Making the most of Azure Sentinel

At a high-level, Azure Sentinel is a SIEM, a security incident event management tool. It can watch your whole network including hybrid devices and on-premises resources. There is a cost associated with Sentinel based on the volume of data ingested for analysis, but its capabilities make it worth the investment.

Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. It uses advanced AI and machine learning algorithms to analyze the logs and tries to detect any threat posed for the system.

I'm very impressed by Sentinel's use of Microsoft AI. Microsoft watches every network of their customers around the world, keeping track of behavior in the aggregate. It then analyzes that data and, based on behavior statistics, it can alert you on specific attacks that may be happening.

With Sentinel, you can take advantage of Microsoft's global security division and take all the information they have gathered and apply it. For example, let's say your network is being attacked. Azure Sentinel can spot the same attack in Brazil and recommend a fix.