Collect, normalize, and analyze security information from multiple data sources
Integrate AI, machine learning, built-in and custom threat analyses, and automation to build optimal security solutions
Detect and investigate possible security breaches to tackle complex and advanced cyber threats

Description

Microsoft Sentinel is a security information and event management (SIEM) tool developed by Microsoft that helps you integrate cloud security and artificial intelligence (AI). This book will teach you how to implement Microsoft Sentinel and understand how it can help detect security incidents in your environment with integrated AI, threat analysis, and built-in and community-driven logic. The first part of this book will introduce you to Microsoft Sentinel and Log Analytics, then move on to understanding data collection and management, as well as how to create effective Microsoft Sentinel queries to detect anomalous behaviors and activity patterns. The next part will focus on useful features, such as entity behavior analytics and Microsoft Sentinel playbooks, along with exploring the new bi-directional connector for ServiceNow. In the next part, you’ll be learning how to develop solutions that automate responses needed to handle security incidents and find out more about the latest developments in security, techniques to enhance your cloud security architecture, and explore how you can contribute to the security community. By the end of this book, you’ll have learned how to implement Microsoft Sentinel to fit your needs and protect your environment from cyber threats and other security issues.

Who is this book for?

You’ll get the most out of this book if you have a good grasp on other Microsoft security products and Azure, and are now looking to expand your knowledge to incorporate Microsoft Sentinel. Security experts who use an alternative SIEM tool and want to adopt Microsoft Sentinel as an additional or a replacement service will also find this book useful.

What you will learn

Implement Log Analytics and enable Microsoft Sentinel and data ingestion from multiple sources
Tackle Kusto Query Language (KQL) coding
Discover how to carry out threat hunting activities in Microsoft Sentinel
Connect Microsoft Sentinel to ServiceNow for automated ticketing
Find out how to detect threats and create automated responses for immediate resolution
Use triggers and actions with Microsoft Sentinel playbooks to perform automations

What do you get with eBook?