Microsoft Azure Sentinel Plan, deploy, and operate Azure Sentinel, Microsoft’s advanced cloud-based SIEM Microsoft’s cloud-based Azure Sentinel helps you fully leverage advanced AI to automate threat identification and response — without the complexity and scalability challenges of traditional Security Information and Event Management (SIEM) solutions. Now, three of Microsoft’s leading experts review all it can do, and guide you step-by-step through planning, deployment, and daily operations. Leveraging in-the-trenches experience supporting early customers, they cover everything from configuration to data ingestion, rule development to incident management… even proactive threat hunting to disrupt attacks before you’re exploited. Three of Microsoft’s leading security operations experts show how to: • Use Azure Sentinel to respond to today’s fast-evolving cybersecurity environment, and leverage the benefits of its cloud-native architecture • Review threat intelligence essentials: attacker motivations, potential targets, and tactics, techniques, and procedures • Explore Azure Sentinel components, architecture, design considerations, and initial configuration • Ingest alert log data from services and endpoints you need to monitor • Build and validate rules to analyze ingested data and create cases for investigation • Prevent alert fatigue by projecting how many incidents each rule will generate • Help Security Operation Centers (SOCs) seamlessly manage each incident’s lifecycle • Move towards proactive threat hunting: identify sophisticated threat behaviors and disrupt cyber kill chains before you’re exploited • Do more with data: use programmable Jupyter notebooks and their libraries for machine learning, visualization, and data analysis • Use Playbooks to perform Security Orchestration, Automation and Response (SOAR) • Save resources by automating responses to low-level events • Create visualizations to spot trends, identify or clarify relationships, and speed decisions • Integrate with partners and other third-parties, including Fortinet, AWS, and Palo Alto

Microsoft Azure Sentinel: Planning and implementing Microsoft’s cloud-native SIEM solution (IT Best Practices - Microsoft Press)

Computers & Technology

Diogenes, Yuri

DiCola, Nicholas

Trull, Jonathan

Networking & Cloud Computing

Microsoft Press

Product Description 
Master a complete strategy for protecting any Azure cloud network environment!\nNetwork security is crucial to safely deploying and managing Azure cloud resources in any environment. Now, two of Microsoft's leading experts present a comprehensive, cloud-native approach to protecting your network, and safeguarding all your Azure systems and assets. Nicholas DiCola and Anthony Roman begin with a thoughtful overview of network security’s role in the cloud. Next, they offer practical, real-world guidance on deploying cloud-native solutions for firewalling, DDOS, WAF, and other foundational services – all within a best-practice secure network architecture based on proven design patterns.\nTwo of Microsoft's leading Azure network security experts show how to:\nReview Azure components and services for securing network infrastructure, and the threats to consider in using them 
Layer cloud security into a Zero Trust approach that helps limit or contain attacks 
Centrally direct and inspect traffic with the managed, stateful, Platform-as-a-Service Azure Firewall 
Improve visibility into Azure traffic with Deep Packet Inspection 
Optimize the way network and web application security work together 
Use Azure DDoS Protection (Basic and Standard) to mitigate Layer 3 (volumetric) and Layer 4 (protocol) DDoS attacks 
Enable log collection for Firewall, DDoS, WAF, and Bastion; and configure NSG Flow Logs and Traffic Analytics 
Continually monitor network security with Azure Sentinel, Security Center, and Network Watcher 
Customize queries, playbooks, workbooks, and alerts when Azure's robust out-of-the-box alerts and tools aren't enough 
Build and maintain secure architecture designs that scale smoothly to handle growing complexity\nAbout This Book\nFor Security Operations (SecOps) analysts, cybersecurity/information security professionals, network security engineers, and other IT professionals 
For individuals with security responsibilities in any Azure environment, no matter how large, small, simple, or complex\nAbout the Author 
Nicholas DiCola is the principal director of the Cloud Security Customer Experience Engineering (CxE) team. CxE helps customers with deployments of Cloud Security products such as Azure Security Center, Azure Sentinel, Azure Network Security, Azure Information Protection, Microsoft Defender for Identities, and Microsoft Cloud Application Security. CxE is responsible for driving use of Cloud Security products and taking feedback from customers to improve the products. Nicholas has been with Microsoft since 2006 when he started in Microsoft Consulting Services. He has a Master of Business Administration with a concentration in information systems and various industry certifications such as CISSP and CEH. You can follow Nicholas on Twitter at @mastersecjedi.\nAnthony Roman is the senior PM manager leading the Azure network security Get-To- Production team within Cloud Security CxE. The team works with customers and network security engineering to ensure that products are fulfilling customer security requirements. Anthony joined Microsoft in 2019 and has held positions in IT and security since he made the transition from bartender to IT security professional a decade earlier. His Bachelor of Arts degree in philosophy is complemented by several industry certifications and plenty of on-the-job and home lab experience. He currently lives in Philadelphia with his wife and two children and can often be seen walking around the city in search of parks and restaurants.

