GREAT video as always! A note on pricing: Azure Sentinel requires a separate Azure subscription, but it is indeed worth the investment! Microsoft offers a free 30 day trial to allow users to familiarise with the capabilities.
Awesome to learn from this video starts right from the way you convey things... Post this, I subscribed immediately and looking for all your videos.....Thank you for sharing... And maybe you could showcase on Azure sentinel right from prerequisites, implementations & best practices also if possible
Is Sentinel able to take signals from other Azure services like Monitor, Insights to raise an incident? Perhaps like what AWS offers via its Systems Manager Incident Manager.
Hi Andy - a question for you - what is the difference between defender and sentinel? does Sentinel proactively monitor your entire estate for threats, whereas defender scans for specific viruses etc? thanks!
Microsoft defender for endpoint of the defence tools that manage the policies and detect potential threats. Sentinel is a monitoring system but also can combine with something called soar. Security operations automated response so if anomalies are detected, they can be auto mediated. Sentinel siem system, or security, incident and event management, which basically collate logs and looks for anomalies. Typically defender and sentinel work together to provide you an important cock in the wheel in the Microsoft zero trust model
You say several times in the video that SIEM is Security "Incident" and Event Management, but the definition according to Gartner, IBM and others is Security "Information" & Event Management. Is that intentional?
@@AndyMaloneMVPWhy do you keep deleting my post? I'm only trying to help and I like your content. If someone new to cybersecurity follows your video, and gets asked "What does SIEM mean" in a job interview, they may reply with the wrong answer and fail that question. Why not just own up to your mistake and correct it if you're really trying to help people?
@@icewatermedia I not delete content that may contain offensive language. Beyond that sometimes yt sometimes deletes content which is beyond my control. That said I do appreciate your feedback thanks 👍😊
@@AndyMaloneMVP Thanks for your reply! I think yt may have deleted my comment because I posted a reference link to Microsoft's definition of SIEM. For the benefit of anyone reading this, there's a mistake in the video for what SIEM means. Several times in the video, SIEM is defined as "Security Event and Incident Management" (which would be SEIM and actually could work if it were correct). However, according to Microsoft and the rest of the cybersecurity industry, SIEM is an acronym that stands for "Security Information and Event Management". Microsoft's definition can be found by searching Google for "What is SIEM Microsoft".
Hello Sir and Many thanks for your Channel... I Wonder if you can make a video about EASM New feature (External Attack Surface Management). It is an evolution of the XDR ? Best regards.
For this, she would need to install defender for endpoint client available in settings in the security centre. Then simply configure policies. For more information check out docs.microsoft.com
A casb connects to your environment for the purpose of monitoring apps and users and has a level of intelligence to look for anomalies. Sentinel collates logs and all the other defender services to look for anomalies in logs. E.g. deletions etc. I can see your confusion though, they do have some similarities 😊
Microsoft Sentinel is Microsoft's SIEM and SOAR solution. Microsoft CASB solution is Microsoft Defender for Apps, which is part of Microsoft 365 Defender.
Hey Andy, great video. Does it make sense to connect all the Microsoft services like iot hub, aks clusters, etc to the sentinel platform? I ask because all the services are managed by Microsoft and isn't it senseless to monitor them? Or are there specific use cases from the mittre attack database, that you would say it is a must to activate sentinel. Thank you in advance
Yes, the idea is to monitor everything from Microsoft Sentinel (including the AWS and GCP components that it supports). However, the first cardinal rule is to make sure that you are only ingesting the alerts/logs that you absolutely need. Pricing is based on ingestion, so the more you ingest, the more you pay. There are price discounts based on committed consumption ("I will consume at least 5GB per month"), but even with this you want to limit ingestion to only what you need. Many Sentinel connectors, and its Codeless Connector Platorm, as well as AMA, now support DCRs (data collection rules) which allow you to filter data pre-ingestion, allowing you to better control your price.
This was a great video. Thank you. I have managed NOCs for many years. Can MS Sentinel be considered a NOC monitoring also, not just for security? I ask because you are literally collecting logs from almost any system, which would include system failures. These failures could be pre programed against priority levels which could be projected on a event monitoring dashboard. So I find Sentinel is not just a security event and incident monitoring machine. It's for everything. Would this be correct understanding? Thank you again. Your material is awesome mate! I am from UK also :)
Yes, Sentinel is far more than just a simple monitoring system. It has intelligent systems built on AI and machine learning technologies which perform detailed and complex behavioural analytics to look for any potential anomalies. As I said in the video it’s considered next generation security. For more documentation I would read learning.microsoft.com. Yeah you’ll find all the documentation. Thanks again and all the best Andy 😊
You may want to rename this video. The brand Azure Sentinel has not been used since before Covid. Also, this is a tip on Microsoft branding: if the name starts with Windows or Azure, it means that the product only works on that platform. When the product is named Microsoft, or renamed to Microsoft [Name], like in the case of Microsoft Sentinel, it means that the product is either multi-platform or multi-cloud. When Sentinel started supporting AWS, it was renamed to Microsoft Sentinel.
