- Enabling and Using Microsoft Sentinel.
The reason why we need to touch on this topic
is because secure information and event management platform,
SIEM, is something that most of our large organization,
and even medium organization, are adopting.
So if you are gonna work as a SOC analyst,
security operations center cybersecurity analyst,
depending on the position you go in,
you have to have some knowledge in SIEM.
So if you're not familiar with this platform,
if you're not familiar with this type of platform,
using a software such as Microsoft Sentinel
can give you some hands-on practice
that can help you to create this understanding
of how a SIEM platform works.
And then you can go and learn other platforms
such as Splunk, QRadar, any other platform,
because the concepts are very similar.
There are certain characteristics that are part
of a modern SIEM that you're gonna see
as you use Microsoft Sentinel,
such as data collection across multiple data source.
That's the whole point of a SIEM, right?
If you think about if you are investigate an incident
you want as much data as you need to understand
not only what happened, but how that attack started.
So data correlation across multiple data sources
is extremely important.
The SIEM platform will receive data from the file.
It will receive data from your
cloud workload protection platform
and receive it from multiple places
so you can have that data accumulate in one single place
and do data correlation.
Not only that, but most of the modern SIEMs,
they have their own threat detection capabilities built in.
So you can leverage that as well.
There are integration with threat intelligence.
Threat intelligence becomes something important
for the cybersecurity field
because it's with threat intelligence
that you understand how threat actors
are attacking other companies in the wild,
how threat actors are leveraging legitimate tools
to do malicious operations, because that's another problem.
Most of the attacks, they start in a very benign way
using normal tools.
So the days of crafting malicious tools
is a little bit behind.
Threat actors are smart to understand that they can leverage
built-in operating system tools to do malicious operations.
So how do you even detect that?
Well, based on patterns of behaviors,
and that's where things like threat intelligence
can help you because it will say,
"Hey, threat actors are using these tools
to perform these operations."
That's very important for you to be aware.
The other thing is the investigation capabilities.
Platforms, SIEM platforms, they do have
their own investigation capabilities
that allow you to do deep investigation
on things that are taking place,
and Sentinel has that as well.
Rapid response because, again, it's not only
about the detection, it's about how fast you respond.
If you think about the life cycle of protect
and detect and respond, what you always aim for is to reduce
the time between the identification of an attack
and the response to that attack.
Because if you identify but you delayed too much to respond,
threat actor already did more things
and caused more damage to the environment.
So you want to reduce the time
in between detection and response.
So SIEM platforms, they do have orchestrations
and automations, capabilities to help address this.
Why are you gonna use Sentinel again?
Well, Sentinel, it is one of the leading products
when it comes to SIEM platform.
It has a trial period as well that you can use,
and there is already a lab available for you to utilize.
So if you go to aka.ms/MSSentinelLab,
you're gonna be able to complete modules one to four
and this will give you a lot of familiarization
with the platform.
There's a lot of things happening
between modules one and four that will give you
really hands-on activities.
It's really fun.
You're gonna be able to do that on your lab environment
and get more familiar with Microsoft Sentinel.