Preface

• Who this book is for
• What this book covers
• To get the most out of this book
• Download the color images
• Conventions used
• Get in touch
• Share Your Thoughts

1. Section 1: Design and Implementation

2. Chapter 1: Getting Started with Microsoft Sentinel FREE CHAPTER

• The current cloud security landscape
• The cloud security reference framework
• SOC platform components
• Mapping the SOC architecture
• Security solution integrations
• Cloud platform integrations
• Private infrastructure integrations
• Service pricing for Microsoft Sentinel
• Scenario mapping
• Summary
• Questions
• Further reading

3. Chapter 2: Azure Monitor – Introduction to Log Analytics

• Technical requirements
• Introduction to Azure Monitor Log Analytics
• Creating a workspace using the portal
• Creating a workspace using PowerShell or the CLI
• Managing permissions for the workspace
• Enabling Microsoft Sentinel
• Exploring the Microsoft Sentinel Overview page
• Connecting your first data source
• Advanced settings for Log Analytics
• Summary
• Questions
• Further reading

4. Section 2: Data Connectors, Management, and Queries

5. Chapter 3: Managing and Collecting Data

• Choosing data that matters
• Understanding connectors
• Configuring Microsoft Sentinel connectors
• Configuring Log Analytics storage options
• Reviewing alternative storage options
• Summary
• Questions
• Further reading

6. Chapter 4: Integrating Threat Intelligence with Microsoft Sentinel

• Introduction to TI
• Understanding STIX and TAXII
• Choosing the right intel feeds for your needs
• Implementing TI connectors
• Summary
• Questions
• Further reading

7. Chapter 5: Using the Kusto Query Language (KQL)

• Running KQL queries
• Introduction to KQL commands
• Query statements
• Scalar functions
• String operators
• Summary
• Questions
• Further reading

8. Chapter 6: Microsoft Sentinel Logs and Writing Queries

• An introduction to the Microsoft Sentinel Logs page
• Navigating through the Logs page
• Writing a query
• Summary
• Questions
• Further reading

9. Section 3: Security Threat Hunting

10. Chapter 7: Creating Analytic Rules

• An introduction to Microsoft Sentinel Analytics
• Creating an analytic rule
• Managing analytic rules
• Summary
• Questions
• Further reading

11. Chapter 8: Creating and Using Workbooks

• An overview of the Workbooks page
• Walking through an existing workbook
• Creating workbooks
• Editing a workbook
• Managing workbooks
• Workbook step types
• Summary
• Questions
• Further reading

12. Chapter 9: Incident Management

• Using the Microsoft Sentinel Incidents page
• Exploring the full details page
• Investigating an incident
• Summary
• Questions
• Further reading

13. Chapter 10: Configuring and Using Entity Behavior

• Introduction to Microsoft Sentinel Entity behavior
• Enabling Entity behavior
• Overview of the Entity behavior page
• Overview of the Entity behavior details page
• Creating Entity behavior queries
• Summary
• Questions
• Further reading

14. Chapter 11: Threat Hunting in Microsoft Sentinel

• Introducing the Microsoft Sentinel Hunting page
• Working with Microsoft Sentinel hunting queries
• Working with livestream
• Working with bookmarks
• Using Microsoft Sentinel notebooks
• Creating a workspace
• Performing a hunt
• Summary
• Questions
• Further reading

15. Section 4: Integration and Automation

16. Chapter 12: Creating Playbooks and Automation

• Introduction to Microsoft Sentinel playbooks
• Introduction to Microsoft Sentinel Automation
• Adding a new automation rule
• Playbook pricing
• Types of playbooks
• Overview of the Microsoft Sentinel connector
• Exploring the Playbooks tab
• Logic app settings page
• Creating a new playbook
• Using the Logic Apps Designer page
• Creating a simple Microsoft Sentinel playbook
• Summary
• Questions
• Further reading

17. Chapter 13: ServiceNow Integration for Alert and Case Management

• A brief history of Microsoft Sentinel and ServiceNow integration
• Steps to integrate Microsoft Sentinel with ServiceNow
• Summary

18. Section 5: Operational Guidance

19. Chapter 14: Operational Tasks for Microsoft Sentinel

• Dividing SOC duties
• Operational tasks for SOC engineers
• Operational tasks for SOC analysts
• Summary
• Questions

20. Chapter 15: Constant Learning and Community Contribution

• Official resources from Microsoft
• Resources for SOC operations
• Using GitHub
• Specific components and supporting technologies
• Summary

21. Assessments

• Chapter 2
• Chapter 3
• Chapter 4
• Chapter 5
• Chapter 6
• Chapter 7
• Chapter 8
• Chapter 9
• Chapter 10
• Chapter 11
• Chapter 12
• Chapter 14
• Why subscribe?

22. Other Books You May Enjoy

• Packt is searching for authors like you
• Share Your Thoughts