Microsoft Sentinel is Microsoft’s cloud-native SIEM solution. It is the first SIEM solution built
into a major public cloud platform. Microsoft Sentinel also contains a security orchestration
and automated response (SOAR) capability. Microsoft Sentinel’s SOAR capability is fully
customizable and allows security teams to write Playbooks that can, if desired, automate the entire response to a security event. For example, once Microsoft Sentinel identifies a malicious domain, a Playbook can be triggered that would automatically add a block rule for that domain to the company’s firewalls.
==>Partner defines a SIEM as technology that supports ==>threat detection and security incident
variety of event and contextual data sources.” Most traditional SIEMs started as on-premises. Solutions composed of hardware and software that supported log ingestion and storage and provided a user interface and search engine to correlate system events and security alerts.
As log ingestion and storage requirements increased, customers needed to buy larger hardware or distribute the workload across multiple servers.
Over the last several years, more and more vendors have retooled their SIEMs to make them available in a Software as a Service, or SaaS, model. However, these SIEMS are typically built on top of a public cloud provider’s infrastructure and don’t offer the same automatic scaling and storage benefits found in Microsoft Sentinel. With Microsoft Sentinel, there are no requirements for the customer to open support tickets to scale out their services like other SaaS-based SIEMs. All of this is handled automatically by Microsoft, and the customer can focus on the main task at hand—identifying and responding to cyberthreats.
Core capabilities
While the purpose of this chapter is not to go into depth in any particular area, it is important that you understand the core capabilities of Microsoft Sentinel. Microsoft Sentinel provides security teams with unprecedented visibility into their digital estate. The core capabilities of the solution include the following:
Data collection and storage across all users, devices, applications, and infrastructure,
whether on-premises or in the cloud
Threat detection leveraging Microsoft’s analytics and threat intelligence
Investigation of threats by hunting for suspicious activities at scale
Rapid response to incidents leveraging built-in orchestration and automation of
common tasks
Now that you have an idea of Microsoft Sentinel’s core capabilities.
