Getting Started with Azure Sentinel (part 2 of 4)

By Ashwin Venugopal -

 



To read part 1, please click here
To read part 3, please click here
To read part 4, please click here



Mapping the SOC Architecture

You should always review and implement the following components regularly along with the testing of strength as well as improving any weaknesses for the best result of an SOC platform.

Log management & data sources

First of all you will have to gather and store appropriate log data from the wide range of available services in your IT environment while also considering the following:
  • Variety- You must have data feeds from multiple sources to acquire visibility across the spectrum of the hardware and software in your organization.

  • Volume- Large volume will cost you much more for the analysis and current storage, whereas very low volume may lead you to miss some important breach related events. 

  • Velocity- After processing as well as analyzing data on real-time, you should also store it on real-time as well, which will surely improves performance.

  • Value/Veracity- The data should be of best quality for understanding the meaning as too much noise will hinder investigations.

  • Validity- You should ensure the accuracy as well as source of truth to made correct decisions.

  • Volatility- The data which is rendered useless after some time can be dropped quickly.

  • Vulnerability- The data which is more sensitive than others can be prone to cyber attacks easily if collected and retained carelessly.

  • Visualization- You will have to understand and explain the data information to your audience  which is reporting's key requirement. All this will require some level of visualization.  

Operations Platforms

Nowadays, multiple platforms can carry out their own log collection as well as analysis to make sure threat intelligence and vulnerability scanning. The following solutions can also do the same and report their findings to the SIEM solution for further investigation:
  • Identity & Access Management (IAM)- A modern IAM system includes multiple solutions, can implement multi-factor authentication, and built-in user behavior analytics to detect all the threat risks and all the organizations must use IAM to protect their sensitive systems and services.

  • Endpoint Detection & Response (EDR)- Detection is based on behavior pattern as well as integrated threat intelligence whereas Response can isolate the machine from the network to prevent the further spread of malicious activities while also recording the evidence for forensic analysis as well as access to the investigators remotely.

  • Cloud Access Security Broker (CASB)- A CASB is a vital component in any cloud-based architecture and it can ingest logs from network firewalls as well as proxy servers, and connect with multiple cloud services. It can also offer detection rule templates that can be deployed immediately and can define the custom rules to the infinite as well as unique cases of your organization.

  •  Cloud Workload Protection Platform (CWPP)- It is also called Cloud Security Posture Management (CSPM) as well as offers a unique ability scanning, continually monitoring systems, centralized method for vulnerability scanning and perform regular audits across multiple cloud services along with the centralizing policies and remediation actions. Whenever they are deployed, they can easily detect any potential risk and provide integration point for remediation actions.

  • Next Generation Firewall (NGFW)- It offers all the benefits provided by older firewalls along with the capability of deep packet inspection for the application layer security and integrated intrusion detection/prevention of systems. It can also help in the detection and remediation of possible threats while preventing their spread to other systems.

Threat intelligence & threat hunting

It is an extra advantage provided in log data collection as understanding and showing the data to the audience needs a set of human skills and intelligence of cyber experts so that they can guide the ssytem with their experience and knowledge.




To read part 1, please click here
To read part 3, please click here
To read part 4, please click here




Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more