The basics

Question 1

What is Azure Sentinel?

Answer 1

A cloud-native SIEM (Security Information and Event Management) platform provided by Microsoft.

Question 2

How does Azure Sentinel work?

Answer 2

It uses AI to analyse data from your entire environment, helping you detect and respond to threats.

Question 3

What can I use Azure Sentinel for?

Answer 3

• Centralized security monitoring: Collect data from all sources (on-premises, cloud, devices) and get a unified view of your security posture.
• Threat detection and investigation: Leverage built-in AI and threat intelligence to identify suspicious activity and quickly investigate potential threats.
• Proactive threat hunting: Uncover hidden threats and vulnerabilities before they cause damage.
• Automated response and remediation: Orchestrate actions to contain threats and minimize impact.
• Compliance reporting and auditing: Meet security regulations and track your security posture over time.

Question 4

How do threats look in Azure Sentinel?

Answer 4

• Suspicious events: Unusual login attempts, high data transfers, malware detections, etc.
• Anomalies: Deviations from normal user or device behaviour, identified by AI.
• Correlated events: Seemingly unrelated events that, when combined, point to a potential threat.
• Indicators of compromise (IOCs): Known malicious signatures or patterns associated with specific threats.
• Threat intelligence feeds: Updated information about the latest threats and vulnerabilities.

Question 5

What are some key features of Azure Sentinel?

Answer 5

• Cloud-native: Scalable and elastic, no need for on-premises infrastructure.
• Built-in AI: Reduces false positives and improves threat detection accuracy.
• Rich threat intelligence: Access to Microsoft’s vast security expertise and real-time threat data.
• Open and extensible: Integrates with other security tools and services.
• Cost-effective: Pay-as-you-go pricing based on data ingestion and storage.

Question 6

What are the four pillars of Azure Sentinel?

Answer 6

Collect, detect, investigate, and respond

Question 7

What is the query language used by Azure Sentinel?

Answer 7

Kusto Query Language (KQL)

Question 8

How do you onboard Azure Sentinel to a Log Analytics workspace?

Answer 8

Search for Microsoft Sentinel and click “create”, then add Sentinel to the workspace or create a new one

Question 9

How do you deploy data connectors to start logging data from various sources?

Answer 9

On Sentinel’s GUI, select Data connectors, then click the connector you want to use and follow the instructions

Question 10

How does Azure Sentinel use AI to investigate threats and reduce false positives?

Answer 10

Azure Sentinel uses machine learning and knowledge based on analysing “trillions” of signals daily to correlate and prioritize alerts, and to provide guided investigation and hunting queries

Question 11

How do you respond to incidents rapidly with Azure Sentinel?

Answer 11

You can use built-in orchestration and automation of common tasks by using playbooks, which are based on Azure Logic Apps

Question 12

What are some of the data sources that Azure Sentinel can collect data from?

Answer 12

Azure, on-premises, and other cloud platforms, with built-in or custom connectors.

Question 13

How does Azure Sentinel detect threats and minimize false positives?

Answer 13

It uses advanced analytics, machine learning, and threat intelligence.

Question 14

How does Azure Sentinel investigate and hunt for suspicious activities?

Answer 14

It uses AI and interactive dashboards to investigate and hunt at scale.

Question 15

How does Azure Sentinel respond to incidents quickly and efficiently?

Answer 15

It uses built-in or custom playbooks to automate and orchestrate tasks.

Question 16

What are the benefits of using a cloud-native SIEM solution like Azure Sentinel?

Answer 16

A cloud-native SIEM solution like Azure Sentinel eliminates the need for infrastructure setup and maintenance, scales to meet the security needs, and reduces costs compared to legacy SIEMs.

Question 17

What are some of the Azure services that Microsoft Sentinel natively incorporates?

Answer 17

Microsoft Sentinel natively incorporates Azure services like Log Analytics and Logic Apps.

Question 18

How does Microsoft Sentinel enrich the investigation and detection with AI?

Answer 18

Microsoft Sentinel provides Microsoft’s threat intelligence stream and enables you to bring your own threat intelligence. It also uses machine learning to reduce noise and false positives.

Question 19

What is Azure Sentinel?

Answer 19

A cloud-native product that handles security data and threats.

Question 20

How does Azure Sentinel integrate data sources?

Answer 20

It connects with Microsoft and third-party solutions, supports common formats and API, and lets users add their own intelligence and data.

Question 21

How does Azure Sentinel detect threats?

Answer 21

It uses templates and rules, creates incidents from alerts, shows a visual graph of the kill chain, and lets users hunt and analyse threats.

Question 22

How does Azure Sentinel respond to threats?

Answer 22

It uses playbooks based on Logic Apps to automate or trigger responses, works with Microsoft and third-party tools, and gives examples of playbooks.

Question 23

How does Azure Sentinel use advanced capabilities?

Answer 23

It uses behavioural analytics to find anomalies and impact, uses notebooks to apply machine learning and analytics, and uses watch lists to create lists based on external data.

Question 24

How does Azure Sentinel use metrics and reporting?

Answer 24

It uses workbook to show metrics, uses Power BI to create dashboards and reports, and shares insights and practices with GitHub.

Question 25

What are the two main capabilities of Microsoft Sentinel?

Answer 25

Security information and event management (SIEM) and security orchestration, automation, and response (SOAR).

Question 26

What are some of the sources of security data that Microsoft Sentinel can collect and analyse?

Answer 26

Azure, on-premises, and other clouds.

Question 27

What are some of the tools that Microsoft Sentinel uses to detect and investigate threats?

Answer 27

Built-in analytics, artificial intelligence, and threat intelligence from Microsoft.

Question 28

What are some of the common security tasks that Microsoft Sentinel can automate and orchestrate using playbooks and logic apps?

Answer 28

Alert triage, incident response, threat hunting, etc.

Question 29

What are some of the threats that Microsoft Sentinel can help you identify and mitigate?

Answer 29

Advanced persistent threats (APTs), ransomware attacks, phishing campaigns, etc.

Question 30

How are threats represented in Microsoft Sentinel?

Answer 30

Alerts and incidents. Alerts are notifications of suspicious or malicious activities that require further investigation. Incidents are collections of related alerts that indicate a potential breach or compromise.

Question 31

How can you view and manage alerts and incidents in Microsoft Sentinel?

Answer 31

In the Microsoft Sentinel portal, where you can also access interactive reports, dashboards, and hunting tools.