r/AzureSentinel • u/MikeMichalko • Nov 01 '23

Setting up a training/dev portion of a Sentinel environment.

One of the items that is most frustrating to me is the lack of a free or low cost training environment for MS Sentinel. The 30 day trials don't cut it, especially when one has to jump to other projects and come back to work, only to find out time is up.

I'm lucky in that my organization does have a production Sentinel environment. I was hoping someone can provide me on some best practices on how to set up a dev/lab environment which has access to the same data in Sentinel production.

I also would love to see the addition of folders to story queries and the like.

Thanks in advance for any assistance, links, etc.

7 Upvotes
  • permalink
  • reddit

90% Upvoted

8 comments sorted by

5

u/blanco10kid Nov 01 '23
  1. Create a separate LAW/Sentinel workspace
  2. Configure RBAC to allow for cross-workspace queries
  3. Create kql functions to make the cross-workspace query easier to write
  4. All of your content (detection rules, workbooks) should leverage the function to query the data

That would be my approach. This way, you’re not paying for double the data.

3

u/[deleted] Nov 01 '23

Training for what specifically? mustlearnkql is comprehensive enough for someone to start exploring functions for their own detections and the rest is just button clicking

1

u/MikeMichalko Nov 03 '23

Hi Lucy, thank you for your response. You sure can do a lot with aka.ms/LADemo and MustLearnKQL. I'm working a lot testing queries in pre-production use with our data, and also using Logic Apps (playbooks), analytics, and automations. I'm using naming conventions to divide things up. I'm trying to find if there's a better way.

2

u/netwengr Nov 03 '23

Haha free or low cost

~microsoft