Это видео недоступно.
Сожалеем об этом.
Get Started with Azure Sentinel
HTML-код
- Опубликовано: 12 авг 2024
- If you’re interested in securing Microsoft 365 or Microsoft Azure, then Azure Sentinel is a core skill that you MUST know. In this short session I’ll walk you through the basic features of Sentinel and provide you with the skills to not only get started but also how Io enhance your skills. So if you’re interested in a career in Security, A Security Incident and event management system SIEM is critical. Through automation, integration and investigation Sentinel knowledge is an absolute must if you want to protect your organisation.
Visit me at www.Andymalone.org
This was so clear and easy to follow, you are a true MVP Andy.
Glad you liked it!
I love the optimism of "MAY" incur additional charges. LOL.
I`m planning to deploy Sentinel in my organization and your tutorial was a great starting point. Thank you.
You’re very welcome and thank you 😊
You are an awesome trainer Andy !! Thank you for the session !!
Such an Amazing video, this feature is one of most interesting that we can find in Microsoft services, I was waiting for you to talk about it
Another great video. Doing my AZ-500 next week, and your videos are of great help.
Good luck!
Great content as usual , Andy. Appreciate the effort!
Thanks Joshua, I appreciate that 😊
The best resources and the best channel for Microsoft learning!!! Thanks Andy.. Keep going..
Thanks, will do!
Best explanation, Sir! 🙏
Well Spoken on the subject and easy to follow
Thanks, well explained
Love and appreciate your energy! Thank you for the informative video, it's really helping me in my SOC internship :)
That’s awesome, and good luck 👍
What a great video - Cheers Andy!
Thank you! Cheers!
GREAT video as always!
A note on pricing: Azure Sentinel requires a separate Azure subscription, but it is indeed worth the investment! Microsoft offers a free 30 day trial to allow users to familiarise with the capabilities.
Well said, and thanks for your input. Really useful. 😊 👍
Thanks Andy, great content and explanation as always
No worries!
Friday learning :) Thank you. Wish you wonderful weekend :)
Thank you! You too!
Love your content man, thank you.
My pleasure!
Thanks Andy!!!!
No worries!
Thank you Andy Sir :)
You are very welcome
Awesome to learn from this video starts right from the way you convey things... Post this, I subscribed immediately and looking for all your videos.....Thank you for sharing... And maybe you could showcase on Azure sentinel right from prerequisites, implementations & best practices also if possible
I've done sessions on Sentinel. Check out my Defender playlist.
Superior training skills based on the very solid experience..
Thank you, Andy. I have to do some documentation about integrating Sentinel with our product. It was a bit of a black hole to me.
excellent
Grazie Big
thanks again sir
Always welcome
Can you please teach how logs can be force-pulled from the log analytics on Sentinel using Query?
Hello Sir and Many thanks for your Channel... I Wonder if you can make a video about EASM New feature (External Attack Surface Management). It is an evolution of the XDR ? Best regards.
I’ll add it to my list. Thanks for the suggestion.
Thanks for making a wonderful videos, 1 query defender for endpoint or sentinel which has a more scope??
They are different products, but they compliment each other perfectly. However, I would have to say that sentinel has a greater scope.
This was a great video. Thank you.
I have managed NOCs for many years. Can MS Sentinel be considered a NOC monitoring also, not just for security? I ask because you are literally collecting logs from almost any system, which would include system failures. These failures could be pre programed against priority levels which could be projected on a event monitoring dashboard. So I find Sentinel is not just a security event and incident monitoring machine. It's for everything. Would this be correct understanding?
Thank you again. Your material is awesome mate! I am from UK also :)
Yes, Sentinel is far more than just a simple monitoring system. It has intelligent systems built on AI and machine learning technologies which perform detailed and complex behavioural analytics to look for any potential anomalies. As I said in the video it’s considered next generation security. For more documentation I would read learning.microsoft.com. Yeah you’ll find all the documentation. Thanks again and all the best Andy 😊
You may want to rename this video. The brand Azure Sentinel has not been used since before Covid. Also, this is a tip on Microsoft branding: if the name starts with Windows or Azure, it means that the product only works on that platform. When the product is named Microsoft, or renamed to Microsoft [Name], like in the case of Microsoft Sentinel, it means that the product is either multi-platform or multi-cloud. When Sentinel started supporting AWS, it was renamed to Microsoft Sentinel.
Hehe well spotted.
Hey Andy, great video.
Does it make sense to connect all the Microsoft services like iot hub, aks clusters, etc to the sentinel platform? I ask because all the services are managed by Microsoft and isn't it senseless to monitor them? Or are there specific use cases from the mittre attack database, that you would say it is a must to activate sentinel.
Thank you in advance
I love Sentinel. But beware of over monitoring. It can be very expensive. I agree with your IoT Comment though.
Yes, the idea is to monitor everything from Microsoft Sentinel (including the AWS and GCP components that it supports). However, the first cardinal rule is to make sure that you are only ingesting the alerts/logs that you absolutely need. Pricing is based on ingestion, so the more you ingest, the more you pay. There are price discounts based on committed consumption ("I will consume at least 5GB per month"), but even with this you want to limit ingestion to only what you need. Many Sentinel connectors, and its Codeless Connector Platorm, as well as AMA, now support DCRs (data collection rules) which allow you to filter data pre-ingestion, allowing you to better control your price.
