Automating security monitoring
summary
Shows concrete automations: automated URL enrichment with VirusTotal and MISP threat‑intel lookups, analytic rules in Microsoft Sentinel that group duplicate alerts and auto‑close Defender‑prevented malware, and playbooks (Azure Logic Apps) to isolate hosts or disable users with optional Teams approvals. Demonstrates a PowerShell pipeline that queries multiple workspaces, calls OpenAI to create concise close comments, and claims saved ~11.5 hours/day for 10 analysts by removing repetitive enrichment and triage work.
AI-written summary · about
chapters (15)
- 0:00Automating security monitoring intro
- 2:57Why automation is critical
- 9:47Alert fatigue drivers
- 12:32Security monitoring basics
- 15:24Security teams in practice
- 17:21Key monitoring components
- 20:55Automation basics
- 24:52Microsoft Sentinel overview
- 30:12Threat intelligence enrichment
- 35:29Orchestration for alerts
- 39:16AI automation efficiency
- 43:31Automated response actions
- 44:35DevOps PowerShell example
- 46:40Time savings quantified
- 48:29Final takeaways
related talks
48mAutomate(d) security with Azure Security Center
28mScaling Your Defenses: Next Level Security Automation for Enterprise
44mWhat I learnt about automating security
45mAdvanced Security Operations with Elastic Security
01h 02mAzure Identity and Security
33mModernize Your Security Operations With Azure Sentinel
27mStandard Classification: Automate Security, Don't Tell Your Boss
19mDefender XDR in the Real World: Measurable Risk Reduction