Azure Sentinel PoC Workshop

Let's understand how to set up, configure,
and use Azure Sentinel

Microsoft Azure Sentinel is a scalable, cloud-native, Security Information Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It is powered by built-in AI, analytics and automation with an ability to write the custom alert rules and automated playbooks to collect, detect, investigate and respond to threats in your environment in real-time.

With Azure Sentinel, you can:

Secure your network, infrastructure, data, and applications on Microsoft Azure effectively
Integrate Artificial Intelligence, Threat Analysis, and Automation for Optimal Security solutions
Investigate possible security breaches and gather forensic evidence to prevent modern cyber threats

WORKSHOP HIGHLIGHTS

Understand the features and benefits of Azure Sentinel

Gain visibility into threats across email, identity, and data

Better understand, prioritize, and mitigate potential threat vectors

Create a customised deployment roadmap based on your environment and business & technology goals

Develop joint exploration and execution plans

WORKSHOP OBJECTIVE

Experiencing Azure Sentinel

Get hands-on experience and learn how to discover and analyze threats using Azure Sentinel. Learn how to automate your Security Operations to make it more effective.

Understanding How To Mitigate Threats

Help you understand how Microsoft 365 and Azure security products can help you mitigate and protect against the threats found during the period of this engagement.

Discovering and Analyzing Threats

Gain visibility into threats to your Microsoft 365 cloud and on-premises environments across email, identity and data to better understand, prioritize and mitigate potential cyber-attack vectors.

Planning The Next Steps

Get the information required for you to onboard your Azure Sentinel, including technology deployment roadmap. Plan and provide information to build a business case for a production deployment of Azure Sentinel, including a technical deployment roadmap.

WORKSHOP SCOPE

Remote Monitoring of Threats

Incident Monitoring: Provide remote monitoring of Azure Sentinel for incidents during the engagement
Proactive threat hunting across the organization’s data sources
(optional) – using Sentinel hunting search and query tools for security threats hunting

Joint Threat Exploration

Optional – Included in the scope only at customer’s discretion

Jointly work with the organization’s security analysts and engineering team to discover and analyse the threats using Azure Sentinel.
Demonstration of automation of security operations
Analysis of threats in an enterprise’s on-cloud (Azure) and on-premise environment across email, identify and data to better understand, prioritize and mitigate potential cyber-attack vectors.

WHAT WE'LL DO?

Step 1:Pre-Engagement Call

Engagement overview
Define scope and identify the right stakeholders
Understand business and IT requirements, existing SIEM/SOC tools, data sources to be connected and security operations automation requirements

Step 2:Technical Engagement

Setup trial licence with Deploy and Configure Azure Sentinel
Connect Azure Sentinel to ingest data from Azure AD Identity Protection, Microsoft Cloud App Security, Agreed 3rd Party Syslog integration and

Step 3:Threat Exploration and Report Generation

Remote incident monitoring during the data collection phase
An optional action of threat hunting to discover indicators of attack in the ingested data

Step 4:Results resentation

Prepare results to gain visibility into threats in your cloud and on-premises environment
Get recommendation on how to mitigate or avoid cyberattacks with defined deployment roadmap based on your needs and objectives

WHO can take advantage of this WORKSHOP?

The workshop is intended for security decision-makers such as:

Chief Information Security Officer (CISO)

Chief Information Officer (CIO)

Chief Security Officer (CSO)

IT Operations

Data Protection Officer

IT Security

IT Compliance

Data Governance Officer

Cloud4C has deployed Azure Sentinel for customers across the following domains

Banks and Financial Institutions

Very Large Government organizations

Large Manufacturers

Retail

Communications

Why Cloud4C?

As an Azure Expert MSP, you can trust our expertise that the workshop will be a highly productive session. It will help you better understand Azure Sentinel’s capabilities, determine how it can address your security pain points, and decide whether using managed cybersecurity services – for both detection and incident response can rapidly and cost-effectively raise your security posture.

PROACTIVELY DETECT | ALERT | INVESTIGATE | RESPOND AND IMPROVEPROOF OF CONCEPT WORKSHOP | AZURE SENTINEL

Let's understand how to set up, configure, and use Azure Sentinel