You're reading from Learn Azure Sentinel Integrate Azure security with artificial intelligence to build secure cloud systems

Product type Paperback

Published in Apr 2020

Publisher Packt

ISBN-13 9781838980924

Length 422 pages

Edition 1st Edition

Tools

Azure

Concepts

Artificial Intelligence

Authors (2):

Gary Bushey

Richard Diver

View More author details

Table of Contents (22) Chapters

Preface

1. Section 1: Design and Implementation

2. Chapter 1: Getting Started with Azure Sentinel FREE CHAPTER

3. Chapter 2: Azure Monitor – Log Analytics

4. Section 2: Data Connectors, Management, and Queries

5. Chapter 3: Managing and Collecting Data

6. Chapter 4: Integrating Threat Intelligence

7. Chapter 5: Using the Kusto Query Language (KQL)

8. Chapter 6: Azure Sentinel Logs and Writing Queries

9. Section 3: Security Threat Hunting

10. Chapter 7: Creating Analytic Rules

11. Chapter 8:Introducing Workbooks

12. Chapter 9:Incident Management

13. Chapter 10: Threat Hunting in Azure Sentinel

14. Section 4: Integration and Automation

15. Chapter 11: Creating Playbooks and Logic Apps

16. Chapter 12: ServiceNow Integration

17. Section 5: Operational Guidance

18. Chapter 13: Operational Tasks for Azure Sentinel

19. Chapter 14: Constant Learning and Community Contribution

20. Assessments

21. Other Books You May Enjoy

Leave a review - let other readers know what you think

Introduction to Azure Monitor Log Analytics

Azure Monitor is the name of a suite of solutions built within the Azure platform to collect logs and metrics, with that information then being used to create insights, visualizations, and automated responses. Log Analytics is one of the main services created to analyze the logs gathered. The platform supports near real-time scenarios, is automatically scaled, and is available to multiple services across Azure (including Azure Sentinel). Using a version of the Kusto Query Language (KQL), the query language used to obtain information from logs, complex information can be queried quickly and the queries are saved for future use. In this book, we will refer to this service simply as Log Analytics.

In order to create a Log Analytics workspace, you must first have an Azure subscription. Each subscription is based on a specific geographic location that ties the data storage to that region. The region selection is decided based on where you want...