Build next-generation security operations with Microsoft Sentinel
Microsoft Sentinel is the scalable, cloud-native, security information
and event management (SIEM) solution for automating and streamlining
threat identification and response across your enterprise. Now, three
leading experts guide you step-by-step through planning, deployment, and
operations, helping you use Microsoft Sentinel to escape the complexity
and scalability challenges of traditional solutions. Fully updated for
the latest enhancements, this edition introduces new use cases for
investigation, hunting, automation, and orchestration across your
enterprise and all your clouds. The authors clearly introduce each
service, concisely explain all new concepts, and present proven best
practices for maximizing Microsoft Sentinel's value throughout security
operations.
Three of Microsoft's leading security operations experts show how
to:
- Review emerging challenges that make better cyberdefense an urgent
priority
- See how Microsoft Sentinel responds by unifying alert detection,
threat visibility, proactive hunting, and threat response
- Explore components, architecture, design, and initial configuration
- Ingest alerts and raw logs from all sources you need to monitor
- Define and validate rules that prevent alert fatigue
- Use threat intelligence, machine learning, and automation to triage
issues and focus on high-value tasks
- Add context with User and Entity Behavior Analytics (UEBA) and
Watchlists
- Hunt sophisticated new threats to disrupt cyber kill chains before
you're exploited
- Enrich incident management and threat hunting with Jupyter notebooks
- Use Playbooks to automate more incident handling and investigation
tasks
- Create visualizations to spot trends, clarify relationships, and speed
decisions
- Simplify integration with point-and-click data connectors that provide
normalization, detection rules, queries, and Workbooks
About This Book
- For cybersecurity analysts, security administrators, threat hunters,
support professionals, engineers, and other IT professionals concerned
with security operations
- For both Microsoft Azure and non-Azure users at all levels of
experience
