Cyber Security Resources | CyberOne

Microsoft Azure Sentinel - The CyberOne Guide

Written by Mark Terry | Mar 23, 2022 10:09:00 PM

In a world of increasingly sophisticated and harder-to-detect cyberattacks, the challenges for information security leaders continue to grow.

Digital transformation continues to reshape IT. Information security leaders face growing complexity, diverse attack surfaces, and an increasing number of alerts that are multiplying by orders of magnitude. Cyberattacks are increasingly sophisticated and difficult to detect,  all within the context of exponential growth in data volume. At the same time, IT teams must find ways to make systems and processes more efficient while controlling costs and managing resources effectively.

Security Information and Event Management (SIEM) solutions built for yesterday’s environments struggle to keep pace with today’s challenges, let alone tomorrow’s unknown risks. Costly to operate and slow to scale, resource-heavy SIEM infrastructure and tools can easily become obstacles to digital transformation. Ever-growing volumes of data strain the limits of on-premises systems. Managing and staffing those same systems creates a huge operational burden that takes time away from strategic activities. Alert fatigue is reaching all-time highs, and traditional approaches can’t handle the pace of change, with IT departments having limited funds to address the problem.

A Next Generation SIEM solution

In response to these challenges, CyberOne is proud to partner with Microsoft, with Azure Sentinel at the heart of our Cyber Defence Centre, the UK’s most advanced Security Operations Centre (SOC) service, holding Microsoft Security Solution Partner status.

Built on Microsoft Azure, a leading public cloud platform, Azure Sentinel eliminates the complexity of infrastructure and management. It scales readily to meet dynamic needs and maximises your SOC provider’s skills with intelligent, role-based tools, empowering you with insights from Microsoft’s extensive, multi-billion-dollar global security operations.

  • Collect data at cloud scale – across all users, devices, applications and infrastructure, both on-premises and in multiple clouds.
  • Detect previously uncovered threats and minimise false positives using analytics and unparalleled threat intelligence from Microsoft.
  • Proactively hunt for threats that security apps may not have discovered.
  • Investigate threats with AI and proactively hunt suspicious activities at scale, leveraging decades of cyber security expertise at Microsoft.
  • Respond to incidents rapidly with built-in orchestration and automation of common tasks.

Why Microsoft Azure Sentinel?

Build on Microsoft’s Investment

In security, knowledge and scale are power. With Azure Sentinel, you gain the power of Microsoft’s decades of experience managing security at a massive global scale. Microsoft solutions share insights gained from unparalleled threat intelligence, informed by analysing trillions of signals every day. Their security experts support proactive threat hunting with prebuilt queries based on years of security experience.

Improve Threat Protection With AI on Your Side

Intelligent correlation helps reduce false positives and alert fatigue by up to 90%, enabling the detection of complex, multi-stage attacks. Built-in intelligence helps automate and orchestrate up to 80% of common tasks, simplifying operations and enabling your Security Operations Centre (SOC) team to respond more quickly to threats.

Integrate With and Secure Your Entire Enterprise

Allow your SOC provider to integrate with existing tools, whether business applications, other security products, or home-grown software—analyse data from users, applications, and infrastructure, both on-premises and multi-cloud. Azure Sentinel helps your SOC provider get started fast and grow with your business as needed, with a broad range of connectors and industry-standard data formats.

Invest in Cloud Security, Not Servers.

Powered by the Microsoft cloud platform, Azure Sentinel delivers near-limitless speed and scale without the operational complexity and overhead typically associated with a server-based SIEM. Proven, scalable log analytics provides insights to your SOC provider in seconds. That means lower costs, greater agility, and more time for them to focus on real security issues.

Store and Analyse Massive Amounts of Data in Seconds

Azure Sentinel is built on the highly scalable, high-performance Azure Monitor Log Analytics platform, designed to store and analyse massive amounts of data in seconds. It enables your SOC provider to combine data from multiple tables, aggregate large datasets, and perform complex operations with minimal code, answering questions at speed.

Free Storage & Analysis for Microsoft 365 Data

To help you maximise security effectiveness across your enterprise, Azure Sentinel pulls in data from your entire Microsoft estate for analysis at no additional charge. This provides a significant cost savings over third-party SIEMS, which charge you for each piece of data they ingest.

Business Benefits of Microsoft Azure Sentinel – Forrester Research*

  • Reduced management effort by 56% with a platform delivered in the cloud.
  • 67% reduction in time to deployment with out-of-the-box functionality.
  • Costs 48% lower than the legacy SIEM deployment with flexible, consumption-based pricing.
  • Prebuilt connections to many applications, improving data ingestion, visibility and overall coverage.
  • Improved response times by up to 50% with advanced AI and threat intel to spot suspicious event sequences.
  • Capital investment avoided for storing logs on-premises.
  • Automation of many of the administrative tasks traditionally performed by SOC analysts.

* “The Total Impact of Microsoft Azure Sentinel”, Forrester Consulting, November 2020

Serving The 5 Key Aspects of Security Operations

1. Collection

Azure Sentinel includes connectors providing real-time integration with many industry solutions. It enables easy connections to a variety of Microsoft services, including Office 365, Azure Active Directory, Azure Advanced Threat Protection, and Microsoft Cloud App Security. Data can also be collected from existing security solutions, such as firewalls, routers, endpoint security, and many more, using built-in connectors. Additionally, your SOC provider can utilise Common Event Format (CEF), Syslog, or REST API to connect any compliant data source to Azure Sentinel.
After your data sources are connected, your data begins streaming into Azure Sentinel and is ready for your Security Operations Centre (SOC) provider to use.

