Episode 181 – Deep[er] Dive on Azure Sentinel

In Episode 181, Ben and Scott go deeper into Azure Sentinel, discussing considerations for the design and segmentation of your Sentinel workspaces. Transcript Email Download New Tab - [Ben] Welcome to episode 181 of the Microsoft Cloud IT pro podcast recorded live on June 5, 2020. This is a show about Microsoft 365 and Azure, from the perspective of IT pros and end users where we discuss the topic or recent news and how it relates to you. In this episode, Scott and Ben take a little bit deeper dive into Azure Sentinel and what you can do with it. And here we are, Scott. A Friday, but not just any Friday. This Friday is unique from all other Fridays. - [Scott] It is, is it? - [Ben] Every Friday is unique technically, right? Every Friday is not like the other. One of these things is not on, no don't get me started. - [Scott] No, stop the madness. No, this is your last day, which means we may have to update our intro. We need to talk about that but why might we have to intro, update our intro, Scott? - [Scott] I am going to go out into the wider world and live one of my adult dreams. I'm gonna become a blue badge. - [Ben] Look at you. - [Scott] Look at me. - [Ben] You are moving up. You are leaving me. No, you're not leaving me. We're gonna still keep doing the podcast, you're just changing jobs, which is exciting. I know I've talked to a bunch and this is something you have been trying for wanting to do for a long time. So it's exciting for me to be excited for you because I do know how excited you have been to do this. - [Scott] Yeah, I think it will be very interesting. So I'm gonna be living in a little bit of a different life. I am joining the Azure storage product team as a product manager within a Cogs group. So I'll primarily be working with customers around Azure blob storage, which storage is kinda the backbone of, just about everything that you do in the cloud. At the end of the day, if you think about Azure, it's really a bunch of compute. It's a big hypervisor and then stuff that's running in storage, which tends to be blobs, that could be virtual machine disks, could be something you upload for a workload, could be like data lakes all run in blob storage, things like that. So I think it'd be very exciting to be a little bit closer to kinda the core and backend of everything that drives Azure. - [Ben] Got it, very cool. You are gonna be focused then explicitly on just blob storage because storage has all those other things like you have your blobs and your Azure file shares and all of those that function differently and do different things and you are not Azure storage but you are Azure blob storage. - [Scott] That's my understanding of it. I'll let you know more as it evolves. - [Bob] As it develops when you start here in a few more days. - [Scott] Yes. - [Bob] So you already, how was starting a new job in this world of quarantine? - [Scott] It's very interesting. I think like lots of employers, Microsoft isn't probably too unique in trying to figure out how to onboard employees remotely. I remember when I was a virtual TSP, when back when they used to have like purple badges at Microsoft and your badge came with, your picture and all those things, just usually a normal bad but also your clients certificate for CACing into things. And you weren't allowed to just say, "Hi, I'm Scott" and somebody would send you a badge with a CAC and they'd give you your password in plain text over email and you go like, "Ooh, look at me, I'm on the network." There was a little bit more, a little bit more involved with that. You had to go to a Microsoft location and see somebody in person. So there's certainly things like that. I think it's even interesting for hiring practices like in the United States, you have to prove that you're eligible to work in the United States. So you have to provide documentation such as your passport or your driver's license and your social security card. There's this whole combination of documents that you need to provide that you're allowed to work in the country. And I think lots of countries are like that in the same vein but typically those need to be verified in person. So in the US that is certainly a thing, the IRS says, "Hey, you have to verify these documents in person "as an employer." They've waived all those rules for right now and they're letting employers do virtual verification. But even for that, at some point, like they're very explicit and it calls out in hiring documentation that once things open back up again and we can be non-virtual, you're gonna have to show up at an office with this documentation and make sure we know who you are. - [Ben] Okay, got it, interesting. It's just so bizarre, all of that. I was talking to somebody too, that said banks are struggling with the same thing, not so much from hiring but in terms of opening new accounts