do you want to know about what is Microsoft Sentinel.pdf
- 1. Security
- 2. Security Activity Logs – Here you get information on all of the control plane activities. Azure Resource logs – Here you can get insights on the operations performed on the resource itself. Azure Active Directory reports – Here you can get information on the sign-in activity and other aspects when it comes to Azure Active Directory.
- 3. Security Virtual Machines – You can get the logs from the underlying Windows and Linux virtual machines. Azure Storage Analytics – This can provide insights onto the requests made to storage accounts. Network Security Group flow – You can get information about the inbound and outbound flows via the Network Security Groups.
- 4. Microsoft Sentinel T h r e a t p r o t e c t i o n
- 5. This is a cloud service that provides a solution for SEIM ( Security Information Event Management) and SOAR ( Security Orchestration Automated Response) Microsoft Sentinel This provides a solution that helps in the following Collection of data – Here you can collect data across all users, devices, applications and your infrastructure. The infrastructure could be located on-premise and on the cloud. It helps to detect undetected threats.
- 6. It helps to hunt for suspicious activities at scale. Microsoft Sentinel It helps to respond to incident rapidly. Once you start using Microsoft Sentinel, you can start collecting data using a variety of connectors. You have connectors for a variety of Microsoft products and other third-party products as well. You can then use in-built workbooks to get more insights on the collected data.
- 7. Visibility 32K Microsoft Sentinel Microsoft Sentinel Analytics Hunting Incidents Automation Microsoft Sentinel
- 8. Workbooks
- 9. Security Here you can visualize and monitor the data. You can use the in-built workbooks available in Microsoft Sentinel. You can create your own workbooks.
- 10. Sentinel
- 11. 1 3 4 2 In addition to being a SIEM Solution (Security Information and Event Management), its also a SOAR Solution(Security Orchestration, Automation and Response) Microsoft Sentinel Automation c You can use Automation rules that help to centrally manage the automation of how incidents are managed. A playbook is a collection of response and remediation actions. This can be used to orchestrate your threat response. Playbooks make use of Azure Logic Apps as a workflow solution. Security SOAR Solution Rules Playbook Logic Apps
- 12. Vu l n e rab i l i ty
- 13. With Microsoft Defender for Cloud plans, you can deploy a vulnerability assessment solution to your virtual machines. Vulnerability c Vulnerability You can deploy Microsoft Defender for Endpoint which is supported for Azure virtual machines and Azure Arc-enabled machines. This helps to discover vulnerabilities and misconfigurations in real time. Here there is no need of agents or periodic scans.
- 14. With Microsoft Defender for Cloud plans, you can also opt to deploy the Qualys scanner. Vulnerability c Vulnerability Here you don’t need a separate Qualys license or account. This is also supported on Azure virtual machines and Azure Arc-enable servers.
- 15. An extension to the Azure virtual machine will be deployed when you opt to deploy the vulnerability assessment solution. Vulnerability c Vulnerability The scanning begins automatically as soon as the extension is installed successfully when it comes to the Qualys scanner. For the Qualys scanner, the scan is then run every 12 hours.
- 16. Work l oad
- 17. 1 3 4 2 Examines operating system files, Windows registries, application software, Linux system files. File Integrity Monitoring c The Log Analytics agent sends data reporting the state of items on the machine. You can also mention which files and folders to monitor. You can also connect your machines in your AWS cloud environments. Workload Protection Detect changes Change Tracking Files Cloud
- 18. 1 3 4 2 This is an intelligent and automated solution that can be used to define an allow list of known-safe applications. Adaptive Application Controls c This then helps to identify any sort of potential malware, outdated or unauthorized applications. Applications can be segregated into groups if they run the similar types of applications. You can define rules to configure how applications are managed when it comes to Adaptive application controls. Workload Protection Applications Identify Groups Rules
- 19. 1 3 4 2 It helps to harden the Network Security Group rules. Network hardening c It uses internal machine learning algorithms to provide indicators on how to harden the Network Security Groups. Some of the requirements to enable this feature on VM’s – Microsoft Defender for servers, 30 days of traffic data. You get alerts if traffic flowing via the resource is not within the defined IP range. Workload Protection Network Security Groups Identification Requirement Alerts
- 20. Entitlement
- 21. Entitlement Helps to efficiently manage access to groups, applications and SharePoint Online Sites. Here the access can be granted for internal and external users. c Entitlement management
- 22. 1 3 4 2 Membership to an Azure AD Security Group Access Package c Membership to Microsoft 365 Groups and Teams Assignment to Azure AD Enterprise applications Membership to SharePoint Online Sites This is a bundle of all resources which the user would need access to Entitlement management
- 23. 1 3 4 2 Required for members who request for an access package Access Package c Required for members who approve requests for an access package Required for members who review assignments for an access package Required for members who have direct assignment to an access package License requirement – Azure AD Premium P2 licenses Entitlement management
- 24. Identity
- 25. Identity Has the ability to automatically detect and remediate identity-based risks LEARN NOW c Identity Protection Uses its own threat intelligence to understand identity-based risks
