Blogs by Ashwin

  Azure Sentinel Workbooks Several ready for use templates are provided by the Azure Sentinel that can be used to create your own workbook and then modify them as needed for Contoso. Most of the data connectors it uses to ingest data come with their own workbooks, but better insight can be obtained by simply looking into the data that is being ingested by using tables and visualizations, including bar and pie charts. You can also make your own workbook easily by using this data from the beginning instead of using the predefined templates. Workbook Page You can easily access the workbook page from the Azure Sentinel from the navigation pane which consists of the: Workbook header- You can add a new workbook and review the saved workbooks as well as templates that are available on the workbook page. Templates section- You can access existing workbook templates on the Templates tab. You can save some of the workbooks for quick access and they will appear on the My Workbooks tab.  ...

  Plan for threat intelligence connectors Azure Sentinel readily allows you to import the threat indicators your organization uses, which can enhance your security analysts ability to detect and prioritize known threats. Several features from Azure Sentinel then become available or are enhanced are as follows: Analytics includes a set of scheduled rule templates you can enable to generate alerts and incidents based on matches of log events from your threat indicators. Workbooks provide summarized information about the threat indicators imported into Azure Sentinel and any alerts generated from analytics rule that match your threat indicators. Hunting queries allow security investigators to use threat indicators within the context of common hunting scenarios. Notebooks can use threat indicators when you investigate anomalies and hunt for malicious behaviors.    There are two types of Threat Intelligence Connectors- the TAXII Connector and the Threat Intelligence Platforms ...