Section 5: Operational Guidance
by Richard Diver, Gary Bushey, John Perkins
Microsoft Sentinel in Action - Second Edition
- Microsoft Sentinel in Action
- Contributors
- About the authors
- About the reviewers
- Preface
- Section 1: Design and Implementation
- Chapter 1: Getting Started with Microsoft Sentinel
- The current cloud security landscape
- The cloud security reference framework
- SOC platform components
- Mapping the SOC architecture
- Log management and data sources
- Operations platforms
- Threat intelligence and threat hunting
- SOC mapping summary
- Security solution integrations
- Cloud platform integrations
- Integrating with Amazon Web Services (AWS)
- Integrating with Google Cloud Platform (GCP)
- Integrating with Microsoft Azure
- Private infrastructure integrations
- Service pricing for Microsoft Sentinel
- Scenario mapping
- Step 1 – defining the new scenarios
- Step 2 – explaining the purpose
- Step 3 – the kill chain stage
- Step 4 – which solution will perform detection?
- Step 5 – what actions will occur instantly?
- Step 6 – severity and output
- Step 7 – what action should the analyst take?
- Summary
- Questions
- Further reading
- Chapter 2: Azure Monitor – Introduction to Log Analytics
- Technical requirements
- Introduction to Azure Monitor Log Analytics
- Planning a workspace
- Creating a workspace using the portal
- Creating a workspace using PowerShell or the CLI
- Creating an Azure Resource Management template
- Using PowerShell
- Using the CLI
- Exploring the Overview page
- Managing permissions for the workspace
- Enabling Microsoft Sentinel
- Exploring the Microsoft Sentinel Overview page
- The header bar
- The summary bar
- The Events and alerts over time section
- The Recent incidents section
- The Data source anomalies section
- The Potential malicious events section
- The Democratize ML for your SecOps section
- Connecting your first data source
- Obtaining information from Azure virtual machines
- Advanced settings for Log Analytics
- Agents management
- The Agents configuration options
- Computer Groups
- Summary
- Questions
- Further reading
- Section 2: Data Connectors, Management, and Queries
- Chapter 3: Managing and Collecting Data
- Choosing data that matters
- Understanding connectors
- Native connections – service to service
- Direct connections – service to service
- API connections
- Agent-based
- Configuring Microsoft Sentinel connectors
- Configuring Log Analytics storage options
- Calculating the cost of data ingestion and retention
- Reviewing alternative storage options
- Summary
- Questions
- Further reading
- Chapter 4: Integrating Threat Intelligence with Microsoft Sentinel
- Introduction to TI
- Understanding STIX and TAXII
- Choosing the right intel feeds for your needs
- Implementing TI connectors
- Enabling the data connector
- Registering an app in Azure AD
- Configuring the MineMeld TI feed
- Confirming the data is being ingested for use by Microsoft Sentinel
- Summary
- Questions
- Further reading
- Chapter 5: Using the Kusto Query Language (KQL)
- Chapter 6: Microsoft Sentinel Logs and Writing Queries
- An introduction to the Microsoft Sentinel Logs page
- Navigating through the Logs page
- The page header
- The Tables pane
- The Queries pane
- The Functions pane
- The Filter pane
- The KQL code window
- Running a query
- The Results window
- Learn more
- Writing a query
- The billable data ingested
- Map view of logins
- Other useful tables
- Summary
- Questions
- Further reading
- Section 3: Security Threat Hunting
- Chapter 7: Creating Analytic Rules
- Chapter 8: Creating and Using Workbooks
- An overview of the Workbooks page
- The workbook header
- The Templates view
- Workbook detail view
- Missing required data types
- Saved template buttons
- Walking through an existing workbook
- Creating workbooks
- Creating a workbook using a template
- Creating a new workbook from scratch
- Editing a workbook
- Advanced editing
- Managing workbooks
- Workbook step types
- Text
- Query
- Metric
- Parameters
- Links/tabs
- Groups
- Advanced Settings
- Style
- Summary
- Questions
- Further reading
- Chapter 9: Incident Management
- Using the Microsoft Sentinel Incidents page
- The header bar
- The summary bar
- The search and filtering section
- Incident listing
- Incident details pane
