Jun 07 2023 11:42 PM - edited Jun 13 2023 04:51 PM
Hi all,
Newbie here!
I am SOC analyst for a small business and we are looking at SIEM/SOAR solutions. We already utilize MS Sentinel as SIEM, and Crowdstrike as EDR. We will be rolling out other security products to cover areas such as phishing protection (phishme), IDAM (Tenable AD), etc. Additionally, clients are looking to bring in there own additional applications for us to monitor. I am looking into having alerts going into a single application, allowing analysts to have a single pane of glass to view, as opposed to having to constantly check into every single application.
Does MS sentinel support this kind of functionality or would it be recommended to look at 3rd party applications, as a lot of these products will not be Microsoft based?
Thanks,
Edit 1:
Thanks for responses. I have tried to simply my questions below:
Jun 08 2023 01:30 AM
Jun 09 2023 05:55 AM - edited Jun 09 2023 05:58 AM
Hi Cals,
Your question is quite broad, I'd suggest your create a bullet point list of your requirements and then that list can be compared to features in Sentinel.
Some thoughts on your challenge:
- take a look at the supported device feeds. it's a long list and you'll probably be happy with this level of support for 90% of your log sources.
- for custom log sources:
- syslog - should be pretty easy to parse and product alert/incidents - you'll need to learn how to set up a syslog collector with the AMA agent for this, and you'll need to learn some KQL for the parsing- very short learning curve.
- apis - for api related log sources you'll need to use Azure functions or Logic Apps. This will be a bigger learning curve than syslog so be prepared to spend some time on this or hire a contractor to get it done faster.
-SOAR capabilities - if you need custom SOAR actions to process your incidents, again this will be Logic Apps. Although this is mostly a no-code solution there is a learning curve just like any SOAR tool.
Jun 09 2023 06:15 AM