Azure Sentinel - Modern Day SIEM tool for SOC !
summary
Azure Sentinel is a cloud‑native SIEM and SOAR built on an Azure Log Analytics workspace that eliminates on‑premise scaling headaches and bills pay‑as‑you‑go. The demo creates a workspace, connects Azure AD and other sources via 98+ connectors, uses KQL hunting queries to find anomalies, and wires analytics rules to Logic Apps playbooks for automated responses. It claims ~9,000 customers since Sept 2019, surfaces incidents that can be assigned and closed, and integrates Defender and threat‑intelligence feeds; the configured rules and playbooks execute and return expected alerts and automated actions.
AI-written summary · about
chapters (14)
- 0:00Introduction and agenda
- 2:07What is SOC SIEM SOAR
- 7:26Why Azure Sentinel matters
- 11:01Setting up Azure Sentinel
- 16:09Data connectors explained
- 25:41Threat intelligence overview
- 28:33Raw data and threat management
- 32:08Threat hunting with KQL
- 36:01Incident management in Sentinel
- 41:03Creating alert rules
- 44:59Automation with playbooks
- 50:07Dashboards and workbooks
- 51:10User behavior analytics
- 52:17Sentinel for SOC operations
related talks
48mAzure Sentinel the modern SIEM system
21mModernize your security operations with Azure Sentinel
51mManaging SIEM And SOAR using Azure Sentinel
33mModernize Your Security Operations With Azure Sentinel
46mUsing Azure Sentinel in service of protecting your systems
45mLet's talk about: Azure Sentinel
01h 02mAzure Identity and Security
28mWell-Architected Framework: Security