- Using the Actions button
- Exploring the full details page
- The Timeline tab
- The Alerts tab
- The Bookmarks tab
- The Entities tab
- The Comments tab
- Investigating an incident
- Showing related alerts
- The Timeline button
- The Info button
- The Entities button
- The Insights button
- The Help button
- Summary
- Questions
- Further reading
- Chapter 10: Configuring and Using Entity Behavior
- Introduction to Microsoft Sentinel Entity behavior
- Enabling Entity behavior
- Overview of the Entity behavior page
- The header bar
- The search section
- Entities with alerts
- Overview of the Entity behavior details page
- Identifying information
- Notable events
- Insights
- Creating Entity behavior queries
- Header bar
- Activities list
- Activity details pane
- Adding a new activity
- Summary
- Questions
- Further reading
- Chapter 11: Threat Hunting in Microsoft Sentinel
- Introducing the Microsoft Sentinel Hunting page
- The header bar
- The summary bar
- The hunting queries list
- Hunting query details pane
- Working with Microsoft Sentinel hunting queries
- Adding a new query
- Editing a query
- Cloning a query
- Deleting a query
- Adding to Livestream
- Creating an analytics rule
- Working with livestream
- Working with bookmarks
- Creating a bookmark
- Viewing bookmarks
- Associating a bookmark with an incident
- Using Microsoft Sentinel notebooks
- The header bar
- The summary bar
- The notebook list
- The notebook details pane
- Creating a workspace
- Performing a hunt
- Developing a premise
- Determining data
- Planning a hunt
- Executing an investigation
- Responding
- Monitoring
- Improving
- Summary
- Questions
- Further reading
- Section 4: Integration and Automation
- Chapter 12: Creating Playbooks and Automation
- Introduction to Microsoft Sentinel playbooks
- Introduction to Microsoft Sentinel Automation
- The header bar
- The summary bar
- Automation rules listing
- Adding a new automation rule
- Playbook pricing
- Types of playbooks
- Overview of the Microsoft Sentinel connector
- Exploring the Playbooks tab
- Logic app listing
- Logic app settings page
- The menu bar
- The header bar
- The essentials section
- The Runs history section
- Creating a new playbook
- Using the Logic Apps Designer page
- The Logic Apps Designer header bar
- The Logic Apps Designer workflow editor section
- Creating a simple Microsoft Sentinel playbook
- Summary
- Questions
- Further reading
- Chapter 13: ServiceNow Integration for Alert and Case Management
- A brief history of Microsoft Sentinel and ServiceNow integration
- Integrating Microsoft Sentinel with ServiceNow ITSM using Microsoft Sentinel Logic Apps
- Integrating Azure security alert sources (not just Sentinel) with ServiceNow Security Incident Response via the Microsoft Graph Security API
- Integrating Microsoft Sentinel with ServiceNow Security Incident Response via an API directly to Microsoft Sentinel
- Steps to integrate Microsoft Sentinel with ServiceNow
- Configuring the Microsoft Azure portal
- Installing the Microsoft Sentinel integration plugin in ServiceNow
- Configuring the ServiceNow Sentinel plugin to authenticate to Microsoft Sentinel
- Creating profiles in the ServiceNow Sentinel integration plugin
- Summary
- Section 5: Operational Guidance
- Chapter 14: Operational Tasks for Microsoft Sentinel
- Chapter 15: Constant Learning and Community Contribution
- Official resources from Microsoft
- Official documentation
- Tech community – blogs
- Tech community – forums
- Feature requests
- LinkedIn groups
- Other resources
- Resources for SOC operations
- MITRE ATT&CK® framework
- National Institute of Standards for Technology (NIST)
- Using GitHub
- GitHub for Microsoft Sentinel
- GitHub for community contribution
- Specific components and supporting technologies
- Kusto Query Language
- Jupyter Notebook
- Machine learning with Fusion
- Azure Logic Apps
- Summary
- Assessments
- Other Books You May Enjoy
Section 5: Operational Guidance
In this section, you will learn how to ensure the system remains in peak operational efficiency and keep up to date with solution improvements.
This section contains the following chapters:
- Chapter 14, Operational Tasks for Microsoft Sentinel
- Chapter 15, Constant Learning and Community Contribution
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.