Ninja Cat Giveaway: Episode 3 | Sentinel integration

[HeikeRitter]

For this episode, your opportunity to win a plush ninja cat is the following -

Reply to this thread with: what was your favorite feature Javier presented? Oh and what does UEBA stand for? 

This offer is non-transferable and cannot be combined with any other offer. This offer ends on April 14^th, 2023, or until supplies are exhausted and is not redeemable for cash. Taxes, if there are any, are the sole responsibility of the recipient. Any gift returned as non-deliverable will not be re-sent. Please allow 6-8 weeks for shipment of your gift. Microsoft reserves the right to cancel, change, or suspend this offer at any time without notice. Offer void in Cuba, Iran, North Korea, Sudan, Syria, Region of Crimea, Russia, and where prohibited.

[#2]

One of my favorite features presented by Javier in the video was the threat-hunting module in Microsoft Sentinel which enables security analysts to proactively search for security threats within an organization's IT environment. 

I find the threat-hunting module a powerful tool that allows organizations to proactively detect and respond to potential threats before they escalate into more serious security incidents.

UEBA stands for User and Entity Behavior Analytics. It is a type of cybersecurity technology that uses machine learning algorithms to analyze and identify anomalous behavior patterns in users and entities accessing a computer network. The goal is to detect potential insider threats or external attacks that may be missed by traditional security measures.

[#3]

Hi Luke! I checked with Javier, just to be sure I am not missing anything, and he did not present this in the show.

[#4]

That's funky. I must have had something else on my mind, but I rewatched the video and edited my response. Thank you!

[#5]

@HeikeRitter

In the episode I enjoyed learning that Content Hub (Preview) contains more connectors/logs that can be ingested into Azure Sentinel. Also 'Next Steps' on the connector page showing what KQL can be used to look for those logs.

UEBA stands for User and Entity Behavior Analytics

[#6]

First of all, it was a great presentation even for me who's been working with Sentinel for a couple of years.

I really liked the MITRE ATT&CK heat map. That's a great addition to the service so we can see where our gaps are.

UEBA is User and Entity Behaviour Analytics.

And I was the one who replied to you on LinkedIn mentioning that a dog person giving away cats for free 😉 Since the Ninja cat was chased by a dog at 18:27 I'd like to adopt one to keep it safe from harm. And as you can see on my avatar, I need a sidekick on our superhero endeavours fighting cybercrime and annoying antagonists on a daily-basis.

[#7]

The new incident page shown is really great. Enjoyed using it since day one. The direct integration of M365D links makes it so much easier and the exposed entities help to get additional UEBA (User and Entity Behavior Analytic) information. Which in my opinion is one of the hidden champions in the products. Have to do an new blog in this especially on how to expose more insights to the analyst

[#8]

For me the best part is the automation rules and playbooks.

UEBA is User and Entity Behavior Analytics 😁👍

[#9]

what was your favorite feature Javier presented?
remediation playbooks for Microsoft 365 Defender with Automation. And the MITRE ATT&CK Preview Overview.
Oh and what does UEBA stand for?
UEBA = User and entity behavior analytics

[#10]

HI Heike,
My favorite feature is the Mitre Attack Table classification. I also like the granular way of integrating Defender 365 in sentinel
And Finally, it is impressive the number of connectors available since 2020. 
UEBA Stands for User and Entity Behavior analytics
Thanks again for these interesting contents

[#11]

😄 hahaha, I am still laughing thinking about that comment! Your answer is perfect, and one cat will be extremely happy to get adopted by you ❤️ check your mailbox here

[#12]

Great show and liked the part of playbooks, always nice to learn new things. Looking forward to next new episodes.

UEBA = User and entity behavior analytics

[#13]

Hey @HeikeRitter 

I love the automation feature - opens up so many possibilities!!

UEBA = User and Entity Behavior Analytics

[#14]

UEBA: User and Entity Behavior Analytics
I like at most the bi-directional sync between M365 Defender and Sentinel. It is great to manage incidents in one system and not in multiple systems.

[#15]

Favourite feature is Analytics rules - the power of detection from simple to most complex incidences is pretty impressive
UEBA - User Entity Behaviour Analytics

[#16]

UEBA stands for User and Entity Behavior Analytics which is a really great feature of Microsoft Sentinel and provides not only amazing anomaly detection analytics rules but also provides some great tables for hunting and enrichment such as the IdentityInfo table. My favorite feature presented was analytics rules.

Such anomaly detection could be used to detect the presence of dogs in the video to provide an early warning to ninja cats before the become dinner 🙂

[#17]

My favorite feature was the Dashboard feature. I think it's very important to be able to visualize data in a way that makes it meaningful for reporting and decision-making. UEBA stands for User and Entity Behavior Analytics.

[#18]

Excellent session with Javier! UEBA is User and Entity Behavior Analytics. I was surprised to see how many Data Connectors exist to pick from in Sentinel, but my favorite feature was the Automation!

[#19]

@HeikeRitter 

• My favorite feature Javier presented- Sentinel being on stop all solution covering SIEM,SOAR and UEBA. How beautifully the integration(through connectors) and automation are present as part of solution with the bi-directional flow among components like SIEM and SOAR
•  UEBA stands for User and Entity Behavior Analytics 

[#20]

EUBA = End User Behaviour Analytics.

My absolute favourite feature which Javier presented? Tough ask. The Case management features have really been a hit in my recent customer presentations, but I have really got in to the power of automations. The Sentinel Triage AssistanT (STAT) on GitHub, and playing around with asking ChatGPT questions from Incidents are particularly impactful.