This was so clear and easy to follow, you are a true MVP Andy.
Glad you liked it!
I`m planning to deploy Sentinel in my organization and your tutorial was a great starting point. Thank you.
You’re very welcome and thank you 😊
You are an awesome trainer Andy !! Thank you for the session !!
Great video. Because of this video, I got a new opportunity in MNC. Thank you so much.
Awesome👍
Such an Amazing video, this feature is one of most interesting that we can find in Microsoft services, I was waiting for you to talk about it
Positive attitude, thanks for this. Have a Nice Day. Greeting from Finland
Thank you very much, greetings from scotland also 😊
The best resources and the best channel for Microsoft learning!!! Thanks Andy.. Keep going..
Thanks, will do!
GREAT video as always!
A note on pricing: Azure Sentinel requires a separate Azure subscription, but it is indeed worth the investment! Microsoft offers a free 30 day trial to allow users to familiarise with the capabilities.
Well said, and thanks for your input. Really useful. 😊 👍
What a great video - Cheers Andy!
Thank you! Cheers!
It was so clear and easy to understand...well explained....Thank you.
Thanks Andy, great content and explanation as always
No worries!
I love the optimism of "MAY" incur additional charges. LOL.
Another great video. Doing my AZ-500 next week, and your videos are of great help.
Good luck!
Great content as usual , Andy. Appreciate the effort!
Thanks Joshua, I appreciate that 😊
Best explanation, Sir! 🙏
Friday learning :) Thank you. Wish you wonderful weekend :)
Thank you! You too!
Awesome to learn from this video starts right from the way you convey things... Post this, I subscribed immediately and looking for all your videos.....Thank you for sharing... And maybe you could showcase on Azure sentinel right from prerequisites, implementations & best practices also if possible
I've done sessions on Sentinel. Check out my Defender playlist.
Can you please teach how logs can be force-pulled from the log analytics on Sentinel using Query?
Subbed! Found this information very useful thanks so much :)
Thank you, Andy. I have to do some documentation about integrating Sentinel with our product. It was a bit of a black hole to me.
Well Spoken on the subject and easy to follow
Thanks, well explained
this was so good thank you
The overview changed a lot, what is the difference or benefits of the new overview ?
An integrated portal Microsoft 365 XDR
Is Sentinel able to take signals from other Azure services like Monitor, Insights to raise an incident? Perhaps like what AWS offers via its Systems Manager Incident Manager.
Absolutley 100%
Hi Andy - a question for you - what is the difference between defender and sentinel? does Sentinel proactively monitor your entire estate for threats, whereas defender scans for specific viruses etc? thanks!
Microsoft defender for endpoint of the defence tools that manage the policies and detect potential threats. Sentinel is a monitoring system but also can combine with something called soar. Security operations automated response so if anomalies are detected, they can be auto mediated. Sentinel siem system, or security, incident and event management, which basically collate logs and looks for anomalies. Typically defender and sentinel work together to provide you an important cock in the wheel in the Microsoft zero trust model
Superior training skills based on the very solid experience..
Hi Andy, why you skipped Analytics section after Data Connector, I came for it :)
Hi Andy, is there anyway I can get that sample data to import into sentinel and play with it, Please
I had demo data that I believe you can generate a sample either in Sentinel, Defender for endpoint of on Microsoft Learn.
what license do you need to use the sentinel platform? I have the E5 license, but it's still saying subscription is not enabled.
E5 plus additional costs. but you can take advantage of an E5 benefit. 5Mb data per day.
@@AndyMaloneMVP thanks
Which certification exam we have to write for Azure Sentinel ?
SC-200
Love your content man, thank you.
My pleasure!
Can you please tell me how to get notification when a new incident generated??
Create an automation to send you an email
@@AndyMaloneMVP yes but I want beep sound when unassigned incident occurs
No idea sorry other than a txt message or email
@@AndyMaloneMVP it's ok, thanks for your reply
How to use Microsoft sentinel in multiple tenant?
Here you go learn.microsoft.com/en-us/azure/sentinel/multiple-tenants-service-providers
Thanks for making a wonderful videos, 1 query defender for endpoint or sentinel which has a more scope??
They are different products, but they compliment each other perfectly. However, I would have to say that sentinel has a greater scope.
You say several times in the video that SIEM is Security "Incident" and Event Management, but the definition according to Gartner, IBM and others is Security "Information" & Event Management. Is that intentional?
