Item: Microsoft Sentinel
Rating: 8
Author: Verified User

Use Cases and Deployment Scope

Sentinel is our SIEM solution that is used in our MSSP service where it is used to monitor security incidents for our customers. The integration and native support for all Microsoft products is really beneficial and helps customers with a quick onboarding. It is being used to monitor both cloud as on-premises workloads where different streams of logs are being ingested in the portal. The solution helps to centrally manage all Sentinel instances of customers where standardized solution can be distributed to the customers.

Pros and Cons

It has a native integration with all Microsoft products, from Entra to Azure, Microsoft 365
Being built upon native Azure functionality benefits in automation and infrastructual solutions
The KQL language is relatively easy to learn and powerful.
Microsoft is listening very careful to the customers and develops new functionality at a fast pace

The solution can become very expensive when not used in an effective way
The SOAR functionality can be more powerful compared to other products
Ingestions delays are not often clear and have to be taken care of thoroughly

Return on Investment

Less overhead on integration of cloud-native logging
The KQL language is very helpful since it can be used for security and operational monitoring but as well for workbooks and dashboarding
A large community developing solutions is very helpful for a quick adoption

Sources

Cloud Identities
On-Premises Identity events
Azure platform events
Defender and other Microsoft products
On-premises appliances
Linux events

The native microsoft sources are pretty easy to incorporate with the standard integrated data connectors
This same counts towards Azure activity, Azure VMs and workloads

On-premises workloads will make use of logforwarders (Windows Event Forwarder / Syslog Forwarder) We are moving to Logstash in due time

AI and ML

We make use of UEBA for the correlation between anomalies, especially on the identity platform.

Next to that we use the Fusion rules that will detect multi-stage attack scenarios
Sentinel notebooks are not used a lot at this moment, because of the learning curve

Investigation Tools

We do not rely too much on the investigation tools. Investigation will primarily be done with investigation with KQL Queries. The investigation dashboard is looked into to identify the entities and a first overview of the timeline. After that we construct our own timeline by using our own queries

Alternatives Considered

Arcsight Enterprise Security Manager

ArcSight is an on-prem solution that has a different approach than Sentinel.

In a basis this product is more complex to maintain and deploy. The query functionality in Sentinel is more powerful and easier to maintain. ArcSight has a much slower performance and an interface that has a steep learning curve. Being an on-premises solution can sometimes be more cost efficient when looking at storage but also less scalable

Key Insights

Do you think Microsoft Sentinel delivers good value for the price?

Yes

Are you happy with Microsoft Sentinel's feature set?

Yes

Did Microsoft Sentinel live up to sales and marketing promises?

Yes

Did implementation of Microsoft Sentinel go as expected?

Yes

Would you buy Microsoft Sentinel again?

Yes

Other Software Used

Microsoft Defender for Cloud, Microsoft Defender for Endpoint, Microsoft Azure, Microsoft Defender for Identity, Microsoft Defender for Office 365, Microsoft Defender External Attack Surface Management

Likelihood to Recommend

For most customers that have a cloud native workload that is based on Microsoft products it is an excellent product. Because of the integration it can be used pretty cost efficient and it works pretty good across the different products. This is very much the case when Azure AD/Entra is being used for authentication which will benefit with UEBA and Fusion.
When companies have no Microsoft footprint it still can be an excellent product, but it lacks integration and UEBA/Fusion have none or less additional value.
Compared with other SIEM solutions it is a very good product, but keep in mind that using Microsoft products will get you on the right track out of the box

Microsoft Sentinel, the scaleable cloud-native SIEM platform

Overall Satisfaction with Microsoft Sentinel