2. Detection

Enable your SOC provider to detect previously uncovered threats and minimise false positives using analytics and unparalleled threat intelligence from Microsoft.
After your data sources are connected to Azure Sentinel, the next step is to identify suspicious activities and threats. Azure Sentinel provides built-in templates to enable your SOC provider to do this and get notified of such threats. These templates were designed by Microsoft’s team of security experts and analysts based on known threats, common attack vectors and suspicious activity escalation chains. After you enable these templates, they will automatically search for suspicious activity across your environment. Many of these can be customised to search for or filter out activities according to your needs.

3. Hunting

Analysts must proactively look for threats that security applications may not have detected. Azure Sentinel includes built-in hunting queries that guide your SOC provider to ask the right questions to find previously undiscovered threats.

With Azure Sentinel hunting, your SOC provider can take advantage of the following capabilities:

  • Built-in hunting queries: Developed and fine-tuned by Microsoft security researchers and the GitHub community continuously to provide an entry point and help start hunting for the beginnings of new attacks.
  • Powerful query language with IntelliSense: Built on top of a query language, this gives the flexibility to take hunting to the next level.
  • Create your bookmarks: Save items for later to create an incident for investigation. Bookmark a row, promote it to an incident and investigate with an investigation graph.
  • Use notebooks to automate investigation: Notebooks encapsulate all the hunting steps in a reusable playbook.
  • Query the stored data: The data is accessible in tables for querying, such as process creation, DNS events, and many other event types.
  • Links to the community: Leverage the power of the broader community to discover additional queries and data sources.

4. Investigation

Investigate Threats With AI

An incident is an aggregation of all the relevant evidence for a specific investigation. Incidents are created based on alerts that your Security Operations Centre (SOC) provider defines on the Analytics page. The properties related to the alerts, such as severity and status, are set at the incident level. Your SOC provider can now more easily investigate the detected threats and the entire incident, quickly view the status of each incident and manage the full life cycle of this event.

5. Response

Respond to Incidents Rapidly With Built-in Orchestration and Automation of Common Tasks

A security playbook is a collection of procedures that orchestrate a response to a threat. Playbooks can run manually or automatically. Security playbooks in Azure Sentinel are based on Azure Logic Apps, providing built-in, customisable templates. For example, suppose you’re concerned about malicious attackers accessing your network resources. In that case, an alert can be set that detects malicious IP addresses attempting to access your network and triggers a playbook to stop the attack in real-time.

Why CyberOne for Microsoft Azure Sentinel?

Reduce Costs & Enhance Productivity.

CDC works on a flexible consumption-based pay-monthly subscription model, so you don’t pay for any unused capacity. You no longer need to make significant up-front investments in technology, training or resources, with your in-house team free to focus on core objectives. The pricing plan is clear, simple and with nothing hidden.

Threat Hunting

CDC includes ongoing, proactive threat hunting, which many competitors charge for. We proactively search for cyber threats that lie undetected within your network, that could be actively stealing data from right under your nose. This threat hunting service illuminates undetected attacks, enabling a faster response.

Service Reviews

Customer service reviews are regularly carried out to monitor both contract and technology performance. We implement a Continuous Service Improvement Plan for all our contracts to ensure you’re getting the best out of the solution and that we’re keeping pace with your business requirements.

Microsoft Solution Partner

CyberOne, through our Cyber Defence Centre (CDC), is the UK’s premier Microsoft Azure Sentinel SOC partner. We have a single-platform focus,  so our expertise is unparalleled.

Dedicated Team

Our experts manage all aspects of threat prevention, detection, analysis and response, taking the tools we deploy well beyond out-of-the-box capabilities. We establish clear and strong lines of communication to act as an extension of your in-house team. Through continuous measuring against strict performance criteria, we ensure the highest levels of Service are maintained over the long term.

24x7x365 Service

Many competitors pay lip service to “24x7x365”. We live and breathe it. If an issue occurs, your team will investigate it immediately, using Azure Sentinel and initiating rapid-response escalation procedures as necessary. We are watching over you at all times and never rest until all issues are resolved.

Scalability

CDC is a flexible solution that can be easily scaled and adjusted in line with your changing business needs and the ever-evolving demands of the cyber security landscape. Our team has the breadth to scale and respond rapidly.

“With Azure Sentinel, the false positive rate has dramatically improved, and we’re now down to responding within minutes, whereas with our legacy solution, our average response time was eight hours.”
- CISO, eCommerce / Fashion Industry.

“Azure Sentinel addresses all the foundational SIEM use cases. It addresses data aggregation at scale horizontally forever, and the proof is in the pudding. How do you go from 50 gigabytes to 8.5 terabytes a day in six months? The answer is with Azure Sentinel.”
- Senior VP of Global Threat Management, Financial Services Industry.

“There is no more downtime with Azure Sentinel. It’s never blinked. It’s never gone down, and when we hit a certain capacity, Microsoft gave us our dedicated cluster,  and the performance improved.”
- Senior VP of Global Threat Management, Financial Services Industry.

“Whether they are Tier 1, 2, or 3, the key is that everyone is working out of a single console. They can view, triage, and act upon alerts and incidents from their single pane of glass, and perform more advanced hunting work. There is an efficiency there.”
- Senior Director of Security Technology & Operations, IT Services Industry