A big thank you to the Microsoft Sentinel CxE team for helping make this happen and a big thank you to Batami Gold for putting the documents together and organizing them.
A new effort has begun to create and upload content around commonly asked questions as well as best practices for using the product. With this, we have posted 3 new documents and updated some others that are live now!
New documents:
Pre-deployment best practices: This document serves as a place to check while going through pre-deployment planning. It contains information about topics such as requirements, items to prioritize, and best practices for working with workspaces.
General best practices: This document covers general topics, such as tasks to perform and how often they should be performed, integrating Microsoft Sentinel with the other Microsoft security services, and incident response options.
Data collection best practices: This document covers topics to consider when collecting logs, whether it is through a built-in connector or custom method.
To avoid duplication of information and long running documents, there are best practices that can be found within the different documents for Microsoft Sentinel. Two examples would be commonly used Microsoft Sentinel workbooks and cost and billing. Both documents cover what is recommended and how to go about using the different features or methods within your Microsoft Sentinel environment. If you don't see something that you would expect, chances are that the item is covered under another document.
Updated content:
There are a few documents that have been updated with new content to cover newly developed concepts or questions that have been brought up. An example is the costs and billing document, which covers which data sources are free, which services generate cost when using Microsoft Sentinel, and options for cost management.
Updated structure:
Along with the new content, the navigation pane has been updated as well to have a better flow and easier navigation. Before, documents were given scenario based titles and fell within different topics that included different features within the same bucket. With the update, documents are now broken into subtopics based on feature, with the use case listed within the title. As time goes on, new content and best practices can be found under the feature topics based on relevancy.
As mentioned, as time goes on we will be adding more content and best practices to our documents so please keep an eye on them! Go ahead and check out the new and updated content within the docs that are out today.
If there are topics that are not covered or if you find content that is not helpful, not clear, or out of date, please let us know in the comments here so that we can get the content created!
Microsoft