and doing the same type of verification. - [Scott] I would imagine it hits lots and lots and lots of different places. - [Ben] Yes, but now I don't know. We haven't figured this out yet. We'll have to figure this out because we are recording this on our typical Friday, which means by the time you will, people will hear this or you, the listeners will be hearing this, you will have been a Microsoft employee for four days. So we still need to figure out what kind of intro I need to put at the beginning of this, that these are your opinions and not the opinions of Microsoft and that disclaimery type stuff or if we even need that. - [Scott] Yeah, we'll get all that stuff sorted. - [Ben] We'll figure it out. - [Scott] Yes, fun times. - [Ben] Do you feel overwhelmed by trying to manage your Office 365 environment? Are you facing unexpected issues that disrupt your company's productivity. Intelligink is here to help, much like you take your car to the mechanic that has specialized knowledge on how to best keep your car running, Intelligink helps you with your Microsoft cloud environment because that's their expertise. Intelligink keeps up with the latest updates in the Microsoft cloud to keep your business running smoothly and ahead of the curve. Whether you are a small organization with just a few users up to an organization of several thousand employees, they want to partner with you to implement and administer your Microsoft cloud technology. Visit them at intelligink.com/podcast. That's I-N-T-E-L-L-I-G-I-N-K.com/podcast, for more information or to schedule a 30-minute call to get started with them today. Remember Intelligink focuses on the Microsoft cloud, so you can focus on your business. - [Ben] So should we dive into our topic now today? - [Scott] Yeah, absolutely. - [Ben] It has nothing to do with what you're gonna be doing, but it has to do with what you are presenting on here shortly. - [Scott] It does. I think one of the interesting things about my current role is potentially the variety of offerings that come along with them. And so we've been doing, and you've been helping out as a coach in a big bootcamp that Microsoft has been putting on this week. So they had their first virtual partner bootcamp. There was a select group of partners that were invited to this event. I think we had about 1700 attendees signed up, which was pretty good for like an internal, very partner driven event, but all 300 plus level content for four days across a bunch of different tracks, AppDev, Infra, Teams, Versatrack, which is what you're participating in. So in my tracking infrastructure, we've been doing deep dives on arm, including Azure resource manager templates. We've also done as we talked about last week, a bunch of Kubernetes stuff. Like I was talking about some of the heartburn with just Jason and things like that, that was all born out of putting together all this content around Kubernetes. And then my last one, my last session today is on Azure Sentinel. - [Bob] This is an interesting one. We actually had, we did an episode a while back when Sentinel first came out and then we recently had somebody ask too they're like, "Hey, could you dive a little bit deeper to Sentinel? "You did like an overview, but can we dive deeper?" So you're like, "Hey, Scott just wrote a bunch of "three, 400 level content on Sentinel. "Someone asked about Sentinel. "Maybe we should do a Sentinel episode." - [Scott] Yeah, it's totally doable. - [Ben] Yes, so if people, and there may be people that have not heard our intro episode. So should we just start really briefly by what Sentinel is if people have not heard of it or didn't listen to that episode or are just curious, what is Sentinel? - [Scott[ Sentinel is Microsoft's cloud based SIM. So it's an event collector that allows you to do not just collection, but also analysis of security events and logs that you might store across your environments, all in the cloud. So you're leveraging cloud for not only the storage of your logs, but also for the compute and really for the, I think that beauty of computational machine learning and things like that, to help you understand all of those logs as they're aggregated together. So if you think about most environments that you probably have today, let's say you run in Azure. That means you have an Azure subscription, which means you have an activity log you monitor, it means you have Azure AD. And it also means that you have all these workloads that you run off plate. Even if you turn up a VM, that VM has a windows event log or if you're doing Linux, you might be doing Swisslog, something like that. So there's operational events coming from those you're probably a little bit on prem. So maybe you have some clients or servers on prem that are doing things. Like if I have a windows server, it probably has a firewall turned on and that's generating telemetry and logging....