Sentinel How to Questions

GlavniArhivator Answers inline...

1. Is it ok to use the same workspace for Azure Security Center and Sentinel or are they any considerations to pay attention to?

--Yes. That way you have access to all the data you need.

2. What is actually the benefit of having the ASC Workbook in Sentinel except the visual dashboard? I mean, it cannot really replace the handling of alerts and recommendations within the actual ASC interface?

---That is correct.  It is only used a visual report although it can show some issues that need to be investigated.

3. Are there any best practices or examples of how parallely work with 3rd party SIEM solutions and Azure Sentinel and profit ? 

---Yes, there are various Azure Sentinel blog posts that discuss it: https://techcommunity.microsoft.com/t5/azure-sentinel/bg-p/AzureSentinelBlog

4. -ERR:REF-NOT-FOUND-Here they say "You'll only be able to investigate the incident if you used the entity mapping fields when you set up your analytic rule. The investigation graph requires that your original incident includes entities."

Does that mean that e.g. all that Microsoft Security rule types or fusion rules cannot be investigated in "Investigation graph" and only scheduled ones can? Isn't that gap?

---That is not correct.  They automatically populate as many of the entities as they can.

5. How to get the Sentinel workbooks to the Dashboard? When I pin a workbook  i only see a white box with the workbook's name, the workspace name and a blue icon on the dashboard. 

---In that example you need to click on the box to see the workbook.  You can also pin individual parts of the workbook and those should show up in the dashboard.

6. What i did not get is the workflow. Is investigation something that happen in combination with threat response, or before threat response?? 
And about threat response: Is it true that the only thing i can do for respond to threats is to have pre-defined playbooks which i have to run manually or let automatically be triggered? Is there no option for ad-hoc response?

--Investigations and Threat hunting are two different entities.   Investigations are done on incidents that were created from a rule.  Threat hunting is more of looking for issues that are not covered by the analytic rules.   Mind you this is only a basic description as the differences could be a book unto itself. 😉

7. When i have investigated an incident and go to remediate - Where is the difference when i remediate with a üre-defined playbook and when I go and look within Azure Security Center to remediate in order to prevent from future similar alerts?

---If you have an incident that is created from a different Azure security product it is best to use the creating product to do the investigation.  Sadly, there is no connection between the Azure Sentinel incident and the one created in the product (so if you close the one in Azure Sentinel you still need to close the one in the other product).   The main purpose of having the alerts/incidents show up in Azure Sentinel is to have a single pane of glass view.