Microsoft Sentinel in Action - Second Edition

Learn how to set up, configure, and use Microsoft Sentinel to provide security incident and event management services for your multi-cloud environmentKey Features:Collect, normalize, and analyze security information from multiple data sourcesIntegrate AI, machine learning, built-in and custom threat analyses, and automation to build optimal security solutionsDetect and investigate possible security breaches to tackle complex and advanced cyber threats Book Description:Microsoft Sentinel is a security information and event management (SIEM) tool developed by Microsoft that helps you to integrate cloud security and artificial intelligence (AI). This book will enable you to implement Microsoft Sentinel and understand how it can help detect security incidents in your environment with integrated AI, threat analysis, and built-in and community-driven logic.The book begins by introducing you to Microsoft Sentinel and Log Analytics. Youll then get to grips with data collection and management, before learning how to create effective Microsoft Sentinel queries to detect anomalous behaviors and activity patterns. Moving ahead, youll learn about useful features such as entity behavior analytics and Microsoft Sentinel playbooks along with exploring the new bi-directional connector for ServiceNow. As you progress, youll find out how to develop solutions that automate responses needed to handle security incidents. Finally, youll grasp the latest developments in security, discover techniques to enhance your cloud security architecture, and explore how you can contribute to the security community.By the end of this Microsoft Sentinel book, youll have learned how to implement Microsoft Sentinel to fit your needs and be able to protect your environment from cyber threats and other security issues.What You Will Learn:Implement Log Analytics and enable Microsoft Sentinel and data ingestion from multiple sourcesGet to grips with coding using the Kusto Query Language (KQL)Discov