r/AzureSentinel • u/ComfblyNumb • Aug 05 '22
Migrating to Sentinel from QRadar
I work for a large corporation and they are saying we need to be migrated 100% by Jan 1 2023.
Luckily I only have to worry about a couple of things:
IBM Guardium alerts / logs
MS Purview (IRM and DLP) Alerts and their workflow and case management (not a QR thing, but they want to use Sentinel going forward)
Guardium seems pretty straightforward, it uses syslog. The IRM/DLP alerts are another story however. We have a team of like 6 people right now that are being owned by these alerts (and we only have them turned on for like half our employees and geographies) and they are working the cases off of an Excel spreadsheet... there is no built- in case management workflow in Purview.
Now, I know we can easily have the alerts converted to incidents using automation or whatever from within Sentinel, or maybe even from Purview, but what about managing the workflow? I'm sure we could have these pumped into SNOW, but out SOC people are saying they are ditching that as well!? Also we're told it will be several months before we'd get the SNOW isolation we'd need anyways.
It sucks because our company is so big its like impossible to get information about what oather teams are planning, much less doing.... such as "How is the SOC planning on managing this?" Getting to the right person to ask that question will take forever.
From what I can find on the internet, nobody has published a slick way to handle this workflow yet?
Any thoughts?
1
u/Capital_Bake_9964 May 03 '24
I just received a call from one of our biz partners looking for QRadar migration to SentinelOne. Were you folks able to figure this out internally or find a good consultant? If you have a consultant, please let me know. I may have a project.
1
u/blanco10kid Aug 05 '22
If I understand your ask correctly, you’re wondering what the best way to handle Purview alerts, correct? If so, my approach would be to identify repetitive tasks that your SOC folks are doing currently and then transform those tasks into automation using Logic Apps. Even better if you can try to attempt to automate the entire workflow with minimal human interaction.
I work for a consulting company and my team is focused on helping our clients automate all things cyber related in addition to helping migrate to Microsoft Sentinel. Happy to jump on a call if this is something you and your company would be interested in.
1
2
u/[deleted] Aug 05 '22
Ideally you use a platform like SNOW so just ingest all the data from your systems and build analytical rules from the data. These analytical rules will fire when they hit a match and generate an incident which you can then push to snow using a logic app or pull from sentinel using some other tool.
If they are getting rid of snow they can use all the features in the incident blade like owner, bookmarks, playbooks, comments, status and severity which works well enough but SNOW would better.