>> Learn what Azure Sentinel is and why you should
use it in this episode of Azure Tips and Tricks.
Azure Sentinel helps you to detect, alert on,
investigate, and resolve security incidents quickly.
Let's take a look at what it is and how to use it.
Here in the Azure portal,
we can get to Azure Sentinel by searching for it here. Here it is.
Before we can use it,
we need to add it to an Azure Log Analytics Workspace.
I don't have one yet, so let's create a Workspace. All right.
First, I'll give the workspace
a name and I'll select an existing resource group.
I'll also change the location of the workspace.
All right. That's it.
The workspace is being
created and now I need to add Azure Sentinel.
There it goes, and here it is.
This is Azure Sentinel.
It can collect data from many sources and
analyze that for security incidents and threats.
It provides tools to investigate the data,
create alerts, and mitigate security threats.
Let's get started by connecting a data source.
There are many data sources to connect to out of the box.
Microsoft data sources and for
party ones like Amazon Web Services.
Let's connect our Active Directory.
Okay. Let's do it.
Connecting it is really simple,
I just need to click these buttons and it is done. Cool, right?
So now as Azure Sentinel has access
to data from Azure Active Directory.
After a while, you'll see that there are
more events here and maybe some incidents,
although there aren't any yet for my subscription.
I can visualize the data in dashboards.
Here, I can choose out of many pre-built dashboards,
like this Azure Active Directory Audit Logs dashboard.
Let's install that and let's take a look at it.
This shows all sorts of interesting graphs but
my Azure Active Directory activity. Pretty cool.
You can use tools like dashboards to
gain more insights into your security data.
Azure Sentinel provides more tools to
analyze data and identify security incidents.
You can hunt for them with queries like these,
or you can use Azure notebooks to
mangle the data and identify threats.
You can also set up alerts for certain events and incidents.
This helps you to act quickly if something happens,
and you can automate your mitigation response with playbooks.
Playbooks are Azure Logic Apps that contain a workflow to do
something based on security information. Let's create one.
This is the same as creating a regular Logic App.
I'll give it a name and I'll select this resource group.
Okay. Right. Let's create it.
There it is. Just like a regular Logic App,
I can start from scratch or from a template.
Let's try this one.
This will send an e-mail when there is
a new recommendation in Azure Security Center. Here we go.
I'm already connected to Office 365.
So that's good. Let's create a Security Center assessment.
Okay. Continue. The only thing that
I need to configure is the step that sends an e-mail.
I can leave all the fields as they are
and just type an e-mail address here.
This is the address that e-mails will be sent to.
Okay. Let's save the Logic App.
That is how simple it is to create a playbook for Azure Sentinel.
Application and infrastructure security
is extremely important to get right.
Azure Sentinel provides a threat detection and mitigation service,
it helps you to detect incidents and threats when they happen,
and helps you to solve them as effectively as possible.
Go and check it out.