- 26. Anonymous IP Address Anonymous IP address – The user is not signing in from a typical IP address Leaked credentials This detects if the users' credentials have been leaked Risks The different risks c User-risk Sign-in risk Sign-in risk Sign-in risk Sign-in risk Sign-in risk Atypical travel Here sign-ins are happening from different geographic locations Malware Here the user’s device could be infected with a malware Password spray Someone is trying out different passwords Unfamiliar sign-in properties Not the typical behavior the user sign ins Identity Protection
- 27. Privileged
- 28. Control and manage access to key resources. Here you can control access to resources in Azure AD, Azure and Microsoft 365. Here you can ensure that a user only gets access when required. 1 2 3 Control Scope Requirement Privileged c Privileged Identity Management
- 29. Timebound Multi-Factor Authentication Approval Just-in-time Here you can provide privileged access to resources whenever they are required Just-in-time You can mention start and end dates for the access. Time-bound Increased level of authentication to activate a role. Multi-Factor Authentication You can ensure approval is required for any role. Approval Privileged Identity Management c Privileged Identity Management
- 30. License You need to have Azure AD Premium P2 licenses LEARN NOW c Privileged Identity Management
- 31. Conditional
- 32. 1 3 4 2 Here you can define conditions based on which you want to give access to users for a resource. Azure AD Conditional Access c You can make use of different signals for the conditions – User and their location, device they are logging from, the Application , real-time risk. Based on the condition you can decide whether the user should be allowed access , blocked access or they require the user of MFA. These rules are enforced after the first-factor authentication is complete. Security Conditions Signals Access Enforced
- 33. Security This feature requires the use of Azure AD Premium P1 license. To make use of Risk-based policies from within Identity Protection, you need to have Azure AD Premium P2 licenses in place.
- 34. Azure
- 35. 1 3 4 2 This provides a business-to- customer identity as a service. Azure Active Directory B2C c Here customers can sign- into applications using their social identities, enterprise , or local account identities. Normally used when business want to authenticate their end users to their web/mobile applications. Uses the standards when it comes to authentication protocols – Open ID Connect, OAuth 2.0. Security Service Sign-in Purpose Standards
- 36. Microsoft
- 37. 1 3 4 2 This is a Cloud Security Posture and Cloud Workload Protection Platform. You can monitor Azure resources, Amazon Web services resources and on-premises resource. Microsoft Defender for Cloud c It continually assesses the security posture of your resources. It generates a secure score based on the assessment. You get recommendations on how to improve the security of your resources. It can also detect and resolve threats to resources and services. Security Purpose Secure Score Recommendations Threats
- 38. Security When it comes to Azure virtual machines, this service will automatically deploy the Log Analytics agent to the virtual machines. The agent will continuously send information the workspace. And then Microsoft Defender for Cloud will analyze the data. For on-premises servers, Microsoft Defender for Cloud will make use of the Azure Arc service. If you have connected your Amazon Web services account to an Azure subscription, you can protect resources in that account as well.
- 39. Security It always good to have a benchmark or baseline to see how the security of your resources align with that benchmark. Microsoft has the Azure Security benchmark that provides the best practices and recommendations for securing workloads. The benchmark covers different domains such as Network security, Identity Management, Data protection. If you have connected your Amazon Web services account to an Azure subscription, you can protect resources in that account as well.
- 40. Security There is the free plan that is enabled for all Azure subscriptions. Here you get the secure score, be able to apply the security policy and get basic recommendations.
- 41. Security And then you have the Enhanced or Paid version. You can use a 30-day free trial. This gives your further protection to your resources. You get Microsoft Defender for Endpoint – This provides endpoint detection and response (EDR). You can carry out vulnerability assessment for virtual machines, SQL resources and container registries. You can protect your resources in Amazon Web Services and Google Cloud Platform.
- 42. Microsoft
- 43. Security Microsoft Defender for servers can help protect your Windows and Linux machines in Azure, AWS, GCP and on- premises. You get two options when it comes to plans. There is Defender for Servers Plan 2 that gives a lot features. Here you get features such as Integrated vulnerability assessments, threat detection etc.
- 44. Security Auto-provisioning feature Here Microsoft Defender for Cloud will automatically install an agent on the Azure virtual machines. The agent will send data to a log analytics workspace. The data collected in the workspace will provide visibility into missing updates, any sort of misconfigured OS security settings, look at the endpoint protection status.
- 45. Regulatory
- 46. 1 3 4 2 Here Microsoft Defender for Cloud will compare the configuration of your resources against industry standards, regulations and benchmarks. Regulatory Compliance c By default, an Azure subscription will have the Azure Security Benchmark assigned. You have other standards available as well. You can make use of the standards but you need to have the Defender for Cloud enhanced security features. You can assign the different standards to the dashboard. Security Compliance Benchmark Standards Dashboard
- 47. M i c r o s o f t D e f e n d e r f o r c o n t a i n e r s
- 48. You have Microsoft Defender for containers. Security This can perform a vulnerability scan of images in Azure Container registry. When a new image is pushed to the registry, a scan will be performed. Also, weekly scans of any images pulled in the last 30 days are also conducted.
