Microsoft Sentinel Cheat Sheet

• A cloud-native SIEM and SOAR solution.
• It offers a birds-eye view across your enterprise.
• Sentinel is an intelligent security analytics and threat intelligence service that provides alert detection, threat visibility, proactive hunting, and threat response.
• Data connection methods in Sentinel: Service to service integration, External solutions via API, and External solutions via an agent.
  • You can now ingest critical security logs without installing the Log Analytics agent, simplifying setup and management with Agentless Collection for Microsoft 365 and Azure AD logs (Generally Available).
  • New & Updated Data Connectors: Key additions include deeper integration with Microsoft Defender XDR and Defender for Cloud, plus connectors for major third-party tools like CrowdStrike Falcon, Zscaler, and Palo Alto Networks.
  • Data Collection Rules (DCR) & Cost Management: Sentinel now uses Azure Monitor Data Collection Rules (DCRs) as the primary method for configuring data ingestion. This change enables more granular cost allocation through Azure Cost Management tags.
• Microsoft Sentinel roles: Reader, Responder, and Contributor.

Threat Management

• Sentinel provides the following features: Collect, Detect, Investigate, and Respond.
• Quickly gain insights across your data with Azure Sentinel Workbooks.
• Investigate and resolve possible threats with incidents (groups of related alerts).
• You can automate tasks and simplify security orchestration using playbooks.
• Sentinel provides deep investigation tools to find the root cause of a potential security threat.
• Hunting allows you to find issues in your data.
• AI-assisted investigation, hunting, and response (Public Preview).
• Entity Behavior Analytics (UEBA) to detect anomalous user and device activity.

Pricing

• You are charged for all data ingested into the Log Analytics workspace. The first 90 days of retention for this data is included in the ingestion cost. Data retained beyond 90 days incurs an additional monthly retention charge.
• You are charged for the ingested data (per GB).

Microsoft Defender for Cloud vs Microsoft Sentinel:
https://tutorialsdojo.com/azure-security-center-vs-azure-sentinel/

What is Microsoft Sentinel and Why You Should Care

Want to learn more about Azure? Watch the official Microsoft Azure YouTube channel’s video series called Azure Tips and Tricks.

Microsoft Sentinel Cheat Sheet References:

https://docs.microsoft.com/en-us/azure/sentinel/overview
https://azure.microsoft.com/en-in/services/microsoft-sentinel/