Video Transcript:
- What if I told you that with just one portal, you can manage your entire multicloud security operation from one place, so you don’t need to jump between a SIEM, Extended Detection Response and Threat Intel systems and it lets you interact with all of your security data using generative AI with Security Copilot. That’s what we’re delivering and that’s what you just saw with the new unified SIEM and XDR experience in the Microsoft Defender portal. And Rob Lefferts is back to tell us all about it.
- Always great to be back as we keep evolving and improving.
- I’m really looking forward to this so tell us how Microsoft Defender then has changed and how it’s evolving.
- So to build on what we’ve covered here on the show through various seasons, we’ve been working towards a unified security operations platform for a while and now it’s here. First, we are extending Microsoft 365 Defender with signals from Defender for Cloud and renaming it to Microsoft Defender XDR. Additionally, we’re bringing in all of Microsoft Sentinel with its vast insights to deliver a truly unified security operations platform. So now, instead of multiple interfaces and data streams that you’d need to learn, navigate, and use to work through your security incidents, we’ve made things much easier. The Microsoft Defender portal provides a single experience to help you coordinate threat detection, prevention, investigation and response. And you get a comprehensive overview of incidents across your digital estate, whether they are related to endpoints, SaaS services, your network in the cloud, or on-prem infrastructure. Additionally, as security events happen, you can disrupt them at machine speed to protect users identities and endpoints, and now even business applications. Which of course takes things a step further in the prevention of data exfiltration.
- Right, in terms of the pain that goes away, these are incidents and activities that might have spanned a few different services like different islands kind of in the past.
- Absolutely. And as a result, SOC teams would need to jump between those islands carrying the context and piecing together the full scope and details of an incident in their heads. Not the most efficient way to carry out an investigation where seconds count. And just to be clear, with Microsoft Defender portal’s unified approach, you won’t be losing any of the functionality you rely on today in each service. You can still jump back into those connected services. It just means that you can now operate within one island when that 360 degree context matters.
- Right, and this really helps when time is of the essence. And plus you’ve got a lot of different time savers, which then leads us to the big news that we announced last March, GPT-based Security Copilot. So, how does that play into Microsoft Defender?
- It gives you a powerful natural language interface over your security data so that you can easily query it and sometimes can catch details that you may have missed. Security Copilot, in fact, has been specifically trained and fine-tuned on cybersecurity. So we’ve evolved the large language model itself and we’ve built an orchestration layer underneath that to find and parse through massive amounts of security data and signals across Microsoft Defender XDR, Microsoft Sentinel, and all of your non-Microsoft connected services completely tailored to your environment and SOC scenarios. Then as you work in Microsoft Defender, Security Copilot is embedded within each Microsoft Defender experience. With all of this training and connected knowledge in the Security Copilot sidebar, each incident automatically gets a generated summary and will even create reports for you. And as you investigate alerts, it can analyze scripts and commands in context as you work. And in Advanced Hunting, you can use natural language to author KQL queries with Security Copilot. Building an AI system like this is something we’re uniquely able to do with our expertise in cybersecurity and in operating large language models.
- Right Rob, I bet you know where this is going. I’d love to see all this working so do you have an example you can show us?
- Sure, I have a great one lined up for you. In this case, we have an active incident with our SAP environment, so it’s business critical and we need to contain it fast. Here, I’m in the new Microsoft Defender portal, which as I mentioned has everything you need from its cloud-based SIEM capabilities, full breakdown of active incidents, complete set of investigation tools with threat intelligence built in, attack story visualizations and more. We see total unique incidents, a unified list across Microsoft Sentinel and Defender XDR insights into data connectors, top risky entities and more. While Defenders used to have two different homepages to go into to get started and determine what to do that day, now they have just one. I can quickly see all of the active attacks in my environment and on my network. And from the data connectors and automation tiles, you can see the extent of our data integration from our SIEM. Let’s dig into the active attacks on my network. This is our new unified incident queue. You can easily see alerts correlated into incidents, and these are prioritized based on machine learning. Now let’s look at this incident on the top. A financial process manipulation on SAP. SAP is a critical ERP and CRM product used by many companies containing both company and employee data, making it a popular target for cyber attacks. But, we see this incident is already tagged with attack disruption, and if you’re new to attack disruption, it automatically intervenes and stops the progression of advanced attacks within Microsoft Defender XDR. And we’ve already had this for Microsoft 365 workloads, but this is new. It’s taking action to disrupt an attack directly on SAP, including protecting the SAP user account.
