Find out what sets apart Microsoft's new SIEM tool (Azure Sentinel) from the rest of the solutions in the marketplace. Take a deeper look at Threat Hunting within Azure Sentinel and five features that make Sentinel an effective tool for security teams rather they use Azure or not.

As far as data breaches go, 2019 is shaping up to be a landmark year based on the findings of the 2019 MidYear QuickView report published by Risk Based Security.

According to the report, breaches in 2019 were 52% higher than what was recorded in 2018 and the year is still not over. The success of these cyber-attacks has been attributed to the Internet of Things (IoT), inexperienced staff, integration of cloud services, and the ever-changing cyberattack landscape. The latter reasons were why Microsoft announced the launch of its Azure Sentinel cloud-based Security Information and Event Management (SIEM) solution.

Azure Sentinel is touted as an intelligent security analytics cloud-based SIEM for enterprises. As expected, the statement raised questions on how different Azure Sentinel SIEM is from the more well-known security solutions such as Splunk, LogRhythm, RSA NetWitness and IBM QRadar; let alone Microsoft’s very own Azure Security Center (ASC). One Sentinel's core differences - Threat hunting.

Threat Hunting with Azure Sentinel

First and foremost, Azure Sentinel allows enterprises to bring in all security events across a hybrid infrastructure into its cloud-based service environment. This means that Sentinel is more of a "SIEM as a Service" tool in its true sense. It also highlights the fact that enterprises will have a deeper insight into security events compared to using other software information and event management (SIEM) competitors.

With Azure Sentinel, predictive analytics when hunting threats is taken to a new level. Security events can be found and analyzed before they occur. Thus, Azure Sentinel takes a more proactive approach to identifying threats than the more reactive nature of Azure Security Center. An example of how Sentinel accomplishes this feat can be seen from considering a vmExtension deployment within a workspace and a procStart event with a defined command and control Uniform Resource Identifier (URI). While ASC may not raise an alarm about the vmExtension, Azure Sentinel can be taught to correlate the difference between both processes and show the responders the exact entry point of the vmExtension.

In the above scenario, Azure Sentinel can highlight malicious deployments and kill these processes in real-time. This eliminates the effort that comes with manually viewing every process until the malware deployed via an extension is discovered.

Features of Azure Sentinel

Listed below are five features that ensure Azure Sentinel stands out from the crowd as a proactive SIEM solution:

• Cloud-scale Data Collection – As stated earlier, Azure Sentinel can be deployed for hybrid infrastructure including multi-cloud environments, interconnected devices, and applications. This feature makes it an excellent threat finder for enterprises across diverse industries.
• Intelligent Built-in Queries – The first feature highlighted here, shows Microsoft’s intent for Sentinel to be used in manufacturing, automation, smart facilities etc. Its numerous built-in queries provide non-technical or non-security experts with an easy way to review common attacks.
• Native Integration with AWS – With AWS owning approximately 40% of the cloud computing and web service market, integrating Sentinel with AWS is a masterstroke from Microsoft. This allows AWS-powered ecosystems to make use of Sentinel.
• Using Bookmarks To Hunt Threats – Sentinel simplifies the process of threat hunting by providing the ability to bookmark suspicious events for future referencing or investigations. Microsoft also intends to ensure HuntingBookmark can be used to visualize data straight from the bookmark tab and promote it to an incident.
• Rapid Response to Incidents – The AI aspect of Sentinel makes it a rapid responder to threat incidents. It also supports the use of open-source applications such as the Jupyter notebook to hunt for threats and orchestrate responses.

Is Azure Sentinel for Your Enterprise?

If your enterprise makes use of on-premise, hybrid or multi-cloud, and interconnected infrastructure; then Azure Sentinel may be the new intelligent, connected SEIM tool you’ve been looking for. Its versatile features can play a huge role in reducing the effort, alert volume and reactive processes that currently dominates the cybersecurity space.

Read more on Azure Sentinel on our website. We are a Microsoft partner and are versed at deploying and managing Microsoft Azure Sentinel for companies of varying sizes. We can help consult you on whether or not Azure Sentinel is the correct solution for your business.

Learn more about how Azure Sentinel can secure your IT infrastructure.