Azure Sentinel is a significant security innovation from Microsoft; a bold step using AI and machine learning to simplify and enhance your security management capability.
Modern technology is empowering organisations and their people, enabling broader horizons from work, to home, to that ‘third space’ of mobile and cloud. It’s no surprise that traditional security operations are struggling to keep up, given the changing working approach, evolving delivery of services and number and volume of threats.
Microsoft’s relentless investment and focus on security has seen it develop a comprehensive set of security components to support and enable a cloud-native approach. Azure Sentinel is the jewel in Microsoft’s security crown, working to proactively assess vulnerabilities and automate and accelerate incident response.
Appropriately named, Azure Sentinel is a scalable, cloud-native, security information and event management (SIEM) tool designed to operate across your entire IT estate, keeping watch for any behaviour or data that could be indicative of an attack.
Sentinel delivers intelligent security analytics and threat intelligence, providing a single solution for alert detection, threat visibility, proactive hunting and threat response.
Think of Sentinel as your birds-eye view across your organisation, working to alleviate the stress caused by increasingly sophisticated attacks, increasing volumes of alerts, and long resolution timeframes.
Sentinel compliments the diverse and growing set of advanced security technologies already offered by Microsoft, covering devices, data, infrastructure and applications.
These technologies already benefit from extensive machine learning based on vast amounts of telemetry data gathered globally and from within your private tenant. The aim is to surface quality, actionable alerts that enable you to detect and respond to potential threats.
This makes Sentinel a powerful asset for any security operations centre (SOC).
Watch the short video below for a quick overview of Azure Sentinel.
Our clients often feel overwhelmed with the monitoring and response requirements from a traditional SOC/SOAR investment. They can struggle to keep up, partly due to the ever-widening cyber security skills gap, but also in persuading their existing providers, either internal or external, to adapt to this new world. As a result, we’re starting to see an evolution in the function of the modern SOC and the development of some very sophisticated outsourcing options for cloud-based security managed services.
The concept of a security managed service is relatively simple: A third party or in-house team operate a security operations center that takes care of your IT security, allowing the business to securely conduct its day-to-day activity, uninterrupted by attack.
We are seeing organisations shift to a hybrid mode rather than completely outsourcing their security, seeking a complementary approach of internal security operations capability backed up by external specialist service providers with supporting services, technologies and automation.
A managed service, either completely or partially outsourced, can provide many benefits through real-time monitoring and data analysis. Taking advantage of a 24/7 SOC will allow you to defend against incidents regardless of time, type or even source.
Organisations often turn to a managed service because it helps with ownership of internal issues and gives you one place to go to seek a resolution. They can also offer opportunities to train your internal IT staff which can only add to your security strength.
Many SOCs are based around a central data repository. Typically these are located in a company’s data centre, but are more recently being moved to the Cloud (à la Sentinel).
Populating the data repository is normally achieved through a variety of methods from selected key business systems. This allows for RAW data to be correlated using unique business processes to produce incident cases.
Again, Sentinel will play a key part here, pulling information from across your organisation and translating it into a dashboard to highlight any concerns to the security team.
The main functions of a SOC are detection, investigation and triage. To that end, here are some key elements you should be looking for, that all effective SOCs should provide:
A big part of making sure your company is always performing at its best is monitoring. This can be achieved in several ways, through actionable alerts, emails or even just dashboards on a portal screen.
Many companies wait for issues to occur to see how their corporate infrastructure holds up, which is a reactive approach – you want to be proactive!
Information gathered through active monitoring can also lead to innovative projects that resolve long-standing issues in the IT environment, including automation and adapting remediations to current tools and techniques.
These are agreed and signed off processes that take the form of internal workflows and are required to be followed.
This ensures that all incidents are dealt with in the same way, every time. Now, we know that not all incidents are the same, so common sense is key, but first and foremost everything needs to be audited to make sure we can review what has been changed or completed in the event of a recurring incident.
This helps to build upon previous knowledge and stay up to date with evolving attack patterns.
A key requirement in your documentation library, and one that will get referred to regularly, this plan should cover everything from the smallest incident to a full-on company outage.
Inside this plan will be complete documentation on escalation processes all the way down to corporate templates for completion.
Take the SOC Capability Assessment and pick up your free report. Based on your current circumstances, we'll help you understand:
Every supplier constructs their security managed service differently, all using different tools, vendors, hosting types and cost models.
When considering your options, it’s important to understand the differences and choose one that meets both your business needs and your IT strategy. Investing in a managed service should ultimately increase your efficiency and effectiveness.
Here at ThirdSpace, we have developed a security managed service, built on Azure Sentinel, that delivers maximum value and peace of mind for our clients. As highlighted above our security services include:
What sets Azure Sentinel apart from other SIEMs is its access to Microsoft’s vast data sources. As well as your internal data, Sentinel can also draw on security data gathered across the world from every Microsoft platform. That’s an insane amount of knowledge Sentinel can use to teach itself how to better protect your digital assets.
A security managed service with a Sentinel powered SOC, supported by expert knowledge, is the ideal solution for any organisation looking to take their digital security to the next level.
Next, watch our Azure Sentinel webinar, where we deep dive into how Microsoft’s latest security software works and the benefits it provides.
Keep your finger on the pulse of security and Microsoft technology. Submit your business email to get the latest content and event invites straight to your inbox.
As head of our Mobility & Security practice, Mat’s responsibilities include ensuring that our technical knowledge and delivery capability are fully up to speed and current, as well as creating a...
READ AUTHOR'S FULL BIO
Take the SOC Capability Assessment and discover the cost saving potential for your organisation.Get my report
Send us your questions or feedback.
Friendly folks are standing by!
Eight-time winner of the Microsoft Partner of the Year Award for Identity Management, Enterprise Mobility, and Security and Compliance.
You are seeing this because you are using a browser that is not supported. The ThirdSpace website is built using modern technology and standards. We recommend upgrading your browser with one of the following to properly view our website:Windows
Please note that this is not an exhaustive list of browsers. We also do not intend to recommend a particular manufacturer's browser over another's; only to suggest upgrading to a browser version that is compliant with current standards to give you the best and most secure browsing experience.