Azure Sentinel this Week - Issue #35

The Biden Administration’s recent Executive Order on Improving the Nation’s Cybersecurity emphasizes the need to improve not only the detection of cloud

Customers exploring threat intelligence indicators in their cloud workloads today face challenges understanding, aggregating, and actioning data across multiple sources. Threat intelligence is an advanced cybersecurity discipline requiring detailed knowledge of identifying and responding to an attacker based on observation of indicators in various stages of the attack cycle. Azure Sentinel is a cloud native SIEM solution that allows customers to import threat intelligence data from various places such as paid threat feeds, open-source feeds, and threat intelligence sharing communities. Azure Sentinel supports open-source standards to bring in feeds from Threat Intelligence Platforms (TIPs) across STIX & TAXII. Microsoft has released the next evolution of threat hunting capabilities in the Azure Sentinel Threat Intelligence Workbook.

The Azure Security Benchmark (ASB) Workbook provides a single pane of glass for gathering and managing data to address ASB control requirements. The power of this workbook lies in its ability to aggregate data from 25+ Microsoft security products and to apply these insights to relevant controls in the ASB framework. Rather than separately interfacing with Azure Security Center, Azure Sentinel, Azure Resource Graph, Azure Active Directory, Microsoft Defender for Endpoint, and additional products to understand compliance posture, the Azure Security Benchmark Workbook centralizes the relevant data within the context of the ASB controls.

Log Analytics Legacy Queries now available only in the new query experience. The old Query Explorer Experience is will no longer be available. All Queries features are now a part of the new and upgraded Query Experience in Logs.