Azure Day Rome Reloaded 2019 - Azure Sentinel: set up automated threat responses in Azure through Logic Apps
- 1. Azure Sentinel: set up automated threat responses in Azure through Logic Apps
- 2. Thanks to
- 3. AGENDA • Azure Sentinel main features • Respond to incidents rapidly with built-in orchestration and automation • DEMO
- 5. Too many disconnected products 76% report increasing security data* 3.5M unfilled security jobs in 2021 Lack of automation 44% of alerts are never investigated IT deployment & maintenance Sophistication of threats Security operations challenges
- 6. Introducing Azure Sentinel intelligent, cloud-native SIEM Uses AI and automation to improve effectiveness Scales to support your growing digital estate Delivers instant value to your defenders
- 7. End-to-end solution for security operations Analytics DetectCollect Incidents AutomationVisibility Hunting Investigate Respond Powered by community + backed by Microsoft’s security experts
- 8. Visibility
- 9. Collect security data at cloud scale from any source
- 10. Use workbooks to power interactive dashboards Choose from a gallery of workbooks Customize or create your own workbooks using queries Take advantage of rich visualization options Gain insight into one or more data sources
- 11. Analytics
- 12. Leverage analytics to detect threats Choose from more than 100 built-in analytics rules Customize and create your own rules using KQL queries Correlate events with your threat intelligence and now with Microsoft URL intelligence Trigger automated playbooks
- 13. Tap into the power of ML increase your catch rate without increasing noise Use built–in models – no ML experience required Detects anomalies using transferred learning Fuses data sources to detect threats that span the kill chain Simply connect your data and learning begins Bring your own ML models (coming soon)
- 14. Hunting
- 15. Start hunting over security data with fast, flexible queries Run built-in threat hunting queries - no prior query experience required Customize and create your own hunting queries using KQL Integrate hunting and investigations
- 16. Use bookmarks and live stream to manage your hunts Bookmark notable data Start an investigation from a bookmark or add to an existing incident Monitor a live stream of new threat related activity
- 17. Use Jupyter notebooks for advanced hunting Run in the Azure cloud Save as sharable HTML/JSON Query Azure Sentinel data Bring external data sources Use your language of choice - Python, SQL, KQL, R, …
- 18. Incidents
- 19. Start and track investigations from prioritized, actionable security incidents Use incident to collect related alerts, events, and bookmarks Manage assignments and track status Add tags and comments Trigger automated playbooks
- 20. Visualize the entire attack to determine scope and impact Navigate the relationships between related alerts, bookmarks, and entities Expand the scope using exploration queries View a timeline of related alerts, events, and bookmarks Gain deep insights into related entities – users, domains, and more
- 21. Automation
- 22. Automate and orchestrate security operations using integrated Azure Logic Apps Build automated and scalable playbooks that integrate across tools Choose from a library of samples Create your own playbooks using 200+ built-in connectors Trigger a playbook from an alert or incident investigation
- 23. Example playbooks Assign an Incident to an Analyst Open a Ticket (ServiceNow/Jira) Keep Incident Status in Sync Post in a Teams or Slack Channel Lookup Geo for an IP Trigger Defender ATP Investigation Send Validation Email to User Block an IP Address Block User Access Trigger Conditional Access Isolate Machine Incident Management Enrichment+ Investigation Remediation
- 24. Community Hundreds of contributions, including data connectors, workbooks, analytics rules, queries, notebooks, parsers, functions, and playbooks are available on GitHub.
- 25. Take actions today—Get started with Azure Sentinel To learn more, visit https://aka.ms/AzureSentinel Create Azure Sentinel instance Connect data sources Start Microsoft Azure trial
- 28. Thank You!!!
- 29. Thanks to