Last week, made a comment about how I wasn't a huge fan of Sentinel overall. Got to dive a bit deeper into it with my team over at Binary and has definitely changed my perspective a bit.
Sentinel is not easy by any stretch but there is a lot to it.
Sentinel is not easy by any stretch but there is a lot to it.
https://twitter.com/HackingDave/status/1364978812832907268?s=20
If you have the right data going into it (which isn't easy), and you have a team behind you to build up the detections, Sentinel is extremely powerful.
With jupyter and KQL foundation is super powerful to build what you need to off of it.
With jupyter and KQL foundation is super powerful to build what you need to off of it.
From my comments earlier, it is a solid product.. It just requires a substantial lift to get it to a point that will help you mature monitoring and detection capabilities.
Requires a knowledgeable team is the biggest thing there.
Requires a knowledgeable team is the biggest thing there.
Having a dedicated threat hunting team is a perfect fit for Sentinel overall...
I think that this would need to be a requirement here if you were looking to deploy and get better with detections and visibility in your organization.
I think that this would need to be a requirement here if you were looking to deploy and get better with detections and visibility in your organization.
The last piece here, Sysmon + Sentinel is amazing. I would love to have that on an IR or hunting engagement and would probably be my number one thing for an organization to focus on if going the Sentinel route.
Also @lazyactivist192 and @rpargman are amazing folks :)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