- 49. You also get threat protection for your Azure Kubernetes clusters. Security Here the Defender agent performs analysis of Kubernetes audit logs. This can detect activities such as creation of high-privileged roles or the creation of sensitive mounts.
- 50. A z u r e B l u e p r i n t s
- 51. 1 3 4 2 Role assignments – If you need specific roles to be assigned. Azure Blueprints c Azure Blueprints Policy assignments – This is if you need specific policies to be applied. Resource groups – If you need certain resource groups to be in place. Azure Resource Manager templates – If there are resources that need to be deployed.
- 52. Definition – Here you define the Blueprint itself. The Blueprint needs to be saved to either a management group or a subscription. Azure Blueprints When you save the Blueprint to a management group, the Blueprint can be assigned to any subscription which is part of the management group. To save the Blueprint definition, you need to have Contributor access to either the management group or the subscription.
- 53. Publishing – Once the Blueprint is defined, you can publish it. Here you can assign a version number for the Blueprint. Azure Blueprints Assignment – Here the Blueprint is then assigned to a subscription. You can protect resources deployed via the Blueprint resource locks. Here even if there is a user with the Owner role, still the user will not be able to remove the lock. You can only remove the lock by unassigning the blueprint.
- 54. Prote cti n g
- 55. Security Domain Controllers should be protected with Trusted Platform Module chips. The volumes on the domain controller servers need to be protected via BitLocker Drive Encryption. Domain Controllers should allow connections only from authorized users and systems. This can be implemented via the use of Group Policy Objects.
- 56. Security Manage the updates for the domain controllers. Microsoft Defender for Identity can be used to monitor domain controllers. Microsoft Defender for Identity can capture the network traffic , correlate with Windows events and analyze for any threats.
- 57. Microsoft 365
- 58. 1 3 4 2 It helps to protect your endpoints. It can provide an automated response and investigation. Also, has Vulnerability Management. Microsoft 365 Defender c Safeguards against malicious threats when it comes to email messages , links etc. Helps to protect your identities defined in your on-premises Active Directory. Helps to bring visibility and controls onto the usage of other cloud applications. Security Defender for Endpoint Defender for Office 365 Defender for Identity Defender for Cloud Apps
- 59. P r o t e c t i n g d a t a
- 60. Once attackers gain access to your network, they can also get access to your data. Security A hacker would first use an account with elevated privileges to gain access to data. The hacker could then copy data across the network to another location. Or the hacker could simply delete the data.
- 61. Azure SQL Database Security Implement dynamic data masking to limit the exposure of sensitive data. Ensure that database columns that store sensitive data are encrypted. Enable database-level encryption.
- 62. Other data stores Security Azure Virtual Machine Disks – Enable Azure Disk Encryption Azure Storage Accounts – Azure Storage Service Encryption Encryption of data in Azure Cosmos DB
- 63. D a t a M a s k i n g
- 64. Here the data in the database table can be limited in its exposure to non-privileged users. Data Masking You can create a rule that can mask the data. Based on the rule you can decide on the amount of data to expose to the user.
- 65. There are different masking rules Data Masking Credit Card masking rule – This is used to mask the column that contain credit card details. Here only the last four digits of the field are exposed. Email – Here first letter of the email address is exposed. And the domain name of the email address is replaced with XXX.com. Custom text- Here you decide which characters to expose for a field. Random number- Here you can generate a random number for the field.
- 66. A u d i t i n g
- 67. You can enable auditing for an Azure SQL database and also for Azure Synapse Analytics. Auditing This feature can be used to track database events and write them to an audit log. The logs can be stored in an Azure storage account, Log Analytics workspace or Azure Event Hubs. This helps in regulatory compliance. It helps to gain insights on any anomalies when it comes to database activities. Auditing can be enabled at the database or server level. If it is applied at the server level, then it will be applied to all of the databases that reside on the server.
- 68. D a t a c l a s s i f i c a t i o n
- 69. The Azure SQL database and Azure Synapse service have the capabilities of Data Discovery and Classification. Security This service can scan the database and identify columns that contain potentially sensitive data. You can also apply sensitive-classification labels to certain columns.
- 70. A z u r e S Q L D a t a b a s e E n c r y p t i o n
- 71. This feature is used to encrypt the data at rest. Security It carries out the real-time encryption and decryption of the database , its backups and transaction log files. This is enabled by default on all new Azure SQL databases.
- 72. The Always Encrypted Feature can be used to encrypt data at rest and in motion. You can encrypt multiple columns located in different tables. You can encrypt multiple columns located in the same table. You can just encrypt one specific column. Security
- 73. You have 2 types of encryption Deterministic encryption – Here the same encrypted value is generated for any given plain text value. This is less secure. But it allows for point lookups , equality joins, grouping and indexing on encrypted columns. Randomized encryption – This is the most secure encryption method. But it prevents the searching, grouping , indexing and joining on encrypted columns. Security