User Profile
Ashwin_Patil
Joined 7 years ago
User Widgets
Recent Discussions
Re: Sentinel vs CloudAppSecuruty for AWS CloudTrails
Hi vadymvedmedenko , Thank you for the question. There is some overlap of AWS Cloudtrail detections between both products , but its very minimal. On high level, MCAS has features such as providing recommendation for security configurations, setting up and control cloud apps with policies. On the other hand, Azure Sentinel do not have those but have added advantage of correlating with third party data sources such as firewalls, network devices, commercial EDRs for hunting and analytics across various phases of attacks, getting insights into data via workbooks and remediation/SOAR capabilities with playbooks. I will reach out to MCAS team to consider publishing something highlighting features of both products. Product roadmaps are generally shared with customers under NDA. Let me know if that is the case and I will connect you with relevant teams/persons. Happy to answer any additional questions you have regarding Sentinel AWS detections.1KViews1like0CommentsTime Series analysis and visualization in Azure Sentinel
I have posted couple of blogs around Time Series analysis and visualization on security event log data sources in Azure Sentinel Blog 1: Introduction to Time Series, Step by step guide on compiling queries, configure alerts and investigate the results. Data Source : Windows Event Log - Process Execution Data https://techcommunity.microsoft.com/t5/Azure-Sentinel/Looking-for-unknown-anomalies-what-is-normal-Time-Series/ba-p/555052 Blog 2: Visualization and interpreting Time Series Data. Data Source- Palo Alto Network Traffic Logs https://techcommunity.microsoft.com/t5/Azure-Sentinel/Time-Series-visualization-of-Palo-Alto-logs-to-detect-data/ba-p/666344 As always, Feedbacks or questions are welcome.3KViews5likes1Comment
Recent Blog Articles
Anomaly detection and Explanation with Isolation Forest and SHAP using Microsoft Sentinel Notebooks
In this blog, we will demonstrate how you can identify anomalous Windows logon sessions using an Isolation Forest algorithm with an Azure ML studio notebook connected to a Microsoft Sentinel workspac...21KViews3likes1CommentHunting for potential network beaconing patterns using Apache Spark via Azure Synapse – Part 1
In this first of 2-part blog, we will do notebook code and section walkthrough to show how you can leverage power of Apache Spark via Azure Synapse in Azure ML Notebooks to perform scalable hunting o...7.9KViews3likes0CommentsUsing Jupyter Notebook to analyze and visualize Azure Sentinel Analytics and Hunting Queries
In this blog, we will look at various Detections and Hunting Queries published in our Public GitHub Repo , analyze and visualize the output to understand current MITRE ATT&CK® coverage, identify gap...11KViews2likes2CommentsHunting for Capital One Breach TTPs in AWS logs using Azure Sentinel - Part I
This is the first part of two part article in which we will explain the attack simulation of Capital one Breach scenario using Cloud Goat scenario - cloud_breach_s3 which is developed by Rhino Securi...22KViews5likes2CommentsDetect Network beaconing via Intra-Request time delta patterns in Azure Sentinel
This article will discuss the use case of detecting network beaconing via intra-request time delta patterns using KQL (Kusto query language) in Azure Sentinel. The logic or technique of the use-case...23KViews4likes3CommentsLooking for unknown anomalies - what is normal? Time Series analysis & its applications in Security
This article provides a practical outline for using Time Series analysis to surface anomalies on security event log data sources, visualizing and alerting on anomalies for further investigation in Az...23KViews6likes5Comments