Making the most of Azure Sentinel

December 3 2021

At a high-level, Azure Sentinel is a SIEM, a security incident event management tool. It can watch your whole network including hybrid devices and on-premises resources. There is a cost associated with Sentinel based on the volume of data ingested for analysis, but its capabilities make it worth the investment.

Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. It uses advanced AI and machine learning algorithms to analyze the logs and tries to detect any threat posed for the system.

I'm very impressed by Sentinel's use of Microsoft AI. Microsoft watches every network of their customers around the world, keeping track of behavior in the aggregate. It then analyzes that data and, based on behavior statistics, it can alert you on specific attacks that may be happening.

With Sentinel, you can take advantage of Microsoft's global security division and take all the information they have gathered and apply it. For example, let's say your network is being attacked. Azure Sentinel can spot the same attack in Brazil and recommend a fix.

About Jeff Christman

Jeff Christman is a Navy Veteran with over 20 years of experience in the IT field. Specializing in cloud migrations, he has worked for companies such as Raytheon, AT&T, and NASA. Currently, he is a Sr. Cloud Security Consultant at a large consulting firm. In addition to his daytime job, he also has published content and courses for Pluralsight.com, Techsnips.io, and Adamtheautomator.com. 

In his off time, he loves fantasy football, everything tech, and embarrassing his teenage daughters.

More about Jeff Christman