AzureFunBytes Episode 64 - Building SOC Efficiency with @Azure Sentinel with @rodtrent
Tags: azure, cloud, security, secops
Published: 2022-01-06 18:53:50

AzureFunBytes is a weekly opportunity to learn more about the fundamentals and foundations that make up Azure. It's a chance for me to understand more about what people across the Azure organization do and how they do it. Every week we get together at 11 AM Pacific on [Microsoft LearnTV](https://cda.ms/226) and learn more about Azure.

![AzureFunBytes animation](https://res.cloudinary.com/practicaldev/image/fetch/s--Z7BxBMz1--/c_limit%2Cf_auto%2Cfl_progressive%2Cq_66%2Cw_880/https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j2xzw2g664tj31jij13t.gif)

It's been a few weeks but AzureFunBytes is back with a new episode all about mitigating risk in the cloud by using tools provided by Azure.  If you're currently deploying workloads in the cloud, how they handle potential intrusions and attacks is crucial.  By preventing these security incidents you can build trust with those who may access your applications and IT solutions.  

[Microsoft documentation defines the role of security operation teams](https://cda.ms/3xS) (also known as Security Operations Center (SOC), or SecOps) is detect, prioritize, and triage potential attacks.  The central SecOps team monitors and analyses security-related telemetry data. Any communication, investigation, or hunting actions must be coordinated with the application team.

This week we'll investigate the use cases for implementing the first cloud native Security and Event Management service (SIEM) [Microsoft Sentinel](https://cda.ms/3xP).  Microsoft Sentinel includes a number of connectors for Microsoft solutions that are ready to use and provide real-time integration, such as Microsoft 365 Defender (formerly Microsoft Threat Protection) solutions and Microsoft 365 sources such as Office 365, Azure AD, Microsoft Defender for Identity (formerly Azure ATP), and Microsoft Defender for Cloud Apps, among others. There are also built-in interfaces for non-Microsoft security solutions to the broader security ecosystem. You can also link your data sources to Microsoft Sentinel using common event formats, Syslog, or REST-API.

Microsoft Sentinel exists today, in part, because of the gaps in existing tools that were identified as Microsoft began its own journey to the cloud. One of those gaps is around efficiency and scale. In this session, we’ll talk about how Microsoft Sentinel was intentionally and mindfully developed to allow security teams to do more things more quickly without a drain on resources.

With Sentinel we can:

* Collect data at cloud scale
* Detect threats
* Investigate threats
* Respond to incidents

To help me with my journey into deploying Microsoft Sentinel I'll be joined by Microsoft Senior Cloud Security Advocate [Rod Trent](https://twitter.com/rodtrent) this week to see how we can build SOC efficiency with Microsoft Sentinel.  Rod will help me better understand how Microsoft Sentinel delivers **intelligent security analytics and threat intelligence** across the enterprise

{% youtube wuqCjUmOFV0 %}

[00:00:00 - Intro](https://youtu.be/wuqCjUmOFV0)
[00:03:15 - Welcome back to AzureFunBytes](https://youtu.be/wuqCjUmOFV0?t=195)
[00:05:15 - Let's meet Rod Trent](https://youtu.be/wuqCjUmOFV0?t=315)
[00:06:16 - So how'd you get here?](https://youtu.be/wuqCjUmOFV0?t=376)
[00:08:52 - Four pillars of Microsoft Sentinel](https://youtu.be/wuqCjUmOFV0?t=532)
[00:11:43 - How does our SOC fit in?](https://youtu.be/wuqCjUmOFV0?t=703)
[00:13:34 - Let's learn about Microsoft Sentinel](https://youtu.be/wuqCjUmOFV0?t=814)
[00:21:09 - SLAs](https://youtu.be/wuqCjUmOFV0?t=1269)
[00:22:10 - Daily Must-do's](https://youtu.be/wuqCjUmOFV0?t=1330)
[00:23:50 - Current SOC Efficiency Hunt Complaints](https://youtu.be/wuqCjUmOFV0?t=1430)
[00:26:14 -  A look at what's in the demo](https://youtu.be/wuqCjUmOFV0?t=1574)
[00:28:27 - Can Microsoft Sentinel integrate with other Microsoft security tools?](https://youtu.be/wuqCjUmOFV0?t=1707)
[00:30:40 - Does Microsoft Sentinel only work with Microsoft products and clouds?](https://youtu.be/wuqCjUmOFV0?t=1840)
[00:32:42 - What can be automated in Microsoft Sentinel?](https://youtu.be/wuqCjUmOFV0?t=1962)
[00:37:02 - Demo time!](https://youtu.be/wuqCjUmOFV0?t=2222)
[00:51:16 - Must Learn KQL](https://youtu.be/wuqCjUmOFV0?t=3076)

Our agenda includes:

- Azure Sentinel is the Tofu tool for monitoring security for the entire environment.
- Azure Sentinel is the sluice box of the Microsoft security platform.
- Azure Sentinel is the Cyclorama for the connected entities. 

About Rod Trent:

*Rod Trent is a Senior Cloud Security Advocate for Microsoft and an Azure Sentinel global SME helping customers migrate from existing SIEMs to #AzureSentinel to achieve the promise of better security through improved efficiency without compromise. He is a husband, dad, and first-time grandfather (so speak slow and loud). He spends his spare time (if such a thing does truly exist) simultaneously watching Six Million Dollar Man TV show episodes and writing KQL queries.*

------

Learn about Azure fundamentals with me!

Live stream is normally found on Twitch, YouTube, and [LearnTV](https://cda.ms/226) at 11 AM PT / 2 PM ET Thursday. You can also find the recordings here as well:

[AzureFunBytes on Twitch](https://twitch.tv/azurefunbytes)
[AzureFunBytes on YouTube](https://aka.ms/jaygordononyoutube)
[Azure DevOps YouTube Channel](https://www.youtube.com/channel/UC-ikyViYMM69joIAv7dlMsA)
[Follow AzureFunBytes on Twitter](https://twitter.com/azurefunbytes)

Useful Docs:
[Get $200 in free Azure Credit](https://cda.ms/219)
[Microsoft Learn: Introduction to Azure fundamentals](https://cda.ms/243)
[Security Operations in Azure](https://cda.ms/3xS)
[Microsoft Sentinel Overview](https://cda.ms/3xR)
[What is Microsoft Sentinel?](https://cda.ms/3xP)
[Microsoft Learn: Introduction to Microsoft Sentinel](https://cda.ms/3xY)
[Microsoft Learn: SC-200: Configure your Microsoft Sentinel environment](https://cda.ms/3xZ)
[Pre-deployment activities and prerequisites for deploying Microsoft Sentinel](https://cda.ms/3xX)
[Quickstart: On-board Microsoft Sentinel](https://cda.ms/3xQ)
[Best practices for Microsoft Sentinel](https://cda.ms/3y1)
[Tutorial: Use playbooks with automation rules in Microsoft Sentinel](https://cda.ms/3xT)
[Tutorial: Create a Power BI report from Microsoft Sentinel data](https://cda.ms/3xW)
[Forrester: The Total Economic Impact™ Of Microsoft Azure Sentinel](https://cda.ms/3y0)
[Weekly Microsoft Sentinel newsletter](https://aka.ms/SentinelNewsletter)
[Microsoft Sentinel community on LinkedIn](https://aka.ms/SentinelLinkedIn)
[Microsoft Sentinel product blog](https://aka.ms/AzureSentinelBlog)
[Rod Trent's blog](https://aka.ms/RodsBlog)