I stand by my definition :-) According to Microsoft
@@AndyMaloneMVPWhy do you keep deleting my post? I'm only trying to help and I like your content. If someone new to cybersecurity follows your video, and gets asked "What does SIEM mean" in a job interview, they may reply with the wrong answer and fail that question. Why not just own up to your mistake and correct it if you're really trying to help people?
@@icewatermedia I not delete content that may contain offensive language. Beyond that sometimes yt sometimes deletes content which is beyond my control. That said I do appreciate your feedback thanks 👍😊
@@AndyMaloneMVP Thanks for your reply! I think yt may have deleted my comment because I posted a reference link to Microsoft's definition of SIEM.
For the benefit of anyone reading this, there's a mistake in the video for what SIEM means. Several times in the video, SIEM is defined as "Security Event and Incident Management" (which would be SEIM and actually could work if it were correct). However, according to Microsoft and the rest of the cybersecurity industry, SIEM is an acronym that stands for "Security Information and Event Management".
Microsoft's definition can be found by searching Google for "What is SIEM Microsoft".
Hello Sir and Many thanks for your Channel... I Wonder if you can make a video about EASM New feature (External Attack Surface Management). It is an evolution of the XDR ? Best regards.
I’ll add it to my list. Thanks for the suggestion.
Thanks Andy!!!!
No worries!
Hey andy i am new in sentinel and don't know how to protect my VM with malware using sentinel. can you help on this this?
For this, she would need to install defender for endpoint client available in settings in the security centre. Then simply configure policies. For more information check out docs.microsoft.com
Thanks for the video Andy. How would you differentiate Azure Sentinel to cloud app security broker (CASB) ?
A casb connects to your environment for the purpose of monitoring apps and users and has a level of intelligence to look for anomalies. Sentinel collates logs and all the other defender services to look for anomalies in logs. E.g. deletions etc. I can see your confusion though, they do have some similarities 😊
Microsoft Sentinel is Microsoft's SIEM and SOAR solution. Microsoft CASB solution is Microsoft Defender for Apps, which is part of Microsoft 365 Defender.
Thank you Andy Sir :)
You are very welcome
Hey Andy, great video.
Does it make sense to connect all the Microsoft services like iot hub, aks clusters, etc to the sentinel platform? I ask because all the services are managed by Microsoft and isn't it senseless to monitor them? Or are there specific use cases from the mittre attack database, that you would say it is a must to activate sentinel.
Thank you in advance
I love Sentinel. But beware of over monitoring. It can be very expensive. I agree with your IoT Comment though.
Yes, the idea is to monitor everything from Microsoft Sentinel (including the AWS and GCP components that it supports). However, the first cardinal rule is to make sure that you are only ingesting the alerts/logs that you absolutely need. Pricing is based on ingestion, so the more you ingest, the more you pay. There are price discounts based on committed consumption ("I will consume at least 5GB per month"), but even with this you want to limit ingestion to only what you need. Many Sentinel connectors, and its Codeless Connector Platorm, as well as AMA, now support DCRs (data collection rules) which allow you to filter data pre-ingestion, allowing you to better control your price.
@@pjchacon Great tips, and I totally agree with you on price!
Andy, which of your videos can I utilize in assisting me to pass my SC-200 ? ... I know Sentinel is a mjor part of the exam.. thanks sir
None in particular, but if you look at the security videos, in particular, all of the defender videos, they are included in the exam
@@AndyMaloneMVP Thank you kindly
This was a great video. Thank you.
I have managed NOCs for many years. Can MS Sentinel be considered a NOC monitoring also, not just for security? I ask because you are literally collecting logs from almost any system, which would include system failures. These failures could be pre programed against priority levels which could be projected on a event monitoring dashboard. So I find Sentinel is not just a security event and incident monitoring machine. It's for everything. Would this be correct understanding?
Thank you again. Your material is awesome mate! I am from UK also :)
Yes, Sentinel is far more than just a simple monitoring system. It has intelligent systems built on AI and machine learning technologies which perform detailed and complex behavioural analytics to look for any potential anomalies. As I said in the video it’s considered next generation security. For more documentation I would read learning.microsoft.com. Yeah you’ll find all the documentation. Thanks again and all the best Andy 😊
thanks again sir
Always welcome
Grazie Big
excellent
You may want to rename this video. The brand Azure Sentinel has not been used since before Covid. Also, this is a tip on Microsoft branding: if the name starts with Windows or Azure, it means that the product only works on that platform. When the product is named Microsoft, or renamed to Microsoft [Name], like in the case of Microsoft Sentinel, it means that the product is either multi-platform or multi-cloud. When Sentinel started supporting AWS, it was renamed to Microsoft Sentinel.
Hehe well spotted.
HA! even the microsoft mvp is using a mac
Absolutley I'm all in Apple. For devices!