Integration of Azure Sentinel

[Larissa_ADEGBIDI]

Hi everyone,

I've discover Sentinel recently, hence why i have some basics questions. Here they are:

I would like to know in a practical way how Sentinel fits into the architecture of a company ? Is there any video available on this?

I mean how is the solution able to know the infrastructure within which it is added?

How Sentinel gets to know users in a particular department of the company (which later allows this SIEM solution to determine an anomaly when a person from the sales department connects to a position in the legal department, for example)?

Also, how many time does it take to achieve a project of adopting Azure Sentinel in an enterprise? I understand it might depend on the IT architecture of the corporate but i would like to have an estimation.

Thanks in advance

[#2]

@Larissa_ADEGBIDI For most of your questions, I recommend reading the Azure Sentinel Ninja training: https://techcommunity.microsoft.com/t5/azure-sentinel/become-an-azure-sentinel-ninja-the-complete-le...

In a nutshell, everything that Azure Sentinel knows depends on the data it is ingesting via data connectors.  There is always going to be a balance between having the needed data and having to pay for all that data.

In regards to how much time it would take I'll give the typical consultant answer:  It depends :)    It will depend a lot on what data you want to ingest (and where it is located; Azure, on-prem, elsewhere), what rules will need to be created to use this data (although Azure Sentinel has a lot of rule templates they do not cover every possible data source), custom workbooks and playbooks, and how much training is needed (are you going to be doing the maintaining, monitoring, and investigation or let a Managed Service provider handle it?).

[#3]

Thanks Gary Bushey!