Microsoft Azure Network Security (IT Best Practices - Microsoft Press)

Roman, Anthony

Prepare for Microsoft Exam SC-900 and help demonstrate your real-world knowledge of the fundamentals of security, compliance, and identity (SCI) across cloud-based and related Microsoft services. Designed for business stakeholders, new and existing IT professionals, functional consultants, and students, this Exam Ref focuses on the critical thinking and decision-making acumen needed for success at the Microsoft Certified: Security, Compliance, and Identity Fundamentals level. &nbsp; Focus on the expertise measured by these objectives: * Describe the concepts of security, compliance, and identity * Describe the capabilities of Microsoft identity and access management solutions * Describe the capabilities of Microsoft security solutions * Describe the capabilities of Microsoft compliance solutions &nbsp; This Microsoft Exam Ref: * Organizes its coverage by exam objectives * Features strategic, what-if scenarios to challenge you * Assumes you are a business user, stakeholder, consultant, professional, or student who wants to create holistic, end-to-end solutions with Microsoft security, compliance, and identity technologies &nbsp; About the Exam Exam SC-900 focuses on knowledge needed to describe: security and compliance concepts and methods; identity concepts; Azure AD identity services/types, authentication, access management, identity protection, and governance; Azure, Azure Sentinel, and Microsoft 365 security management; Microsoft 365 Defender threat protection and Intune endpoint security; Microsoft 365 compliance management, information protection, governance, insider risk, eDiscovery, and audit capabilities; and Azure resource governance. &nbsp; About Microsoft Certification Passing this exam fulfills your requirements for the Microsoft Certified: Security, Compliance, and Identity Fundamentals certification, helping to demonstrate your understanding of the fundamentals of security, compliance, and identity (SCI) across cloud-based and related Microsoft services. With this certification, you can move on to earn more advanced related Associate-level role-based certifications. &nbsp; See full details at: microsoft.com/learn

Exam Ref SC-900 Microsoft Security, Compliance, and Identity Fundamentals

McKinnerney, Kevin

Morowczynski, Mark

Certification

Build next-generation security operations with Microsoft Sentinel 
Microsoft Sentinel is the scalable, cloud-native, security information and event management (SIEM) solution for automating and streamlining threat identification and response across your enterprise. Now, three leading experts guide you step-by-step through planning, deployment, and operations, helping you use Microsoft Sentinel to escape the complexity and scalability challenges of traditional solutions. Fully updated for the latest enhancements, this edition introduces new use cases for investigation, hunting, automation, and orchestration across your enterprise and all your clouds. The authors clearly introduce each service, concisely explain all new concepts, and present proven best practices for maximizing Microsoft Sentinel’s value throughout security operations.\nThree of Microsoft’s leading security operations experts show how to: Review emerging challenges that make better cyberdefense an urgent priority See how Microsoft Sentinel responds by unifying alert detection, threat visibility, proactive hunting, and threat response Explore components, architecture, design, and initial configuration Ingest alerts and raw logs from all sources you need to monitor Define and validate rules that prevent alert fatigue Use threat intelligence, machine learning, and automation to triage issues and focus on high-value tasks Add context with User and Entity Behavior Analytics (UEBA) and Watchlists Hunt sophisticated new threats to disrupt cyber kill chains before you’re exploited Enrich incident management and threat hunting with Jupyter notebooks Use Playbooks to automate more incident handling and investigation tasks Create visualizations to spot trends, clarify relationships, and speed decisions Simplify integration with point-and-click data connectors that provide normalization, detection rules, queries, and Workbooks\nAbout This Book For cybersecurity analysts, security administrators, threat hunters, support professionals, engineers, and other IT professionals concerned with security operations For both Microsoft Azure and non-Azure users at all levels of experience

Microsoft Azure Sentinel: Planning and implementing Microsoft's cloud-native SIEM solution (IT Best Practices - Microsoft Press)

Turpijn, Tiander

See the best price to sell, buy, or rent books by DiCola, Nicholas. BookScouter helps to compare book prices from 25+ online bookstores and 30+ buyback vendors with a single search.

Books by DiCola, Nicholas