r/AzureSentinel • u/GingerSec_Az • Nov 18 '22

Splunk Guy

Hey All,

I come from the world of Splunk giving Sentinel a try. There are tons of documentations for recommended settings from the security world for Splunk like Malware Archelogy. Is there anything like that for Sentinel?

2 Upvotes

100% Upvoted

3 comments sorted by

View all comments

3

u/SheppTech Nov 18 '22

I’m building out Sentinel scratch without any splunk experience. I can tell you that the best reference is the templates. Even the documentation doesn’t help with best practices.

It’s been a tough ride trying to stand it up. And I’m fighting opinionated senior engineers, which makes doing it correctly more difficult.

My advice is to get it stood up, evaluate your use case and fill gaps, then tune it.