{"id":91526,"date":"2020-07-09T13:00:51","date_gmt":"2020-07-09T20:00:51","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=91526"},"modified":"2023-05-15T23:04:50","modified_gmt":"2023-05-16T06:04:50","slug":"making-azure-sentinel-work","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/","title":{"rendered":"Making Azure Sentinel work for you"},"content":{"rendered":"

Microsoft Azure Sentinel is the first Security Incident and Event Management (SIEM) solution built into a major public cloud platform that delivers intelligent security analytics across enterprise environments and offers automatic scalability to meet changing needs. This new white paper<\/a> outlines best practice recommendations for configuring data sources for Azure Sentinel, using Azure Sentinel during incident response, and proactively hunting for threats using Azure Sentinel.<\/p>\n

Research shows that, on average, 44% of security alerts that are raised by security solutions go uninvestigated. Organizations simply lack the time, tools, and talent to investigate and correlate every single alert. In many cases this results in a focus on alerts that are flagged as \u201ccritical\u201d or \u201cvery important\u201d and lower severity alerts are ignored. However, experience shows that investigating those lower severity alerts \u2013 and how they may be correlated to show more worrying combinations of actions \u2013 can reveal attacker behaviors that would otherwise fly under the radar.<\/p>\n

Azure Sentinel is an incredibly powerful tool that can help you collect security data across your entire hybrid organization from devices, users, apps, servers, and any cloud. Using these data sources you can build a more complete picture of the threats that your organization faces, conduct deep threat hunts across your environment, and use the power of automation and orchestration in the cloud to help free up your security analysts to focus on their highest-value tasks.<\/p>\n

T<\/span><\/span>raditional SIEMs have proven to be expensive to own and operate, often requiring you to commit up front and incur high cost for infrastructure maintenance and data ingestion. Azure Sentinel provides you with SIEM-as-a-service and SOAR-as-a-service for the SOC: your birds-eye view across the enterprise; putting the cloud and large-scale intelligence from decades of Microsoft security experience to work. Following the best practices outlined within <\/span><\/span>this white<\/span><\/span><\/a>\u00a0<\/span><\/span>paper<\/span><\/span><\/a>\u00a0will help you eliminate security infrastructure setup and maintenance and provide you with scalability to meet your security needs\u2014 all while reducing costs and increasing visibility and control.<\/span><\/span>\u00a0<\/span><\/p>\n

For more information on Microsoft Security Solutions,\u00a0visit our website<\/a>.\u00a0Bookmark the\u00a0Security blog<\/a>\u00a0to keep up with our expert coverage on security matters. Also, follow us at\u00a0@MSFTSecurity<\/a>\u00a0for the latest news and updates on cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":"

A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel. <\/p>\n","protected":false},"author":96,"featured_media":91528,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3685],"products":[3726],"threat-intelligence":[],"tags":[],"coauthors":[2360,2194,2361],"class_list":["post-91526","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-siem-and-xdr","products-microsoft-sentinel"],"yoast_head":"\nMaking Azure Sentinel work for you | Microsoft Security Blog<\/title>\n<meta name=\"description\" content=\"A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Making Azure Sentinel work for you | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-09T20:00:51+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T06:04:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-BANNER.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ken Malcolmson, Adwait Joshi, Rin Ure\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-BANNER.png\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ken Malcolmson, Adwait Joshi, Rin Ure\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/ken-malcolmson\/\",\"@type\":\"Person\",\"@name\":\"Ken Malcolmson\"},{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/adwait-joshi\/\",\"@type\":\"Person\",\"@name\":\"Adwait Joshi\"},{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/rin-ure\/\",\"@type\":\"Person\",\"@name\":\"Rin Ure\"}],\"headline\":\"Making Azure Sentinel work for you\",\"datePublished\":\"2020-07-09T20:00:51+00:00\",\"dateModified\":\"2023-05-16T06:04:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\"},\"wordCount\":369,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\",\"name\":\"Making Azure Sentinel work for you | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png\",\"datePublished\":\"2020-07-09T20:00:51+00:00\",\"dateModified\":\"2023-05-16T06:04:50+00:00\",\"description\":\"A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png\",\"width\":500,\"height\":263,\"caption\":\"An image of a female and male enterprise employees collaborating in a conference room.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Making Azure Sentinel work for you\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Making Azure Sentinel work for you | Microsoft Security Blog","description":"A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/","og_locale":"en_US","og_type":"article","og_title":"Making Azure Sentinel work for you | Microsoft Security Blog","og_description":"A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/","og_site_name":"Microsoft Security Blog","article_published_time":"2020-07-09T20:00:51+00:00","article_modified_time":"2023-05-16T06:04:50+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-BANNER.png","type":"image\/png"}],"author":"Ken Malcolmson, Adwait Joshi, Rin Ure","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-BANNER.png","twitter_misc":{"Written by":"Ken Malcolmson, Adwait Joshi, Rin Ure","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/ken-malcolmson\/","@type":"Person","@name":"Ken Malcolmson"},{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/adwait-joshi\/","@type":"Person","@name":"Adwait Joshi"},{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/rin-ure\/","@type":"Person","@name":"Rin Ure"}],"headline":"Making Azure Sentinel work for you","datePublished":"2020-07-09T20:00:51+00:00","dateModified":"2023-05-16T06:04:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/"},"wordCount":369,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/","name":"Making Azure Sentinel work for you | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png","datePublished":"2020-07-09T20:00:51+00:00","dateModified":"2023-05-16T06:04:50+00:00","description":"A new white paper outlines best practice recommendations for configuring data sources for incident response and proactively hunting for threats using Azure Sentinel.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2020\/07\/M365CO19_ENT_dellLatitude13_5475-7-9-FEATURE.png","width":500,"height":263,"caption":"An image of a female and male enterprise employees collaborating in a conference room."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/07\/09\/making-azure-sentinel-work\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Making Azure Sentinel work for you"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/91526"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=91526"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/91526\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/91528"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=91526"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=91526"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=91526"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=91526"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=91526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=91526"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=91526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}