Microsoft Sentinel in Action
By :
Microsoft Sentinel in Action
By:
Overview of this book
Microsoft Sentinel is a security information and event management (SIEM) tool developed by Microsoft that helps you integrate cloud security and artificial intelligence (AI). This book will teach you how to implement Microsoft Sentinel and understand how it can help detect security incidents in your environment with integrated AI, threat analysis, and built-in and community-driven logic.
The first part of this book will introduce you to Microsoft Sentinel and Log Analytics, then move on to understanding data collection and management, as well as how to create effective Microsoft Sentinel queries to detect anomalous behaviors and activity patterns. The next part will focus on useful features, such as entity behavior analytics and Microsoft Sentinel playbooks, along with exploring the new bi-directional connector for ServiceNow. In the next part, you’ll be learning how to develop solutions that automate responses needed to handle security incidents and find out more about the latest developments in security, techniques to enhance your cloud security architecture, and explore how you can contribute to the security community.
By the end of this book, you’ll have learned how to implement Microsoft Sentinel to fit your needs and protect your environment from cyber threats and other security issues.
Table of Contents (23 chapters)
Preface
Section 1: Design and Implementation
Free Chapter
Chapter 1: Getting Started with Microsoft Sentinel
Chapter 2: Azure Monitor – Introduction to Log Analytics
Section 2: Data Connectors, Management, and Queries
Chapter 3: Managing and Collecting Data
Chapter 4: Integrating Threat Intelligence with Microsoft Sentinel
Chapter 5: Using the Kusto Query Language (KQL)
Chapter 6: Microsoft Sentinel Logs and Writing Queries
Section 3: Security Threat Hunting
Chapter 7: Creating Analytic Rules
Chapter 8: Creating and Using Workbooks
Chapter 9: Incident Management
Chapter 10: Configuring and Using Entity Behavior
Chapter 11: Threat Hunting in Microsoft Sentinel
Section 4: Integration and Automation
Chapter 12: Creating Playbooks and Automation
Chapter 13: ServiceNow Integration for Alert and Case Management
Section 5: Operational Guidance
Chapter 14: Operational Tasks for Microsoft Sentinel
Chapter 15: Constant Learning and Community Contribution
Assessments
Other Books You May Enjoy
How would like to rate this book
Customer Reviews
