Richard Diver - Microsoft Sentinel in Action: Architect, design, implement, and operate Microsoft Sentinel as the core of your security solutions, 2nd Edition

Architect, design, implement, and operate Microsoft Sentinel as the core of your security solutions

Richard Diver

Gary Bushey

John Perkins

BIRMINGHAMMUMBAI

Copyright 2022 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Group Product Manager: Vijin Boricha

Publishing Product Manager: Meeta Rajani

Senior Editor: Arun Nadar

Content Development Editor: Sulagna Mohanty

Technical Editor: Arjun Varma

Copy Editor: Safis Editing

Project Coordinator: Shagun Saini

Proofreader: Safis Editing

Indexer: Vinayak Purushotham

Production Designer: Vijay Kamble

First published: May 2020

Second edition: January 2022

Production reference: 1021221

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham

B3 2PB, UK.

ISBN 978-1-80181-553-6

www.packt.com

Richard Diver is a senior technical business strategy manager for the Microsoft Security Solutions group, focused on developing security partners. Based in Chicago, Richard works with advanced security and compliance partners to help them build solutions across the entire Microsoft platform, including Microsoft Sentinel, Microsoft Defender, Microsoft 365 security solutions, and many more. Prior to Microsoft, Richard worked in multiple industries and for several Microsoft partners to architect and implement cloud security solutions for a wide variety of customers around the world. Any spare time he gets is usually spent with his family.

Gary Bushey is an Azure security expert with over 25 years of IT experience. He got his start early on when he helped his fifth-grade math teacher with their programming homework and worked all one summer to be able to afford his first computer, a Commodore 64. When he sold his first program, an apartment management system, at 14 he was hooked. During his career, he has worked as a developer, consultant, trainer, and architect. When not spending time in front of a computer, you can find him hiking in the woods, taking pictures, or just picking a direction and finding out what is around the next corner.

John Perkins is the founder and principal of Threat Angler, a cybersecurity service provider that specializes in managed services, professional services, and training with a focus on delivering cybersecurity outcomes to customers of all shapes and sizes. John has over 20 years of experience in cybersecurity and has contributed to nearly all cybersecurity disciplines during his career. He has experience with numerous applications, including Microsoft Sentinel, and has designed, built, and led managed security services for several large service providers. In his free time, John enjoys spending time with his family, traveling, and staying active.

Ashwin Patil currently works as a senior program manager for Microsoft Threat Intelligence Center (MSTIC) and has over 10 years' experience entirely focused on security monitoring and incident response, defending enterprise networks. In his current role, he primarily works on threat hunting, detection research in Kusto Query Language (KQL) for Microsoft Sentinel, and developing Jupyter notebooks written in Python/R to do threat hunting and investigation across a variety of cloud and on-premises security event log data sources. He has a bachelor's degree in computer engineering and possesses various SANS certifications, including GCIA, GCFE, and GCIH in the field of Digital Forensics and Incident Response (DFIR).

Dennis Pike is the original sales engineer at Island, a stealth mode security startup. He would tell you more, but they may put him on an island with nothing but a volleyball. Born in Kentucky, he surprisingly can't stand bourbon and ended up a nationally ranked beer judge instead. He holds a BSc in systems engineering from the University of Virginia and has spent the last 25 years working in IT, including as a Global Black Belt Advanced Security Analytics at Microsoft where he focused on Microsoft Sentinel.

I want to thank my wife, Heather, for her patience, love, and support.

Rod Trent is a senior cloud security advocate for Microsoft and an Microsoft Sentinel global SME helping customers migrate from existing SIEMs to Microsoft Sentinel to achieve the promise of better security through improved efficiency without compromise. He is a husband, dad, and first-time grandfather (so speak slowly and loudly). He spends his spare time (if such a thing does truly exist) simultaneously watching Six Million Dollar Man episodes and writing KQL queries.