Ever wonder what Azure Sentinel's all about?
Does it keep watch on your organization?
Will it protect you?
I'm gonna show you all about it.
Tell you what it is, why you need it,
and most importantly, how you can deploy it.
Coming up now.
Hello, my name is Adam Gordon,
edutainer here at ITPROTV, back with another exciting
‘What is Azure?’ episode in our serial,
as we continue to look at all of the cool
and exciting features and services
that Microsoft Azure provides.
Today, we're gonna take a look at
‘What is Azure Sentinel?’
This is a really interesting, new,
and innovative approach to being able to use
what we traditionally refer to as a SEM,
SIEM, and/or SIM solution.
I'll define those acronyms for you as we get started
talking about the Azure Sentinel solution.
We're gonna take on those three questions we always ask.
What is Azure Sentinel?
Why do you want to be able to use it?
And equally importantly,
how do we actually deploy this thing,
and make it work for you?
Let's begin by talking a little bit
about what Azure Sentinel actually is.
What it allows you to do as an organization
using the Azure platform.
When you think about security, threat, risk,
all the bad things that potentially can occur in our organization.
These days, our organizational members
are typically gonna be spread out across the cloud,
probably a hybrid solution where we have some
on-premises as well as cloud-integrated services
ala the Azure platform.
Any and all those areas are subject
to attack continuously by all sorts of bad people
that want to come and take things away from us.
Our ability to collect, to be able to detect,
to be able to investigate, and to respond
to those threats, those incidents, those risks,
is really what's at the heart of Azure Sentinel.
When we think about what Azure Sentinel is,
we really want to identify the fact that it provides for us,
truly at scale, a cloud-based SEM solution,
SEM or SIEM, as I suggested.
Let's define those terms a little bit.
When we think about SIM,
one of the things that goes into making
the Azure Sentinel solution so powerful for us,
we think about security, information, and management.
When we talk about SEM,
we think about security, event, management.
When we combine these two together,
we get what we call SIEM,
at least that's how most people pronounce it anyway.
And this is security, information, event, management.
Really just adding these two together.
What this provides for us is the ability
to take information from all sorts of different places,
on-premises, in the cloud, anywhere we can imagine
a device or a system being that's going to generate logs,
information that we want to be aware of
and pay attention as security professionals,
as threat management professionals,
as risk management professionals.
We want to understand what's going on with these systems,
we want to be able to tell compelling stories
about things that are happening that the organization
needs to pay attention to.
As a result of that, we take all that information,
gather it up, and through collection, detection,
investigation, we can then ultimately respond.
We want to think about this life-cycle associated
with the Azure Sentinel product as being a flow,
as being something that takes place in a linear fashion.
Really starting with the idea of understanding
what information is available to us,
how we can then look at and assess all the different systems
where that information may live.
We can then investigate, when we see evidence
of things that may or may not be,
not only unusual but typically problematic for us.
Finally, we can drive response associated
with that investigation, leading us, potentially,
back to engage in more collection.
Now, this life cycle is something
that we'll talk more about as we move to our second question,
which is why would Azure Sentinel
be so important for an organization?
To consider deploying?
It is complicated technology,
it scales across our organization,
bringing the ability to generate and understand
information and event management at scale,
to allow us to integrate those two and have a life cycle
associated with activity management around that.
Why would this be so important?
It's important because of each of the elements
of the life cycle we were just discussing.
When we talk about collect,
I mentioned that we can reach out and get information
from a variety of different systems, end-points,
devices, servers, mobile platforms, as well as our on-premises,
cloud-based infrastructure; not just our cloud-based
infrastructure in Azure, but multi-cloud infrastructure.
Most of our businesses today are using
more than one cloud platform.
We actually can reach out and,
through what we call connectors,
integrate those cloud platforms
and pull information in using Azure Sentinel.
A true cloud SIEM solution at scale,
available globally, that allows us to collect from anywhere,
and understand the information we're bringing in.
We can detect millions of different events
that are taking place across that landscape at
or near real-time using artificial intelligence,
machine learning, and the advanced analytics capabilities
that these technologies bring to bear for us,
integrating not just the ability to collect and detect,
but then when we take that information to investigate it...
Again, across that operational landscape,
using not only artificial intelligence,
not only machine learning
but the combined understanding
and information assessment capabilities
that Microsoft's platform globally has access to
through aggregation of threat intelligence.
Not just from our systems,
but every customer system globally that Microsoft services.
We're gonna get the benefit, in other words,
of all of that information Microsoft looks at every day,
brought to bear, to make sense of our world
and tell us how to understand our systems,
and when there is an issue,
understand what we have to do in order
to potentially address that issue, mitigate it,
and hopefully minimize its impact.
We can do this using,
not only industry-standard technology
but industry-standard log capabilities.
So, syslog and all of the other standard solutions
we would think of, are fed into this platform,
scaling it massively, allowing us to integrate
existing systems and cloud-native systems
into one holistic solution.
So, when we think of what it is,
and why we want to use it, it's really all
about bringing everything we want to see together,
and by the way, let's try to minimize
those false positives as part of this, eliminating
and really filtering out the issues
that are traditionally gonna cause us to chase them,
when in fact, they may not be all that important.
The artificial intelligence
and machine learning capabilities,
and the threat assessment capabilities at scale,
help us to filter out those red flags that are not truly red,
and really focus on the ones that may be a mystery to us,
but that we do have to go and chase.
We're gonna go take a look
at how we can actually implement this solution
and a little overview of what it looks like to set it up,
but in order to do that, we're gonna go over
to our demo environment and tackle our last question.
