Learn Azure Sentinel: Integrate Azure security with artificial intelligence to build secure cloud systems

Cover
Title Page
Copyright and Credits
About Packt
Foreword
Contributors
Table of Contents
Preface
Section 1: Design and Implementation
Chapter 01: Getting Started with Azure Sentinel
	The current cloud security landscape
	The cloud security reference framework
	SOC platform components
	Mapping the SOC architecture
		Log management and data sources
		Operations platforms
		Threat intelligence and threat hunting
		SOC mapping summary
	Security solution integrations
	Cloud platform integrations
		Integrating with AWS
		Integrating with Google Cloud Platform (GCP)
		Integrating with Microsoft Azure
	Private infrastructure integrations
	Service pricing for Azure Sentinel
	Scenario mapping
		Step 1 – Define the new scenarios
		Step 2 – Explain the purpose
		Step 3 – The kill-chain stage
		Step 4 – Which solution will do detection?
		Step 5 – What actions will occur instantly?
		Step 6 – Severity and output
		Step 7 – What action should the analyst take?
	Summary
	Questions
	Further reading
Chapter 02: Azure Monitor – Log Analytics
	Technical requirements
	Introduction to Azure Monitor Log Analytics
		Planning a workspace
		Creating a workspace using the portal
		Creating a workspace using PowerShell or the CLI
		Exploring the Overview page
	Managing the permissions of the workspace
	Enabling Azure Sentinel
	Exploring the Azure Sentinel Overview page
		The header bar
		The summary bar
		The Recent incidents section
		The Data source anomalies section
		The Potential malicious events section
		The Democratize ML for your SecOps section
		Obtaining information from Azure virtual machines
	Advanced settings for Log Analytics
		Connected Sources
		The Data option
		Computer Groups
	Summary
	Questions
	Further reading
Section 2: Data Connectors, Management, and Queries
Chapter 03: Managing and Collecting Data
	Choosing data that matters
	Understanding connectors
		Native connections – service to service
		Direct connections – service to service
		API connections
		Agent-based
	Configuring Azure Sentinel connectors
	Configuring Log Analytics storage options
		Calculating the cost of data ingestion and retention
		Reviewing alternative storage options
	Summary
	Questions
	Further reading
Chapter 04: Integrating Threat Intelligence
	Introduction to TI
	Understanding STIX and TAXII
	Choosing the right intel feeds for your needs
	Implementing TI connectors
		Enabling the data connector
		Registering an app in Azure AD
		Configuring the MineMeld TI feed
		Confirming the data is being ingested for use by Azure Sentinel
	Summary
	Questions
	Further reading
Chapter 05: Using the Kusto Query Language (KQL)
	Running KQL queries
	Introduction to KQL commands
		Tabular operators
		Query statement
		Scalar functions
		String operators
	Summary
	Questions
	Further reading
Chapter 06: Azure Sentinel Logs and Writing Queries
	An introduction to the Azure Sentinel Logs page
	Navigating through the Logs page
		The page header
		The Tables pane
		The Filter pane
		The KQL code window
		The results window
		Learn more
	Writing a query
		The billable data ingested
		Map view of logins
		Other useful logs
	Summary
	Questions
	Further reading
Section 3: Security Threat Hunting
Chapter 07: Creating Analytic Rules
	An introduction to Azure Sentinel Analytics
		Types of analytic rules
		Navigating through the Analytics home page
	Creating an analytic rule
		Creating a rule from a rule template
		Creating a new rule using the wizard
	Managing analytic rules
	Summary
	Questions
	Further reading
Chapter 08: Introducing Workbooks
	An overview of the Workbooks page
		The workbook header
		The Templates view
		Workbook detail view
		Missing required data types
		Workbook detail view (continued)
		Saved template buttons
	Walking through an existing workbook
	Creating workbooks
		Creating a workbook using a template
		Creating a new workbook from scratch
	Editing a workbook
		Advanced editing
	Managing workbooks
	Workbook step types
		Text
		Query
		Parameters
		Links/tabs
		Advanced settings
	Summary
	Questions
	Further reading
Chapter 09: Incident Management
	Using the Azure Sentinel Incidents page
		The header bar
		The summary bar
		The search and filtering section
		Incident listing
		Incident details pane
		Using the Actions button
	Exploring the full details page
		The Alerts tab
		The Bookmarks tab
		The Entities tab
		The Comments tab
	Investigating an incident
		Showing related alerts
		The Timeline button
		The Info button
		The Entities button
		The Help button
	Summary
	Questions
	Further reading
Chapter 10: Threat Hunting in Azure Sentinel
	Introducing the Azure Sentinel Hunting page
		The header bar
		The summary bar
		The hunting queries list
		Hunting query details pane
	Working with Azure Sentinel Hunting queries
		Adding a new query
		Editing a query
		Cloning a query
		Deleting a query
	Working with Livestream
	Working with bookmarks
		Creating a bookmark
		Viewing bookmarks
	Using Azure Sentinel Notebooks
		The header bar
		The summary bar
		The notebook list
		The notebook details pane
	Performing a hunt
		Develop premise
		Determine data
		Plan hunt
		Execute investigation
		Respond
		Monitor
		Improve
	Summary
	Questions
	Further reading
Section 4: Integration and Automation
Chapter 11: Creating Playbooks and Logic Apps
	Introduction to Azure Sentinel playbooks
	Playbook pricing
	Overview of the Azure Sentinel connector
	Exploring the Playbooks page
		The header bar
		The summary bar
		Logic app listing
	Logic Apps settings page
		The menu bar
		The header bar
		The essentials section
		The summary section
		The Runs history section
	Creating a new playbook
	Using the Logic Apps Designer page
		The Logic Apps Designer header bar
		The Logic Apps Designer workflow editor section
	Creating a simple Azure Sentinel playbook
	Summary
	Questions
	Further reading
Chapter 12: ServiceNow Integration
	Overview of Azure Sentinel alerts
	Overview of IT Service Management (ITSM)
	Logging in to ServiceNow
	Creating a playbook to trigger a ticket in ServiceNow
		Cloning an existing logic app
		Modifying the playbook
		Additional incident information
		Adding dynamic content
		Adding static content
		Adding an expression
	Summary
	Questions
	Further reading
Section 5: Operational Guidance
Chapter 13: Operational Tasks for Azure Sentinel
	Dividing SOC duties
		SOC engineers
		SOC analysts
	Operational tasks for SOC engineers
		Daily tasks
		Weekly tasks
		Monthly tasks
		Ad hoc tasks
	Operational tasks for SOC analysts
		Daily tasks
		Weekly tasks
		Monthly tasks
		Ad hoc tasks
	Summary
	Questions
Chapter 14: Constant Learning and Community Contribution
	Official resources from Microsoft
		Official documentation
		Tech community – blogs
		Tech community – forum
		Feature requests
		LinkedIn groups
		Other resources
	Resources for SOC operations
		MITRE ATT&CK® framework
		National Institute of Standards for Technology (NIST)
	Using GitHub
		GitHub for Azure Sentinel
		GitHub for community contribution
	Specific components and supporting technologies
		Kusto Query Language
		Jupyter Notebook
		Machine learning with Fusion
		Azure Logic Apps
	Summary
Assessments
	Chapter 1
	Chapter 2
	Chapter 3
	Chapter 4
	Chapter 5
	Chapter 6
	Chapter 7
	Chapter 8
	Chapter 9
	Chapter 10
	Chapter 11
	Chapter 12
	Chapter 13
Other Books You May Enjoy
Index