@@pjchacon Great tips, and I totally agree with you on price!
Hi Andy - a question for you - what is the difference between defender and sentinel? does Sentinel proactively monitor your entire estate for threats, whereas defender scans for specific viruses etc? thanks!
Microsoft defender for endpoint of the defence tools that manage the policies and detect potential threats. Sentinel is a monitoring system but also can combine with something called soar. Security operations automated response so if anomalies are detected, they can be auto mediated. Sentinel siem system, or security, incident and event management, which basically collate logs and looks for anomalies. Typically defender and sentinel work together to provide you an important cock in the wheel in the Microsoft zero trust model
Is Sentinel able to take signals from other Azure services like Monitor, Insights to raise an incident? Perhaps like what AWS offers via its Systems Manager Incident Manager.
Absolutley 100%
Thanks for the video Andy. How would you differentiate Azure Sentinel to cloud app security broker (CASB) ?
A casb connects to your environment for the purpose of monitoring apps and users and has a level of intelligence to look for anomalies. Sentinel collates logs and all the other defender services to look for anomalies in logs. E.g. deletions etc. I can see your confusion though, they do have some similarities 😊
Microsoft Sentinel is Microsoft's SIEM and SOAR solution. Microsoft CASB solution is Microsoft Defender for Apps, which is part of Microsoft 365 Defender.
Andy, which of your videos can I utilize in assisting me to pass my SC-200 ? ... I know Sentinel is a mjor part of the exam.. thanks sir
None in particular, but if you look at the security videos, in particular, all of the defender videos, they are included in the exam
@@AndyMaloneMVP Thank you kindly
Hi Andy, is there anyway I can get that sample data to import into sentinel and play with it, Please
I had demo data that I believe you can generate a sample either in Sentinel, Defender for endpoint of on Microsoft Learn.
what license do you need to use the sentinel platform? I have the E5 license, but it's still saying subscription is not enabled.
E5 plus additional costs. but you can take advantage of an E5 benefit. 5Mb data per day.
@@AndyMaloneMVP thanks
Which certification exam we have to write for Azure Sentinel ?
SC-200
Positive attitude, thanks for this. Have a Nice Day. Greeting from Finland
Thank you very much, greetings from scotland also 😊
Hey andy i am new in sentinel and don't know how to protect my VM with malware using sentinel. can you help on this this?
For this, she would need to install defender for endpoint client available in settings in the security centre. Then simply configure policies. For more information check out docs.microsoft.com
How to use Microsoft sentinel in multiple tenant?
Here you go learn.microsoft.com/en-us/azure/sentinel/multiple-tenants-service-providers
Where can I get these courses with certificates online? I see so much just and scam sites out there pitching certification then you search them and it’s all bad news. I’m in a remote location and I need to do as much as I can online. I have a lab for this stuff and internet.
My best advice is go to learn.microsoft.com and docs.microsoft.com these are the definitive sites for learning and certification. You can take the entire course here and even book exams online. You can also take a proctored exam online, all in your dressing gown and slippers if you like :-D
@@AndyMaloneMVP haha! Yea I was checking out one of your videos that showed the courses. I’m gonna knock out the AWS Architect first then move on to MS courses and VMWare. My apparel business is on the Discovery Channel but it’s still just a hobby and small business so I want to expand my IT skills
@@dirtyminerapparel that’s a good plug🙈🤣😂
@@AndyMaloneMVP sorry. Not trying to plug anything. I am actually in IT full time.
I just left NetApp after 10 years in Field Services. They are moving HQ out of the US and we shut down 18 buildings on Crossman and moved to the end of Santana Row. It’s been a crazy ride ever since McKenzie came in to break up the business. I made it through 12 layoffs so that’s good I guess.
@@dirtyminerapparel it’s awesome and I take my hat off to you for your business flair, and I wish you every success.
Can you please tell me how to get notification when a new incident generated??
Create an automation to send you an email
@@AndyMaloneMVP yes but I want beep sound when unassigned incident occurs
No idea sorry other than a txt message or email
@@AndyMaloneMVP it's ok, thanks for your reply
You say several times in the video that SIEM is Security "Incident" and Event Management, but the definition according to Gartner, IBM and others is Security "Information" & Event Management. Is that intentional?
I stand by my definition :-) According to Microsoft
@@AndyMaloneMVPWhy do you keep deleting my post? I'm only trying to help and I like your content. If someone new to cybersecurity follows your video, and gets asked "What does SIEM mean" in a job interview, they may reply with the wrong answer and fail that question. Why not just own up to your mistake and correct it if you're really trying to help people?
@@icewatermedia I not delete content that may contain offensive language. Beyond that sometimes yt sometimes deletes content which is beyond my control. That said I do appreciate your feedback thanks 👍😊
@@AndyMaloneMVP Thanks for your reply! I think yt may have deleted my comment because I posted a reference link to Microsoft's definition of SIEM.
For the benefit of anyone reading this, there's a mistake in the video for what SIEM means. Several times in the video, SIEM is defined as "Security Event and Incident Management" (which would be SEIM and actually could work if it were correct). However, according to Microsoft and the rest of the cybersecurity industry, SIEM is an acronym that stands for "Security Information and Event Management".
Microsoft's definition can be found by searching Google for "What is SIEM Microsoft".
HA! even the microsoft mvp is using a mac
Absolutley I'm all in Apple. For devices!