Cloud SIEM: Your Guide to Microsoft Sentinel

01 Jul Cloud SIEM: Your Guide to Microsoft Sentinel

Posted at 07:00h in Security by Simon Spencer

Small-to-medium businesses (SMBs) continue to be focused on improving their cloud security, and for good reason. Often, it is assumed that enterprise-grade security tools are unnecessary for smaller firms. However, SMBs are just as vulnerable to large-scale security threats as large enterprises.

Those businesses with cloud infrastructure from Azure may struggle to keep track of security events and logs. However, it is precisely here where security threats can be intercepted and responded to.

That is where two tools are particularly important, an SIEM and a SOAR. With Microsoft Sentinel, Microsoft has combined these two useful solutions into one holistic cloud security package. Microsoft Sentinel provides best-in-class intelligent security analytics and threat intelligence.

In this guide, we will give you all you need to know about how Microsoft Sentinel gives you a ‘bird-eye view’ of your cloud infrastructure and explore how it can help protect your business from the most sophisticated cyber-attacks.

What are SIEM and SOAR?

Microsoft Sentinel combines two important security technologies:

Security Information and Event Management (SIEM)
Security Orchestration, Automation and Response (SOAR)

These tools cover the same job – helping your business better respond to a security threat and more quickly handle security. However, there are some key subtle differences between each tool that makes Microsoft Sentinel – combining the two – such a useful complete software package.

What is a SIEM?

Before diving into how Microsoft Sentinel can protect your business, it is important to first define what each of these security tools is.

Security Information and Event Management (SIEM) solutions are involved in capturing and processing security data generated from your systems and cloud infrastructure.

Where is this security information coming from? It includes the logs from antivirus software and firewalls, alerts from servers and applications, network devices, domain controllers and more. This wealth of information is vital for understanding the security health of your infrastructure but managing such a data volume manually is virtually impossible.

A SIEM aggregates and then categorizes and analyses this security information and events through AI automation. A SIEM tool like Microsoft Sentinel is looking out for the patterns in event data that indicate a potential cyber-attack and will alert your team of any pressing security breaches.

What is a SOAR?

The best way to understand the role of a SOAR – Security Orchestration, Automation and Response – tool is to consider it as the engine for which your business can respond to security alerts.

A SOAR tool takes the input alerts from the SIEM system and uses its AI to understand what action and responses are needed to resolve security issues. It considers the dependencies, impacts and risks associated with each security alert and categorises each risk based on its severity. This is particularly useful for reducing ‘alert fatigue’ where a large volume of low-risk security alerts makes it easier to ignore or miss high-risk security alerts.

An important feature of a SOAR tool is the ability to automate responses to certain types of security alerts. Rapid incident response is extremely important for mitigating the damage caused by security threats and breaches. SOAR tools can help your security team drastically reduce both mean time-to-detect (MTTD) and mean time-to-respond (MTTR).

What is Microsoft Sentinel?

Microsoft Sentinel – formally known as Azure Sentinel – is Microsoft’s cloud-native SIEM and SOAR suite. It affords businesses advanced tools for security monitoring and includes a smart analytics service for detecting, investigating, and responding to threats across your cloud infrastructure.

Microsoft bill its tool as a “birds-eye view across your enterprise.” It allows organizations to detect threats before they cause damage and speeds up threat response using Microsoft’s advanced security artificial intelligence.

The capabilities of Microsoft Sentinel are split into four categories:

Collect
Detect
Investigate
Respond

These four competencies neatly combine the features and use-cases of both SIEM and SOAR software.

Sentinel collects your security data at a cloud-scale. By connecting to the rest of your cloud infrastructure and using other Azure services like Active Directory, Security Centre and Azure Log Analytics, Sentinel aggregates vital security information from any source at a scale that is impractical to achieve manually – and supports open standards like CEF and Syslog.

This includes data from all your users, devices, applications etc. This does not just include cloud services – Sentinel aggregates on-premises security information to give your security team a complete outlook on the security health of your infrastructure.

Microsoft’s smart analytics tools and threat intelligence makes it easy to detect previously undetected security threats and helps identify false positives.

Then, Sentinel’s SOAR capabilities become clear. With Sentinel, your security team can easily investigate threats and identify critical incidents to resolve. Microsoft’s artificial intelligence makes spotting patterns of cyber breaches a breeze, making it possible to hunt for suspicious activities at cloud-scale.

Finally, Sentinel can orchestrate a rapid response to security incidents and allows you to automate security procedures to drastically cut your MTTR.

What can Microsoft Sentinel do for my business?

Microsoft Sentinel modernizes your security threat workflow, making it easier and quicker to respond to pressing security threats. Financially, many businesses find Sentinel a worthwhile investment, with an indicative company seeing an average ROI of 201% over 3 years – according to Forrester.

Sentinel’s convenient data ingest tools allow companies to increase the amount of security data they analyse, drastically improving visibility and coverage. Over three years, the average reduction in false positives amounts to 79%.

How does Microsoft Sentinel compare to legacy SIEM and SOAR solutions? Forrester states organizations can expect a 48% reduction in security costs using Sentinel when compared to legacy platforms. It is also 67% faster to deploy when compared to on-premises SIEM solutions.