Azure Sentinel: The best Zero Trust Security model for Cloud Solutions.

Today, amidst the changing global scenario, countless organizations around the world have turned to a more flexible work environment that has initiated the work from home model. In order to ensure that the employees can work collaboratively, tools such as Microsoft Teams and WVD (Windows Virtual Desktop) have been extensively implemented. The work from home model has remarkably boosted the usage of Teams, and it has also played a crucial role in communication along with data sharing, which has led to the responsibility of the SOC team to secure and protect their organization and users. Similarly, WVD is the only virtual desktop infrastructure (VDI) that delivers simplified management, multi-session Windows 10, optimizations for Microsoft 365 Apps for enterprise, and support for Remote Desktop Services (RDS) environments.

While both these remote management solutions like WVD may have its own built-in security and compliance features, it is not entirely invulnerable to attacks. At the same time, a large proportion of Microsoft services and tools consist of dashboards, under specific separate portals, which becomes cumbersome for the SOC team and the Operational team to navigate for analyzing data. This is where Adfolks’ latest offering Azure Sentinel can make a substantial difference.

A cloud-based SIEM solution from Microsoft, it empowers the SOC team to set up end to end monitoring of the entire infrastructure in an instant. Contrary to other on-prem SIEM solutions, Azure Sentinel is cost-effective with the ability to monitor both on-prem along with cloud services. It is touted to be an ideal solution for organizations with a hybrid setup.

Azure Sentinel’s stand out features

Azure Sentinel has approximately 40+ inbuilt connectors for absorbing logs from numerous devices and services. Nearly all the third-party firewall and endpoint services like Cisco, Barracuda, Symantec, and many more, are appropriate for Sentinel. Furthermore, for the exceptional cases, one can practice Syslog Server to accumulate the logs from network switches and routers, and later deliver the same to Sentinel exercising agents.

This tool assists in identifying threats or incidents that can aid the SOC team to investigate while also offering an option to set up auto-remediation policies, thereby adding to the SOAR capability of the Sentinel. Aside from threat investigation and incident reporting, Sentinel also creates stimulating and fascinating dashboards that support the team to look at the operations together without compromising the security wellbeing of the entire organization.

At Adfolks, we take pride in ensuring that our customers secure their infrastructure while also providing operational insights. This is why we would recommend the installation of the Azure Sentinel.

Azure Sentinel can boost the productivity and security of Microsoft Teams

One of the key concerns of most firms where all employees are working from home is the productivity factor. The management is often keen to analyze how engaged the employees are and how they are collaborating with their fellow team members to measure their productivity output. While the Microsoft Teams User Activity data provides a definite understanding of how the users interact and work with their team, at Adfolks we believe that data collected using the Sentinel can not only help to deliver beneficial insights regarding a company's productivity but also its security.

By installing Azure Sentinel in Microsoft Teams, our customers will be able to easily identify some attack techniques such as external users from anomalous organizations

(Mitre ATT&CK technique T1136); external users added and then removed (Mitre ATT&CK technique T1136 ); new bot or application added (Mitre ATT&CK techniques T1176, T1119 ); User-made Owner of multiple Teams (Mitre ATT&CK technique T1078 ); and multiple Teams deleted by a single user (Mitre ATT&CK technique T1485, T1489) Meanwhile, on the operational front, by investing in Sentinel, some issues that can be resolved in Teams include user activity details, identifying the top 3 users based on the call count; identifying top users based on the number of private chats; categorizing users based on the number of Teams Meeting attended; user wise call meeting and message count details; and aggregated data based on different dates.

Azure Sentinel can boost the productivity and security of WVD

Windows Virtual Desktop is yet another important service that is being used by all enterprises to enable work from home during the pandemic. WVD’s performance and monitoring dashboards support the management to scale up the infrastructure as per the usage and serve to track the work hours of employees. However, a large section of customers believes that the installation of the Azure Sentinel will not only help to run the WVD Service effectively but also improve productivity as well.

With Sentinel, organizations needn’t worry about security breaches and risks that include: Brute Force Attack on WVD Hostpool Machines

(Mitre ATT&CK techniques T1110 ); Anomalous PowerShell Executions (Mitre ATT&CK techniques T1059/001/); Adaptive Application Control (Mitre ATT&CK techniques T1210); Adaptive Network Hardening (Mitre ATT&CK techniques T1046) To conclude, by investing in Azure Sentinel, Adfolks believes that organizations with a hybrid set up can not only make their threat detection and response smarter and faster with AI, but also elastically scale to meet their security needs while reducing their IT costs.