Protect Office 365 with Azure Sentinel

1. 11 May, 2021
Protect Office 365 with Azure Sentinel
Nanddeep Nachan
@NanddeepNachan
Smita Nachan
@SmitaNachan

2. AGENDA
 Challenges with Microsoft 365 environment monitoring
 Monitor Office 365 Logs from Azure Sentinel
 Threat detection with Azure Sentinel analytics
 Respond to Threats
 Q&A

3. Office 365 Consultant
Speaker | Author | Blogger
Nanddeep Nachan
 Pune, India
 Twitter Handle: @NanddeepNachan
 LinkedIn: /in/NanddeepNachan
 Microsoft MVP, MCT
 SharePoint, Microsoft 365, MS Azure

4.  Pune, India
 Twitter Handle: @SmitaNachan
 LinkedIn: /in/SmitaNachan
 Microsoft MVP, MCT
 SharePoint, Microsoft 365
Lead Software Engineer @TietoEVRY
Speaker | Author
Smita Nachan

5. Challenges with Microsoft 365
environment monitoring

6.  With the increase in usage, it is essential to keep track of user activities
 Potential security risk with admin activities
 Audit logs in the compliance center
Monitoring Microsoft 365 environments

7. Demo
Audit log in the compliance center

8. License Retention period
Office 365 E5 or Microsoft 365 E5 1 Year
(non-E5) Office 365 or Microsoft 365 90 Days
O365 Audit logs retention

9.  Auditing & Historical purpose
 Compliance
 Legal
Why we need O365 logs?

10. Azure Sentinel
Cloud-native SIEM platform

11.  Security Information and Event Manager (SIEM)
 Security Orchestration Automated Response (SOAR)
Azure Sentinel Overview
Image reference: https://docs.microsoft.com/azure/sentinel/overview

12. Demo
Set up Azure Sentinel

13. Connect Office 365 logs to Azure Sentinel
O365 Audit
Logs
User / Admin
Activities
O365 Data
Connector
Azure Sentinel
Log Analytics
Workspace
Office 365

14.  Read and write permissions on your Azure Sentinel workspace.
 Global administrator or security administrator rights on Office 365 tenant.
 Office 365 deployment must be on the same tenant as your Azure Sentinel workspace.
Prerequisites

15. Demo
Connect Office 365 logs to Azure Sentinel

16. Workbooks
Monitor the data

17.  Monitor data using the Azure Sentinel integration with Azure Monitor Workbooks
 Create custom workbooks across your data
 Combine data from various data sources and data types
 Visualize related data in a single interactive report
Workbooks

18. Demo
Azure Sentinel Workbooks

19. Analytics
Monitor the data

20.  Detect, investigate, and remediate cyber security threats
 Analyzes data from various sources to identify correlations and anomalies
 Trigger alerts based on the attack techniques
 Get insights of attack
 Create rule from Rule templates
Analytics

21. Demo
Create Analytics Rule

22. Respond to Threats
Use playbooks with automation rules in Azure Sentinel

23.  Create an automation rule
 Create a playbook
 Add actions to a playbook
 Attach a playbook to an automation rule or an analytics rule to automate threat response
Automate your incident response

24. Demo
Use playbooks with automation rules

25.  Azure Sentinel
 https://docs.microsoft.com/en-us/azure/sentinel/overview
 Monitor Office 365 Logs from Azure Sentinel
 https://nanddeepnachanblogs.com/posts/2021-03-14-monitor-o365-logs-azure-sentinel/
 Threat detection with Azure Sentinel analytics
 https://nanddeepnachanblogs.com/posts/2021-04-15-threat-detection-with-azure-sentinel-analytics/
 Log analytics samples (KQL queries) by Brian T. Jackett
 https://github.com/BrianTJackett/log-analytics-samples
References

26. Q&A

27. Thank You!
@NanddeepNachan
/in/NanddeepNachan
Nanddeep Nachan
@SmitaNachan
/in/SmitaNachan
Smita Nachan