Building Microsoft Sentinel Usecases with automation using playbooks
Channel: AzureVlog
Date: 05/04/2021

#Microsoft #Sentinel is nothing without good #usecases! In this video I'll demonstrate how you can setup Analytics rules (use cases) and automate response on them by using #playbooks.

▼ In this video:
0:00 - Intro
1:05 - Coffee
2:56 - Introduction in Analytics Rules
4:04 - Alert rules based on other Microsoft security solutions
4:46 - Azure Sentinel Fusion (with Demo)
7:22 - Azure Sentinel Rule Templates (with Demo)
10:25 - Scheduled Rules (Theory)
22:50 - Scheduled Rules (Tips)
25:11 - Scheduled Rules - Demo: Analytics Rule setup
36:46 - Setting up automation rules
40:42 - Triggering the automation rule
41:39 - Check incident that has been generated
43:14 - Outro

▼ Automation rules explained:
https://youtu.be/0BksPVklkb0

▼ Pluralsight course about KQL queries
https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch

▼ Microsoft KQL docs
https://docs.microsoft.com/en-us/azure/data-explorer/kusto/concepts/

▼ My mediun.com page
https://jeroenniesen.medium.com/  

▼ KustoKing
https://www.kustoking.com/ 

▼ Social Jeroen Niesen
Twitter: https://twitter.com/jeroenniesen​​

▼ Social AzureVlog
Twitter: https://twitter.com/AzureVlog