Microsoft Sentinel

We track all our systems to protect them from any threats with Microsoft Sentinel. Before Microsoft Sentinel, it was challenging to monitor our systems and fix security issues and threats fast and in time to keep our data safe. Faster alerts are easy to obtain, and we can react and correct them more quickly to protect our data.

We use it because when a user sees the suspicious activity on his account, Microsoft Sentinel gives alerts to the user's system and the admin system as well. When a user of one of our systems clicked a spam email, that email was trying to install a virus on our server, but Microsoft Sentinel gave an alert to the user and admin both, so that is why our team was able to fix that issue with Microsoft Sentinel very fast. However, it will not be the best option for you if your team is utilizing every feature but you are on a tight budget.

We mainly use it for another company tennet. They're mostly Microsoft, so we have to go inside their tenants. I know there is some products within out company that do use Microsoft as well, but we primarily use it for our other tenant.

Quarantining detections are really relevant and being able to investigate particularly what someone has done. What's not so relevant is product security or not even product security. Endpoint security and management of users, I would say.

Internally we use it to gain visibility around threats within the organization, but primarily we consult with other organizations to deploy and implement Sentinel. We have a managed service built around Sentinel. So we use Sentinel as part of our managed XDR solution that we've developed with Microsoft.

Scenarios where it's best suited would be organizations looking to consolidate on a platform, gain better visibility of threats in their environment, reduce the amount of time it takes to search for and respond. And then scenarios where it's less appropriate. Well, I guess anything where you're not collecting, where you need to collect large amounts of information to make quick decisions.

We use it as a central SIM to collect all of these security alerts from our customers. It overcomes the fact that you need some sort of way to centrally collect it, so the SIM will be your central collector.

If a company has a Microsoft First strategy and is very much already in the cloud, then Sentinel is well positioned.

The business problem is that you have a lot of threats that could come from the cloud and also on premise on really any device that is logging into your domain as company. So with Sentinel you could be aware of any signal that could mean or could imply that you are under an attack. So you could correlate several events from several devices or from several kind of inputs to identify a threat. And if you have this configure on the Pro, you could take action or send an alert to the responsible

I think that the pro is well suited for a complex environment for a big organization that has people that has a mid-size cybersecurity team in place. And it's less appropriate if you are a not so big company because the budget could be important. Barrier to adopt it right on the right way

Sentinel is an CM two to monitoring and send alerts for the incident information security alerts and consolidate many source to detect many threats and many alerts

When the customers have all products of the Microsoft or they have an suite like to Microsoft 365, they have an close to the benefits, the less cost to ingest these sources and it's an I scenario, less appropriate. Maybe when they have an G Suite or another cloud products, it's not too easy to implement.

The primary use case for us is as a managed service for our clients. We maintain dozens of instances in our client's Azure environments for them, and then we build detection rules, manage the configuration for them, and then respond to incidents with it.

I think for all medium and large organizations, I don't have any solutions where it doesn't make a lot of sense because of its flexibility. I work primarily in medium and very large size companies and it's very good there because it's flexible and adaptable as I mentioned previously. But for small companies, which I don't do a lot of business with, there's sort of easy buttons for a lot of things. So people are able to get comfortable with it pretty quickly. So I don't have a lot of problems in that sense.

Sentinel for us is the core sim engine. That is where all my event logs get correlated and it is the nerve hub of my security operation center.

The product is well suited if you have a large Microsoft ecosystem, their platforms solutions are that is what you use, which we do. I think where it is less suited is where the ecosystem is broader. And if you have less than 25% or 30% of Microsoft's capabilities deployed in your environment.

At an organization we've deployed this as one of our edge security components, so any edge traffic that comes through our system has to basically propagate through the central lab. Product scope is pretty wide because it's a lot of our API traffic.

Well suited for a organization that has a lot of traffic coming in and is busy. You can't really scan every single request that comes in, so this product is really great for that. And less appropriate would be if you have very small traffic, small number of requests coming in.

Microsoft Sentinel has helped us in Automated threat detection and action. Helped us to boost our security. Increased efficiency and security.

Very well suited for remote and on site security services. I remember after switching to Microsoft Sentinel, we were able to catch some threats that previous vendor couldn't find. Really experience matters.