Microsoft Tech Talks (MTT) | Practical Sentinel : A Day in the Life of a Sentinel Analyst

[Peter Gray]

Practical Azure Sentinel : A Day in the Life of a Sentinel Analyst 

Friday - February 12th, 2021 - 1:00PM - 2:30PM CST

This session brings it all together and provides real-world examples of utilizing Azure Sentinel features as a security analyst. The attendee is able to picture themselves in the role of analyst and get an understanding of the specific tasks required to accomplish their daily workload - all based on an industry standard SOC workflow. It applies specific tasks with specific Azure Sentinel features.

EVENT AGENDA:
1:00 PM – Opening / Welcome
1:10 PM - Featured Topic – Speaker
2:00 PM - Q&A

EVENT SPEAKER BIO:
Rod Trent is an Azure Sentinel global SME helping customers migrate from existing SIEMs to #AzureSentinel to achieve the promise of better security through improved efficiency without compromise.

Microsoft Teams Live Event

[#2]

We are setting the table and getting ready to serve the smorgasbord of knowledge and experience from Rod Trent. Join us tomorrow !! Tell a friend!

[#3]

I am the sole Sentinel Analyst at my company. I have been having a hard time with false positives and haven't been using the product because of that. I have most of the analytic rules set up but like I said since I'm the only person using it and most are false positives I don't feel like I'm using Sentinel to its fullest potential. Do you have any recommendations for solving this problem and also what kind of training or help would you suggest for someone looking to get better at sentinel?@Peter Gray 

[#4]

@Peter Gray @rodtrent 

Are you able to give any insight on how to tackle unfamiliar sign-ins from AAD IP? 

We are seeing 1000s of these events every day to the point where we have had to disable them, it would be great to get your take on how we can tackle this event type and make them useful?

Another event that I am interested to know how you might tackle is New UserAgent discovered which we get 30+ entities a day, each time a guest logs in via AAD B2B or a user's browser gets updated. Please could you give some pointers on how we can add more context to this alert type? 

Many Thanks. 

[#5]

Is there a recording? I would like to watch it again and pass along to additional associates @Peter Gray 

[#6]

@RadRob unfortunately recordings can't be made publicly available. We are looking into a solution that would allow Premier and Unified Support customers to be able to access them, but we are probably 2 months out on that.

Good news though, Rod wants to present again on more topics so keep an eye out for that!

[#7]

@twessel Any chance you've identified the Analytics Rules that are contributing the most to your false positives? Are they coming from MCAS, possibly? What source?

[#8]

Yes, Most of our false positives come from MCAS. @rodtrent 

[#9]

@twessel Connecting MCAS to Sentinel enables a bridge between the two services so that only the originating service's (MCAS) alerts are synched to the Sentinel console. So, this would actually be a situation where MCAS policies need to be tuned on what and how often alerts are generated.