- Right, and you’ve got all the sentinel information right there in context inside of Defender, but I also see that you’ve also got Jonathan Wolcott and he’s back. So, is he in trouble again?
- Well, he’s had his moments in previous shows, I hope he is okay. Let’s open up this incident and in fact, he’s not okay. As we can see, he has been attacked and attack disruption has already kicked in and things have happened on two fronts. First, Jonathan Wolcott’s AD account has been disabled to get the attacker out of his productivity applications, but his SAP account has also been locked. So the attacker can’t, for example, redirect payment from a business to their own accounts. So being able to disable additional IDs is increasingly important with multi identity stores and many different applications that organizations leverage. By bringing first and third party insights together here, we are getting better coverage and higher confidence that the combined forces of SIEM+XDR automatically take the right actions like this one to defend against advanced attacks. I’m going to need to let our manager and potentially the board know what has happened here. And the good news is that we now have Microsoft Security Copilot reasoning over both Microsoft Sentinel and Defender XDR data right here in the portal to create a summary. Just by clicking this generate an incident report, Copilot gives us a detailed summary of what has happened and why. You see that Jonathan Walcott got a phishing email with a link, which turned out to be a malicious URL, resulting in his credentials being stolen. We even see the IP that was used by the attacker. Now you can easily ship this summary off to a manager, the board, whoever needs to get a heads up about what happened and how it was addressed automatically with your security tools.
- Nice and this really provides a high level recap in terms of what happened. But what else might you do then to find out more or contain that threat?
- One thing you might want to do is find out where any other files accessed from this malicious IP. And the good news is Copilot will guide you to Advanced Hunting to do some research. In this new unified hunting experience, you can look through both Microsoft Sentinel and Defender XDR data. No matter where it’s from, this also means your SAP data, your device events, all your information will be there. Before this as a tier one analyst, hunting using KQL was quite a challenge to me, but now I can use Microsoft Security Copilot to query and return results. And in this case it even figured out what I should be looking for and wrote the prompt for me. And I can continue using natural language prompts or suggested prompts. And in this case it says, “Hey, you should check out were there any successful connections.” And when I do that, you’ll see that they were able to access a few more files but nothing confidential. We were able to stop them before they reached the important stuff. With this, unified advanced hunting, it’s working across Microsoft Sentinel and Defender XDR. So I was able to query everything in one place without having to keep track in my head of where to find what relevant information.
- Right and everything you did there just saved a ton of time in terms of investigation and response. So this is Mechanics again and a lot of implementers are watching. How would I get all this stuff set up?
- So if you’re already on Microsoft Defender E5 and using Microsoft Sentinel, you’ll see this banner displayed in Defender’s Homepage at the top with a button to connect your Microsoft Sentinel Workspace. And when I click on it, it takes me through a simple Wizard process to onboard my workspace. The entire process takes only a few minutes so there’s no complicated onboarding required. And Microsoft Sentinel continues to work in the Azure portal just like usual. It’s pretty easy and brings everything together in one place.
- Which as you showed, makes it a lot easier than to work through your incidents with all the tools and intelligence you need. And it’s right there for you. So for anyone who’s watching right now, looking to get started, what do you recommend?
- Well that’s easy. If you’re already using Microsoft Sentinel and Microsoft Defender XDR as we just showed, it’s super simple to get everything up and running. And you can find out more at aka.ms/SOCPlatform and join our private preview, we’d love to hear from you.
- Thanks again, Rob, for joining us today.
- Thank you.
- And it’s great to see the unified experience there with Defender and all things you’re doing and also Security Copilot. And by the way, for deeper dives like this in the latest tech, be sure to subscribe to Microsoft Mechanics. Thanks for watching, we’ll see you next time.
