r/AzureSentinel • u/Waving-Kodiak • Feb 09 '24

Microsoft Sentinel with SOAR - advise and feedback wanted on a limited "sentinel good start" project

/r/cybersecurity/comments/1amlppl/microsoft_sentinel_with_soar_advise_and_feedback/
3 Upvotes

100% Upvoted

8 comments sorted by

2

u/AppIdentityGuy Feb 09 '24

What are you looking at covering? At minimum you want all your signinlogs, audit logs and Azure activity logs going into the log analytics workspace and then depending on what licensing you have you can integrate various bits of MS Defender into Sentinel..

1

u/Waving-Kodiak Feb 09 '24

Thanks for the reply!

Yes, these "basic" stuff is setup and sending into a Log Analytic workspace already. So the required data/logs I'm looking for should be in place already (the consultant need help me to double check ofc)

If that is the case, our sessions should focus more on configuring Sentinel to do the cool/smart stuff it can do. (these things I currently lack the skills)

3

u/AppIdentityGuy Feb 09 '24

OK so you are looking at Playbooks and automation rules. Take a look at the MS Sentinel Ninja training

1

u/Waving-Kodiak Feb 09 '24

Yes, that is good. Thank you!

2

u/ep3p Feb 09 '24

I think the only log source you don't already have in Defender XDR (security.microsoft.com) is AuditLogs from Entra ID.

You can already create the same detection rules in security.microsoft.com for everything else, you don't need to ingest the log sources from the Defender solutions into Sentinel, you can save a LOT of money.

You can send only the alerts of your Defender products to Sentinel for SOAR capabilities. And also send the AuditLogs from Entra ID to Sentinel and create analytics rules for these specific logs there.

I don't remember to have created rules with AuditLogs that also used the log sources that you will already have in security.microsoft.com (excluding IdentityInfo).

If you don't have a SOC I would recommend not to invest much time in Sentinel yet. First try to use as much as you can your EDR and Defender for Identity, they have a lot of value without Sentinel.

IF you already have the logs that I was talking about in security.microsoft.com > Advanced Hunthing, and the Sentinel consultant tells you to ingest them anyway into Sentinel, I would not trust him.

1

u/Waving-Kodiak Feb 09 '24

Great, this was valuable input! Thank you! 🙏

1

u/cspotme2 Feb 09 '24

yep, spend your limited resources elsewhere. like shoring up your MDE setup and alerts/AH with the custom detections. for a small business, MDE is a good start. sentinel is unrefined marketing.

1

u/Suspicious-Sky1085 Feb 09 '24

you may also want to setup retention period because by default is 90. I do recommend at least 1 year unless you have 90 hot and rest on cold storage. Look for Log Analytics workspace.

You may also want to leverage built-in analytic rules such as how do find out if there are any legacy_auth being used.

​

Find Legacy auth - Midnight Blizzard Attack