How do we actually deploy Azure Sentinel?
All right everybody, let's take a look
at how we actually get Azure Sentinel deployed,
up and running, and ultimately configured.
Believe it or not, it's very straightforward
to set up the background services
that are required to run Azure Sentinel.
The hard work is about actually configuring Azure Sentinel,
connecting it out to all those sources of data
that we're potentially gonna want to monitor.
Let's take a look at how we get started.
We're in the Azure portal,
what I'm gonna do is zoom in,
I'm on the all services area here.
This is where we go to actually search.
As you can see, I've begun to do on the right.
All services.
I started typing in the word Azure,
and you'll see a bunch of stuff with the name Azure pops up.
About 4 or 5 items down, right below Azure OSS,
right above Azure Workbooks, Azure Sentinel is there.
I'm gonna go ahead and select that, and when we do,
we get to an area that says Azure Sentinel workspaces.
Let's just zoom in so you can see that really nicely.
Normally that would be blank,
there would not be something called iptv1 there
that's in a resource group called itpsentinel
in the east US number 2 data center location
under the ITPDemo1 subscription.
All of that has been created by me.
What I've done is I've added
an Azure Sentinel workspace by using the add button,
gone through a quick wizard,
really just asking me those things I just called out.
What's the resource group?
What's the location?
What's the subscription?
And, what's the pricing model that we want to use?
There's only one option initially,
which is pay-as-you-go, you set that up.
The workspace is really gonna be
where we're gonna gather all the logs,
the information being brought in
from all those end-point systems.
Those devices that are racked
and stacked in our data center on-premises,
those cloud-centric devices, those servers
and appliances that are running in the Azure fabric.
Or perhaps, as we said in a multi-cloud environment,
running an AWS, running over in the GCP,
the Google Cloud Platform, or even over in VMWare's
and Dell's clouds, or Oracle's clouds.
It doesn't matter where it is,
we're gonna be able to bring all that in
once we configure Azure Sentinel
with what we call out connectors.
But the workspace is what we're gonna gather
all those logs and actually store them.
So, I've set that up already.
What we're gonna do now is just click
through into that workspace, binding it,
so we can begin to see what's going on with it.
We see our Azure Sentinel area right here,
we're just kind of following our,
what we call breadcrumb trail, to see how we're navigating.
What we see as we zoom in,
is that we have a bunch of menu areas, general,
some overview information, right now nothing there.
We're not bringing anything in yet.
We've got logs, we can see that.
We've got a news and guides area,
we're gonna go there because that's where
we get a prompt to get started by configuring
some of the information connectors
and areas that we need to set up
to get Azure Sentinel working.
We have those capabilities
down below here as well, by the way.
When we move down the menu to configuration,
we can go in individually.
Look at settings, set up our data connectors,
our pipes that connect us out to these other sources
we want to see and collect information from.
Our analytics capabilities and our playbooks
that are gone help us to run analysis on this information.
But, for you, probably the easiest way to get started
is to go up here in the general to news and guides.
And under what's new you can see information
about the latest things associated with Sentinel,
so it's always good to check, depending on how often
you use the product, especially when you're getting used to it.
Microsoft's always adding new things.
For instance, there's an announcement here
about a Teams Connector that's been made available,
and Event Grouping, and things of that nature
that are new and may allow you to access new functionality.
Always good to be aware of that.
We want to go to get started.
This is for us if we're beginning to use this product.
A step-by-step guide, it's gonna help us
to understand what to do, where to go to do that,
relatively easy workflow, most importantly,
how to make sure we're successful.
Getting everybody talking and connecting everything
that we want to see information from,
so we understand how to get the value
out of the Azure Sentinel platform.
So, reminding you that Azure Sentinel
is that cloud-native SEM solution.
SIEM, SEM, SIM, however you choose to pronounce it.
As we talked about on the lightboard, ultimately,
it's the combination of security, event, management,
brought together at scale, and allowing us to bring
that information under a microscope for analysis.
We're gone begin by collecting data.
We connect out and use those connectors
across the enterprise, both on-premises
and in multiple clouds as we suggested.
We then go in from there and we create security alerts.
Scoping and tailoring, focusing our efforts
once we start to bring in large volumes of data
to really filter and say, ‘These things.
These activities from these systems in these areas.
They're important to me, to my organization.
I want to be told when these things are happening.
I also don't want to be distracted by things
that are going on that are not important to me.’
So, the creating of security alerts raises
those capabilities of the platform to focus them
specifically on occurrences of events that are likely
to prove important to us that we want to be notified about.
Then finally, we can automate, and we can orchestrate,
and we have the ability, using our custom
or built-in playbooks.
Again, we can create our own
or use Microsoft's own that are there initially.
The playbook is a list of activities we want executed
and the order we want them executed.
Automating common tasks so we can take the alert,
we can run with it, we can respond,
we can change settings, we can do a variety of things.
Whatever those things are.
Now, setting all this up is a little bit
beyond the scope of our conversation,
and our ability here in this particular discussion,
in this episode of ‘What is Azure?’, to really go in-depth.
But you can certainly join me over at ITPROTV
where we're gonna spend a lot of time
talking about Azure Sentinel.
Actually go through how to set the whole thing up,
create your own playbook, set up your own alerts.
We walk through it end-to-end for you.
I encourage you to come take a look
and walk through that journey with me.
But until we are able to do that
and/or until I come back with another exciting
‘What is Azure?’ episode in our serial,
I'm gonna wish you happy Azuring and I'll see you soon.