Managing SIEM And SOAR using Azure Sentinel
summary
Claims that Microsoft Azure Sentinel scales by using a Log Analytics workspace to store telemetry and running KQL queries for hunting, with a front‑page Fusion engine that correlates millions of low‑fidelity alerts into manageable cases to cut alert fatigue. Data ingestion uses native, API, agent and CEF connectors (Office 365, AWS, firewalls, endpoints). Alerts can auto‑create incidents (example dashboard shows ~295 alerts and 5 incidents over 14 days) and trigger Logic Apps playbooks for automated response.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 2:31Core security concepts
- 6:44Challenges with traditional tools
- 7:43Introduction to Azure Sentinel
- 10:06Sentinel architecture
- 13:29Data connectors
- 16:38Threat management features
- 23:15Hands-on demonstration
- 48:07Conclusion
related talks
53mAzure Sentinel - Modern Day SIEM tool for SOC !
21mModernize your security operations with Azure Sentinel
33mModernize Your Security Operations With Azure Sentinel
46mUsing Azure Sentinel in service of protecting your systems
48mAzure Sentinel the modern SIEM system
01h 02mAzure Identity and Security
45mLet's talk about: Azure Sentinel
28mWell-Architected Framework: Security