Jump-start your security defenses with a cloud-native, scalable, threat intelligence (SIEM) solution!
_______________________________

Overview of Azure Sentinel

Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Sentinel brings compliance to organizations through connecting Office 365 logs, especially when researching events that happened in the past, like previous behavior of a former employee or trying to determine access points that hackers may have used for entry while the default is that the log is only kept for 90 days. This is very limiting when a security breach occurs, or organizations would like to keep logs for more than 90 days. Connecting Office 365 logs to Azure Sentinel enables you to view and analyze this data in your workbooks, query it to create custom alerts, and incorporate it to improve your investigation process, giving you more insight into your Office 365 security.

Azure Sentinel brings peace of mind and safety with wide reach security monitoring and analysis. Use it to detect security incidents and threats and alert organizations – then use Azure Sentinel to investigate and mitigate threats. This is a birds-eye view across your organization, and ultimately relieves the stress of increasingly sophisticated malware attacks and threats. Sentinel provides organizations with intelligent security analytics that will simplify security needs. Organizations can aggregate all their security data in one place with built-in connectors, native integration of Microsoft signals, and support for industry-standard log formats. Azure Sentinel better addresses the main SIEM landscape challenges by simplifying data residency and a unified approach to an organization's security landscape

Benefits of Azure Sentinel

• Better Security – see what is occurring across your environment and cloud quickly
• Reduced damage by hackers by responding quicker
• Save administrators time by collecting data at a Cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds. Including non-Microsoft sources like Carbon Black, Symantec, Barracuda, Citrix, and many other big-name security vendors.
• Save Money - traditional SIEMs have proven expensive to own and operate, often requiring organizations to commit upfront and incur high costs for infrastructure maintenance and data ingestion. With Azure Sentinel there are no upfront costs for the software, you pay for what you use.
  There are two Basic Pricing Models:
  • A capacity reservation has a fixed fee based on a selected tier. Tiers are based on the amount of data (in GB) you estimate will be logged and analyzed in your network every day. The tiers begin with an estimated capacity of 100GB per day.
  • With Pay-As-You-Go pricing, you are billed per GB for the volume of data ingested in the Azure Monitor Log Analytics workspace. Typically, if your organization plans on having less than 69GB of data logged daily, the pay-as-you-go model is the better deal – but once you go over, it is usually cheaper to buy a plan.

Azure Sentinel can enable your organization to:

Copyright Microsoft

• Collect data across your enterprise, such as alerts, Azure activity, sign-in logs, etc.
• Analyze & detect threats quickly. Detect previously undetected threats, and minimize false positives using Microsoft’s analytics and threat intelligence.
• Investigate & hunt for suspicious activities. Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber-security work at Microsoft
• Automate common tasks & threat response. Respond to incidents rapidly with built-in orchestration and automation of common tasks. Accelerate proactive threat hunting with pre-built queries that are ready to use!

How it Works

Azure Sentinel connects to your Microsoft security sources: Office 365, Azure Active Directory, Azure Threat Protection, Microsoft Cloud App Security, and more. In addition, there are built-in connectors to the broader security ecosystem for non-Microsoft solutions. Once connected, Sentinel monitors data using the integration with Azure Monitor Workbooks, which allows custom workbooks across your data to gain insights quickly. Templates are also built-in for organizations to use.

Organizations can use analytics to correlate alerts into incidents, then create a possible-threat item that you can investigate and resolve. Save your organization time and headaches by automating common tasks and simplify security orchestration with playbooks that integrate with Azure services as well as your existing tools. Quickly find the root cause of a threat through search-and-query tools. Here is a preview of the Azure Sentinel in work:

Copyright Microsoft

Why Microsoft?

Microsoft technologies perform optimally when integrated with each other. Azure Sentinel bridges the gap between Microsoft security sources working together best, and other security sources in an organization’s security ecosystem. Security analytics and operations technologies must lean in and help security analysts deal with the complexity, pace, and scale of their responsibilities. That is where Azure Sentinel comes in as a re-invented SIEM in the cloud to address the modern challenges of security analytics. Since our inception in 2011, Interlink has focused solely on providing exceptional support and solutions around Microsoft-based technologies. We educate and guide, so our clients avoid overpaying for licensing or purchasing unneeded technologies.

Jon Oltsik, Senior Principal Analyst and Enterprise Strategy Group Fellow, has compiled an e-book on Industry Trends regarding Security Analytics and Operations. In the book, he provides research-based insights on how real organizations are switching to cloud-based security, and why that benefits their organization's security solutions. From understanding challenges today to future security analytic plans, this e-book is worth reading. View this e-book here!

Azure Sentinel Energize Workshop

Azure Sentinel Energize Workshop is a structured engagement that leverages Azure Sentinel and selected Microsoft 365 security products to help organizations get an overview of Azure Sentinel and get insights on active threats across on-premises and cloud workloads. The Azure Sentinel Workshop has been designed to be utilized in one of the following scenarios:

• Remote monitoring – Interlink will deploy Azure Sentinel in the customer’s environment, performing remote monitoring and optionally, threat hunting, along with demonstrating that the solution can be remotely managed by Interlink.
• Joint threat exploration – Interlink will deploy Azure Sentinel in the customer’s environment, performing the threat exploration and optionally, the threat hunting phase, together with the customer, providing additional readiness for the customer’s SecOps resources to allow them to manage the solution as part of their existing SOC.

At the end of the engagements, the customer will:

• Better understand the features and benefits of Azure Sentinel, a cloud-native SIEM
• Better understand, prioritize, and mitigate potential threats found during the engagement
• Have defined deployment roadmap for the production deployment of Azure Sentinel
• Have defined next steps based on their needs and objectives

Learn if Azure Sentinel is right for your organization! Funding for this engagement may be available from Microsoft. Contact Interlink to discuss your organization’s specific environment and to learn more today!

Interested in learning more? View our similar blog: Azure Sentinel is Now Available.