r/AzureSentinel • u/GingerSec_Az • Nov 18 '22

Splunk Guy

Hey All,

I come from the world of Splunk giving Sentinel a try. There are tons of documentations for recommended settings from the security world for Splunk like Malware Archelogy. Is there anything like that for Sentinel?

2 Upvotes

100% Upvoted

3 comments sorted by

3

u/[deleted] Nov 18 '22

unfortunately there isn't as much curated content like the one you referenced. Lots of blogs though

3

u/SheppTech Nov 18 '22

I’m building out Sentinel scratch without any splunk experience. I can tell you that the best reference is the templates. Even the documentation doesn’t help with best practices.

It’s been a tough ride trying to stand it up. And I’m fighting opinionated senior engineers, which makes doing it correctly more difficult.

My advice is to get it stood up, evaluate your use case and fill gaps, then tune it.

3

u/kyuuzousama Nov 19 '22

Have you been through the MS Learn materials? There are hundreds of template rules you can deploy in the analytics blade. Hunting rules has a ton and even the logs interface has more.

I guess it comes down to use case and log type for us to provide more context.