 365.
When selecting a user,
you can view a clear efficient and convenient timeline
that surfaces the alerts and activities,
associated with the selected user.
Of course the threat investigation,
doesn't have to be a reactive type of activity.
You can take more proactive measures
to pre-empt threats too.
In our hunting page you can find pre-built queries,
crafted by Microsoft security experts,
to start hunting for new anomalies
and security threats across your organization logs.
Azure Sentinel also integrated Azure Notebooks
which is based on the popular Jupiter notebooks
which allows you to automate common investigative steps
such as gathering additional information
around process creation events.
You can also query Azure Sentinel data
about users, machines, IPs or any other entities
and enrich it with other services to visualize the results.
Finally, you can also use Azure Sentinel community
where you can share and consume content for Azure Sentinel.
Content can be dashboards, detection rules,
hunting queries, Playbooks and much more.
So that was a quick overview of Azure Sentinel,
our new cloud native SIEM service
with built-in AI Analytics
that removes the cost and effort
to achieve a central and focused and near real-time view
of the active threats in your environment.
It's in preview today so try for yourself,
and you can add more in the link shown.
Thanks for watching.
(bright upbeat music)