As we know, each organization is unique and have different use cases and scenarios in mind when it come to security operations. Nevertheless we've identified several use cases that are common across many SOC teams.
Azure Sentinel now provides built-in watchlist templates, which you can customize for your environment and use during investigations.
After those watchlists are populated with data, you can correlate that data with analytics rules, view it in the entity pages and investigation graphs as insights, create custom uses such as to track VIP or sensitive users, and more.
Watchlist templates currently include:
We've created the watchlists templates schemas to be super easy and extensible, in order for you to populate it with the relevant data. more information about using the watchlists templates can be found here.
Beside surfacing the watchlists templates data inside the entity pages, we're working on embedding this information in the UEBA anomalies, and the entity risk score which is planned next. Understanding if a user is a VIP/Terminated or an asset is an HVA is important to provide both context and security value for the analyst while investigating.
We Value Your Opinion!
Our goal is to make your life easier while you investigate security incidents. If you have any feedback – about the experience, the usage – or anything else,
Please let us know! We aim to improve
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.