As cybersecurity attacks grow in volume and complexity, today’s security operations professionals are putting their faith in artificial intelligence (AI) to overcome legacy limitations and stay ahead of threats.
According to Avanade’s research, only 52% of executives believe that new security technologies are keeping ahead of new security threats. As such, this trend toward adopting new and emerging technologies should be no surprise.
The birth of modern SOCs
It’s within this context that many security leaders are wondering about the future of their Security Operations Centers (SOC) – the team responsible for the detection of threats and incidents and rapid remediation. The conversation is evolving toward modern intelligent SOC 2.0 - leveraging AI, machine learning (ML), automation and adaptive tools to manage security events and information.
Modern SOCs are built on a combination of cloud-native Security Information and Event Management (SIEM) tools, with AI, machine learning and advanced analytics. With advanced SOC monitoring and automated response, external threat feeds are combined with internal feeds for correlation and rapid response to detonate threats quickly.
Azure Sentinel is the future of SIEM
While advanced SIEM – and the insights it provides – is integral to the success of modern security operations, not all solutions are alike.
Some SIEM tools today have challenges in collating and analyzing the various alerts generated across an enterprise. With many indicators of compromise hiding in different tools in the IT environment, there should be one single orchestrator that can aggregate all threat alerts, identity potential causes and remediate those threats in real-time.
Microsoft’s Azure Sentinel is a cloud-native tool that ingests security data from the cloud and on-premise environments. It has the capabilities to handle peta bytes of data, analyze them using ML models, AI orchestration and provide automation specific to usage. It is a powerful and scalable SIEM that can use bookmarks to threats, rapid playbook creation, fast response to incidents and intelligent built-in queries. Azure Sentinel augments the threat detection of earlier tools like Azure Security Center.
Why Advanced SIEM and SOC are needed for the future
Today's Microsoft environment is diversified with Active Directory / Azure AD, Windows, Office 365, Microsoft Threat Protection, Microsoft Cloud Application Security, Office 365 Advanced Threat Protection (ATP), Azure Security Center… and the list goes on.
To integrate and connect all of this information in one place, Azure Sentinel aggregates all the Microsoft solutions – as well as other firewall and monitoring tools – for end-to-end SIEM monitoring. Microsoft Sentinel also provides a wide range of capabilities, starting from security monitoring, user behavior analytics, real-time automation playbooks, user-enabled query language for event simulation, and other threat hunting features.
The cloud pairing of Azure Sentinel and Microsoft Defender Advanced Threat Protection (MDATP) offers a powerful combination of tools to address Managed Endpoint Detection and Response (MDR) and Managed SOC Services including the combination of threat feed intelligence.
How Avanade uses Sentinel
We practice what we preach here. Avanade is one of the early adopters of Azure Sentinel – successfully running Sentinel in today's world-class, cloud-native SIEM. With our own internal success story, our Security Services provides Managed Security Services by specifically adopting Azure Sentinel to enterprises looking for full SOC services using pro-active threat hunting, multi-feed threat intelligence, use case management, alert management, playbooks creation and automation libraries. The cyber defense offering doesn’t stop until Azure Sentinel is also extended to the Endpoint Detection and Response (EDR) solution.
With many organizations moving cloud-first in their digital transformation journey, Avanade offers the expertise to integrate the world-class, cloud-native SIEM with any security tooling integration and a powerful combination of AI, ML, automation and response.
The original article was published here on December 4, 2019.
