{"id":44088,"date":"2024-07-24T12:19:46","date_gmt":"2024-07-24T10:19:46","guid":{"rendered":"https:\/\/www.schneider.systems\/?p=44088"},"modified":"2024-07-25T09:47:12","modified_gmt":"2024-07-25T07:47:12","slug":"microsoft-sentinel-advanced-security-analytics-and-threat-intelligence","status":"publish","type":"post","link":"https:\/\/www.schneider.systems\/lu\/microsoft-sentinel-advanced-security-analytics-and-threat-intelligence\/","title":{"rendered":"Microsoft Sentinel: Advanced security analytics and threat intelligence"},"content":{"rendered":"<p style=\"text-align: justify;\">Effective July 11, 2024, <strong>Microsoft Sentinel is generally available<\/strong> as <strong>part of the unified security operations platform<\/strong>. This integration aims to <strong>streamline security operations<\/strong> by <strong>combining various tools into a single platform<\/strong>.<\/p>\n<p style=\"text-align: justify;\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-44089 aligncenter\" src=\"https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Website-Microsoft-Sentinel.png\" alt=\"\" width=\"800\" height=\"514\" srcset=\"https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Website-Microsoft-Sentinel.png 800w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Website-Microsoft-Sentinel-300x193.png 300w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Website-Microsoft-Sentinel-150x96.png 150w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Website-Microsoft-Sentinel-768x493.png 768w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: justify;\"><strong>What is the Microsoft Unified Security Operations Platform?<\/strong><\/h2>\n<p style=\"text-align: justify;\">The <strong>Microsoft Unified Security Operations Platform<\/strong> is a comprehensive solution designed to <strong>enhance the efficiency and effectiveness of security operations centers<\/strong> (SOCs). It <strong>integrates several key <a href=\"https:\/\/www.schneider.systems\/lu\/microsoft-security-solutions-network-and-information-security-directive-nis2\/\">Microsoft security<\/a> tools<\/strong> <strong>into a single platform<\/strong>, including:<\/p>\n<ul style=\"text-align: justify;\">\n<li><strong>Microsoft Sentinel<\/strong>: A cloud-native security information and event management (SIEM) solution that provides extensive visibility into the threat landscape.<\/li>\n<li><strong>Microsoft Defender XDR<\/strong>: An extended detection and response (XDR) platform that offers unified visibility, investigation, and response across various environments such as endpoints, identities, emails, and cloud apps.<\/li>\n<li><strong>Microsoft <a href=\"https:\/\/www.schneider.systems\/lu\/microsoft-security-copilot-release-date-and-features\/\">Copilot for Security<\/a><\/strong>: An AI-powered assistant that helps security teams with threat detection, investigation, and response by leveraging advanced generative AI. It includes <a href=\"https:\/\/www.schneider.systems\/lu\/microsoft-365-copilot-the-future-of-productivity\/\">Microsoft 365 Copilot<\/a>.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: justify;\"><strong>What is Microsoft Sentinel?<\/strong><\/h2>\n<p style=\"text-align: justify;\"><strong>Microsoft Sentinel<\/strong> is a <strong>cloud-native security information and event management<\/strong> (SIEM) <strong>solution<\/strong>. It offers <strong>advanced security analytics<\/strong> and <strong>threat intelligence<\/strong> across the enterprise. It is accessible in the <strong><a href=\"https:\/\/www.schneider.systems\/lu\/microsoft-azure-licensing-full-guide\/\">Microsoft Azure<\/a> portal<\/strong> and the <strong>Microsoft Defender portal<\/strong>. By <strong>integrating with Microsoft Defender<\/strong>, it provides a <strong>unified experience<\/strong> for <strong>managing security incidents<\/strong> and <strong>hunting cyberthreats<\/strong>. Microsoft Sentinel also natively <strong>incorporates proven Azure services<\/strong>, like Log Analytics and Logic Apps, and enriches your investigation and detection with <strong>AI<\/strong>.<\/p>\n<p style=\"text-align: justify;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-44093 size-full\" src=\"https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation.avif\" alt=\"\" width=\"2400\" height=\"1352\" srcset=\"https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation.avif 2400w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation-300x169.avif 300w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation-800x451.avif 800w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation-150x85.avif 150w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation-768x433.avif 768w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation-1536x865.avif 1536w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-explanation-2048x1154.avif 2048w\" sizes=\"auto, (max-width: 2400px) 100vw, 2400px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: justify;\"><strong>Microsoft Sentinel: Key Features<\/strong><\/h2>\n<ul style=\"text-align: justify;\">\n<li><strong>Unified Workspace<\/strong>: Onboard a single workspace into the Defender portal through a simple wizard available on the home screen at <a href=\"https:\/\/security.microsoft.com\/\">microsoft.com<\/a>.<\/li>\n<li><strong>Unified Incidents and Hunting<\/strong>: Streamline investigations with unified incidents and hunting capabilities.<\/li>\n<li><strong>Microsoft Copilot for Security<\/strong> (add-on): Utilize AI for incident summaries, guided investigations, and more, if you are licensed with the Microsoft Copilot for Security add-on.<\/li>\n<li><strong>Extended Attack Disruption<\/strong>: Extend attack disruption to critical apps like SAP.<\/li>\n<li><strong>Post-Incident Recommendations<\/strong>: Receive tailored recommendations to prevent similar attacks.<\/li>\n<li><strong>Classic Experience<\/strong>: Continue using the classic experience in Microsoft Azure if needed.