Скачать или смотреть Getting Started With Sentinel | Microsoft Sentinel Deployment

In this video, we’ll guide you through the process of getting started with Microsoft Sentinel, Microsoft’s cloud-native Security Information and Event Management (SIEM) solution. Whether you're new to Sentinel or looking to enhance your security operations, this step-by-step tutorial will help you deploy and configure Microsoft Sentinel to detect, investigate, and respond to security threats in real-time.

🔐 What is Microsoft Sentinel? Microsoft Sentinel is a powerful, cloud-native SIEM solution that helps organizations collect, detect, investigate, and respond to security threats across their entire environment. It uses AI and automation to analyze massive amounts of security data, helping organizations identify potential threats quickly.

Timestamps:
0:00 - Intro
0:30 - SIEM & SOAR recap
0:58 - Learning objectives
2:11 - Sentinel data flow
2:59 - Create Log Analytics Workspace
4:14 - Deploy Sentinel
5:05 - Sentinel settings
6:08 - Workspace config & retention
7:12 - Add data connectors
8:04 - Azure Activity connector
9:18 - Windows Security connector
11:02 - Logs ingestion
12:30 - Run basic KQL queries
13:20 - AzureActivity table
13:57 - Filter & project
15:18 - Summarize & visualize
16:45 - SQL vs KQL
24:05 – KQL operators & Splunk comparison
25:08 – Custom analytic rule creation intro
26:06 – Schedule rule types (real-time, Defender alerts)
27:03 – Rule templates overview (e.g., new Cloud Shell user)
28:01 – MITRE tactics & severity config
28:56 – Rule frequency, threshold, grouping
29:56 – Trigger Cloud Shell manually (no storage)
30:55 – Launch with storage to match query
32:03 – Validate ingestion via query
33:06 – Run KQL with expected log
34:49 – Filter by resource group "CloudShell"
36:02 – Explanation of query condition mismatch
37:17 – Launch classic Cloud Shell with storage
39:06 – Storage confirmed (log generation expected)
40:00 – Query for matching resource group
41:46 – Validate operation name & success
42:09 – Rule query finds evidence (alert triggered)
43:39 – Rule runs every 5 mins, detects tactics
45:52 – Incident appears in portal
46:24 – Assign & investigate incident
47:14 – Related entities & alerts
48:03 – Classify & close incident (e.g., suspicious but expected)
49:51 – Summary: Sentinel setup to incident lifecycle
51:15 – Outro & video closing




In this video, we’ll explain:

What Microsoft Sentinel is and how it fits into your security strategy.
Core features of Sentinel, including log analytics, advanced threat detection, and automated incident response.
How to deploy Sentinel in your Azure environment to start protecting your resources.

🖥️ Step-by-Step Deployment of Microsoft Sentinel Follow along as we walk through the entire process of deploying Microsoft Sentinel, from setting it up to integrating it with your security infrastructure. You’ll learn how to:

Create and configure a Microsoft Sentinel workspace in the Azure portal.
Connect data sources (like Azure resources, on-premises servers, and third-party services) to Sentinel for data collection.
Set up Log Analytics workspace and configure data retention settings.
Enable and configure security analytics to detect potential threats and attacks.
Learn how to set up automated response actions using playbooks and Sentinel’s built-in workflows.

🔧 Integrating Microsoft Sentinel with Data Sources We'll demonstrate how to integrate Azure resources, Office 365, Windows Servers, Linux Servers, and third-party security tools into Sentinel. This ensures you have complete visibility over your environment and enables Sentinel’s threat detection features.

Who Should Watch?

Security professionals, SIEM administrators, or Azure security engineers looking to set up or optimize Microsoft Sentinel.
IT and cloud administrators interested in learning how to integrate security solutions into their Azure environment.
Organizations wanting to centralize their security operations and improve incident detection and response.
Anyone interested in learning about cloud-native security and advanced threat detection using AI.
By the end of this video, you'll have a solid understanding of how to deploy, configure, and use Microsoft Sentinel to enhance your security posture, detect emerging threats, and automate your response workflows.

Want to learn more or connect with us?

Visit our official website: https://www.cloud360.co

Subscribe for more tutorials:    / @cloud360_solutions  

Connect with us on LinkedIn:   / cloud360-solutions  

Like our page on Facebook: https://www.facebook.com/profile.php?...

Stay updated and join the conversation!

🔔 Don't forget to like, comment, and subscribe for more cybersecurity tutorials and tips on Microsoft Sentinel and cloud security!