Microsoft Sentinel

We track all our systems to protect them from any threats with Microsoft Sentinel. Before Microsoft Sentinel, it was challenging to monitor our systems and fix security issues and threats fast and in time to keep our data safe. Faster alerts are easy to obtain, and we can react and correct them more quickly to protect our data.

• We catch problems faster
• Everything is in one place
• Less manual work for the team
• Good return on investment

Sumo Logic

Miro, SAP Sales Cloud, Webex Meetings

Microsoft Sentinel is used both as siem and soar solution in our customer environment . We are also sending logs from Microsoft Sentinel to prisma. We are running kql queries on Microsoft Sentinel to do threat hunting

• reduced cost occured for legacy system and saving 50000 dollar upto 1 year
• reduced false positive incidents up to 90 percent
• faster deployment over 100000 dollar up to 1 year

Splunk Cloud

Splunk Cloud, IBM Security QRadar EDR, LogRhythm NetworkXDR

Internally we use it to gain visibility around threats within the organization, but primarily we consult with other organizations to deploy and implement Sentinel. We have a managed service built around Sentinel. So we use Sentinel as part of our managed XDR solution that we've developed with Microsoft.

• Probably one of my main business objectives is to drive services for our organization. Sentinel provides numerous opportunities for us to drive those services. Implementation, ongoing management, and I think because of our customer base, so interested in SOC services and our focus on Sentinel. Yeah, profitability is our objective and it helps us achieve that.

Microsoft Defender for Endpoint

Microsoft Sentinel is used as log management and SIEM tool , the tool replaces legacy on prem SIEMs having all your logs in the cloud.

the tool solves security monitoring and threat hunting problems.

it also enables an integrated automation solution (logic apps) from within the solution it self .

the connectors (log source integrations )usually comes with multiple detection rules and dashboards

• Made it so easy to integrate MS solutions into SIEM

LogRhythm NextGen SIEM Platform and IBM Security QRadar SIEM

IBM Security QRadar SOAR, Palo Alto Networks Cortex XSOAR, Splunk Enterprise Security

Its integrated into a SOC to provide real-time visibility, reduce alert fatigue, and improve mean time to resolution (MTTR) - which we are achieving via custom playbooks. Monitor login activities, network traffic, and endpoint behavior to detect anomalies like brute-force attacks or compromised accounts. We have also found that our posture improved by 30% within the first month.

• Improved security posture
• Improved response times
• reduced false positives
• could also say alert fatigue improved

Splunk Enterprise Security and SentinelOne Singularity

Fortinet FortiExtender, Palo Alto Networks Cortex XDR, SentinelOne Singularity