<\/li>\n<\/ul>\n<p style=\"text-align: justify;\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-44097 size-full\" src=\"https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration.png\" alt=\"\" width=\"1581\" height=\"822\" srcset=\"https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration.png 1581w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration-300x156.png 300w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration-800x416.png 800w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration-150x78.png 150w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration-768x399.png 768w, https:\/\/www.schneider.systems\/media\/2024\/07\/SCHNEIDER-IT-MANAGEMENT-2024-07-24-Update-Microsoft-Sentinel-Integration-1536x799.png 1536w\" sizes=\"auto, (max-width: 1581px) 100vw, 1581px\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: justify;\"><strong>Microsoft Sentinel: Licensing requirements<\/strong><\/h2>\n<p style=\"text-align: justify;\"><strong>Microsoft Sentinel<\/strong> is available to commercial cloud users with <strong>at least one Microsoft Defender XDR workload deployed<\/strong>.<\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: justify;\"><strong>Microsoft Sentinel: Pricing Overview<\/strong><\/h2>\n<p style=\"text-align: justify;\"><strong>Pricing depends on the types of logs added to a workspace and is billed daily per workspace. There are two main types of logs: Analytics logs and Basic logs.<\/strong><\/p>\n<ul style=\"text-align: justify;\">\n<li><strong>Analytics logs<\/strong>, which are <strong>high-value security logs<\/strong>, can be paid for using either the <strong>Pay-As-You-Go model or Commitment Tiers<\/strong>.\n<ul>\n<li>The <strong>Pay-As-You-Go <\/strong>model charges based on the <strong>actual data volume stored <\/strong>in GB.<\/li>\n<li><strong>Commitment Tiers<\/strong> offer <strong>predictable pricing<\/strong> and <strong>savings for higher data volumes <\/strong>(tiers range from 100 GB to 50,000 GB per day).<\/li>\n<\/ul>\n<\/li>\n<li><strong>Basic logs<\/strong> are <strong>detailed<\/strong> but have <strong>low security value<\/strong>.\n<ul>\n<li>They are charged at a <strong>flat rate per GB<\/strong> and have <strong>limitations<\/strong> such as <strong>reduced querying capabilities<\/strong> and <strong>eight-day retention<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">There are <strong>simplified pricing tiers<\/strong> that <strong>combine the costs of data analysis and ingestion storage<\/strong> into a single tier, making billing and cost management more straightforward. <strong>Some data sources are free<\/strong> with Microsoft Sentinel. For <strong>more info<\/strong>, please visit: <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing?tabs=simplified%2Ccommitment-tiers\">https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing?tabs=simplified%2Ccommitment-tiers<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<h2 style=\"text-align: justify;\"><strong>More information<\/strong><\/h2>\n<p style=\"text-align: justify;\">Find the <strong>announcement<\/strong> here: <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2024\/07\/11\/simplified-zero-trust-security-with-the-microsoft-entra-suite-and-unified-security-operations-platform-now-generally-available\/#:~:text=Microsoft%20Sentinel%20is,Defender%20XDR%20environment\">https:\/\/www.microsoft.com\/en-us\/security\/blog\/2024\/07\/11\/simplified-zero-trust-security-with-the-microsoft-entra-suite-and-unified-security-operations-platform-now-generally-available\/#:~:text=Microsoft%20Sentinel%20is,Defender%20XDR%20environment<\/a>.<\/p>\n<p style=\"text-align: justify;\">Find a <strong>Microsoft Sentinel overview<\/strong> here: <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing?tabs=simplified%2Ccommitment-tiers\">https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing?tabs=simplified%2Ccommitment-tiers<\/a>.<\/p>\n<p style=\"text-align: justify;\">Understand <strong>pricing options of Microsoft Sentinel<\/strong> with this <strong>documentation<\/strong>: <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing?tabs=simplified%2Ccommitment-tiers\">https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing?tabs=simplified%2Ccommitment-tiers<\/a>.<\/p>\n<p style=\"text-align: justify;\">Find a <strong>pricing overview<\/strong> here: <a href=\"https:\/\/azure.microsoft.com\/en-us\/pricing\/details\/microsoft-sentinel\/#purchase-options\">https:\/\/azure.microsoft.com\/en-us\/pricing\/details\/microsoft-sentinel\/#purchase-options<\/a>.<\/p>\n<p style=\"text-align: justify;\">For more on <strong>Microsoft licensing<\/strong>, visit <strong>our<\/strong> <strong>Microsoft vendor<\/strong> <strong>page<\/strong> at: <a href=\"https:\/\/www.schneider.systems\/software\/microsoft\/\">https:\/\/www.schneider.systems\/software\/microsoft\/<\/a>.<\/p>\n<p style=\"text-align: justify;\">Please <a href=\"https:\/\/www.schneider.systems\/contact\/\">contact us<\/a> for <strong>expert services<\/strong> on your specific <strong>Microsoft<\/strong> software and Online Services requirements and to <strong>request a quote today<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Effective July 11, 2024, Microsoft Sentinel is generally available as part of the unified security operations platform. This integration aims to streamline security operations by combining various tools into a [&hellip;]<\/p>\n","protected":false},"author":11,"featured_media":33016,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[671,645,777],"tags":[],"class_list":["post-44088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-copilot","category-microsoft-security","category-microsoft-sentinel"],"_links":{"self":[{"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/posts\/44088","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/comments?post=44088"}],"version-history":[{"count":5,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/posts\/44088\/revisions"}],"predecessor-version":[{"id":44140,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/posts\/44088\/revisions\/44140"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/media\/33016"}],"wp:attachment":[{"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/media?parent=44088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/categories?post=44088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.schneider.systems\/lu\/wp-json\/wp\/v2\/tags?post=44088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}