Unpopular opinion: The more I dive into Azure Sentinel, the less I'm impressed. For SMBs it's OK for commodity alarms due to the simplicity of O365 logs and others, but customized alarms, threat hunting, etc. is very difficult.
I do like KQL, but it's not even close to others.
I do like KQL, but it's not even close to others.
Using Sentinel as a method for increasing coverage and effectiveness of TTPs would be difficult for an organization other than commodity attacks.
I do want to state that Microsoft is by far stepping up the game all around and very noticeably.
This isn't a gripe about anyone at all. Some amazing folks there working hard.
I'm just providing my experiences with Sentinel, and just not impressed.
This isn't a gripe about anyone at all. Some amazing folks there working hard.
I'm just providing my experiences with Sentinel, and just not impressed.
What I will say is having any type of visibility into cloud infrastructure is better than most norms which is none. Having Azure or AWS logging in a predominant cloud org is a good thing.
Most SIEMs though have moved towards that model and have a much better way to query data.
Most SIEMs though have moved towards that model and have a much better way to query data.
Not just query data, but build alarms and better detections based on their own environment. That's key... Continual progression of coverage and effectiveness of attack paths within an organization is a recipe for success.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
