Using Microsoft Sentinel to Monitor Microsoft 365 Security

Microsoft Sentinel is a cloud-based security information and event management (SIEM) tool that enables the analysis of vast quantities of data both within Microsoft 365 and from external sources using artificial intelligence. Microsoft Sentinel allows you to gather data and detect potential threats, and then investigate and respond to those threats.

In this chapter, you will learn how to plan and implement Microsoft Sentinel in your organization, understand and configure playbooks, manage and monitor signals across Microsoft 365 and other sources using Microsoft Sentinel, and respond to threats. You will also be able to access and enable Microsoft Sentinel in the Azure portal, set up a Log Analytics workspace, and connect to Microsoft and third-party data sources.

This chapter will cover the following topics:

• Planning and configuring Microsoft Sentinel
• Configuring playbooks in Microsoft Sentinel
• Managing...

Planning and configuring Microsoft Sentinel

The first steps you need to take when planning to use Microsoft Sentinel for your organization are to open Microsoft Sentinel and then connect it to a workspace and thereby to your organization’s data sources. Microsoft Sentinel has several native Microsoft connectors that enable integration with other Microsoft services, such as Azure Active Directory, Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps (MDA). Ingestion from Microsoft connectors is free of charge.

It is also possible to configure Microsoft Sentinel to connect to non-Microsoft services, and use connection methods such as Syslog, REST API, or the Common Event Format (CEF). It is important to note that using non-Microsoft connections will incur ingestion charges. For more information on how to plan for and track your usage costs, use the Sentinel pricing calculator at https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=commitment...

Configuring playbooks in Microsoft Sentinel

In Microsoft Sentinel, playbooks are collections of responses and actions that can be run like a routine. Playbooks automate and orchestrate threat responses and can be integrated with other systems, both internal and external. They can be configured to run manually or automatically in response to specific alerts or incidents. An example of an automated trigger for a playbook is an automation rule.

Automation rules enable users to centrally manage incident automation. This includes the ability to assign playbooks to incidents and automate responses for multiple analytics rules at once. Additionally, you can automatically tag, assign, or close incidents without requiring a playbook. You can also control the order of the actions executed.

Playbooks are based on Azure Logic Apps. Microsoft Sentinel can leverage the following logic app types:

• Consumption: This is the more classic Azure Logic Apps experience
• Standard: This is...

Creating and using automation rules to manage responses

Automation rules in Microsoft Sentinel are used to manage and orchestrate responses to threats. They can be set using triggers and actions, such as when an incident is created. In this case, this would be the trigger, and running a playbook in response would be the action. To create an automation rule, complete the following steps:

1. In Microsoft Sentinel, navigate to Automation | Create | Automation rule. The Create new automation rule panel will open as shown here:

Figure 9.47: Configuring an automation rule

2. Set a name for your rule and select a trigger action based on incident creation, incident update, or alert creation. Add any required conditions (for more information on this, refer to the Further reading section at the end of this chapter), and then select the action you wish to perform when there is a match. The available actions are as follows:
   • Run playbook
   • Change status...

Managing and monitoring your Microsoft Sentinel instance

Managing and monitoring our Microsoft Sentinel instance ensures that we are regularly reviewing and responding to any threats and taking any corrective action that may be required. Some of the methods available to manage and monitor Microsoft Sentinel are as follows:

• Microsoft Sentinel Overview screen: From the Microsoft Sentinel | Overview section, you can review a selection of alerts and metrics, such as recent incidents, events, and alerts over time, as shown in the following screenshot:

Figure 9.48: Microsoft Sentinel Overview screen

Here you can review events, alerts, usage, and metrics.

• Microsoft Sentinel logs: From the Microsoft Sentinel | Logs section, you can choose from a large number of built-in queries under Log Analytics workspaces and see information on things such as Applications and Azure Monitor, as shown in the following screenshot:

...

Summary

This chapter introduced Microsoft Sentinel, which is a cloud-based SIEM tool that allows you to analyze large amounts of data from both Microsoft and third-party sources. We discussed how to enable Microsoft Sentinel and connect it to a new or existing Log Analytics workspace. We also learned how to set up and configure Microsoft Sentinel playbooks, which use triggers and actions to send alerts on a multitude of events.

In the next chapter, we will discuss the principles of MDA. We will learn how to configure MDA, create snapshot Cloud Discovery reports, discover custom cloud apps, and add them to Cloud App Discovery. In addition, we will learn how to use App Connectors to enable visibility and control over the apps we connect to and apply policies to them, and how to interpret and analyze alerts, reports, and dashboards.

Questions

1. True or false? Automation rules can be used in Microsoft Sentinel to trigger a playbook.
   1. True
   2. False
2. Where in the Microsoft Sentinel portal would you configure a log connector?
   1. Configuration | Data Connectors
   2. Configuration | Automation
   3. Configuration | Settings
   4. Threat management | Workbooks
3. What is the first step after enabling Microsoft Sentinel?
   1. Create a playbook
   2. Set up a data connector
   3. Connect to a playbook
   4. Connect to a workspace
4. Which of the following is not a type of playbook that you can use with Microsoft Sentinel?
   1. Playbook with incident trigger
   2. Playbook with PowerShell trigger
   3. Blank playbook
   4. Playbook with alert trigger
5. True or false? Playbook templates are available with Microsoft Sentinel.
   1. True
   2. False
6. Which Microsoft portal must you access to configure Azure Sentinel?
   1. https://portal.office.com
   2. https://portal.azure.com
   3. https://security.microsoft.com
   4. https://compliance.microsoft.com
7. True or false? Microsoft Sentinel does not require a Log Analytics workspace...

Further reading

Please refer to the following links for more information regarding what was covered in this chapter:

• Overview of Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/overview
• Pre-deployment activities: https://learn.microsoft.com/en-us/azure/sentinel/prerequisites
• Plan costs and billing: https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=commitment-tier
• Onboarding Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
• Best practices for Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/best-practices
• Microsoft Sentinel data connectors: https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources
• Creating a Log Analytics workspace: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal
• Investigating incidents with Microsoft Sentinel: https://learn.microsoft.com/en-us/azure/sentinel/investigate-cases
...

The rest of the chapter is locked