Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

2/28/2019
12:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Microsoft Debuts Azure Sentinel SIEM, Threat Experts Service

New services, which are both available in preview, arrive at a time when two major trends are converging on security.

Microsoft today debuted two new security services: Azure Sentinel, a cloud-native security information and event management (SIEM) system, and Microsoft Threat Experts, a service through which security operations teams can leverage expertise from Microsoft's experts.

The two services arrive at a time when two major trends are converging on security: SOC teams are struggling with an overwhelming amount of daily alerts and a lack of staff to handle them, and more organizations are moving their data and processes over to the cloud.

"As the cloud has revolutionized modern IT architecture, more and more enterprise workloads have moved to the cloud," says Steve Dispensa, program management lead for Microsoft's cloud and AI security division. The transition especially makes sense for security workloads, he adds, as they're both data- and compute-intensive.

Enter Azure Sentinel, which Microsoft reports is the first native SIEM within a major cloud platform. Many organizations still rely on traditional SIEM tools, which typically can't keep up with the cloud's scale and complexity. The AI built into Sentinel scours large volumes of data from users, applications, servers, and devices running on-prem or in the cloud. Microsoft reports early adopters of Sentinel have seen an overall reduction of up to 90% in alert fatigue.

"One of the key goals of Azure Sentinel was to really help SOC operators use their limited bandwidth in the most effective way possible," Dispensa notes.

Azure Sentinel pulls data from Office 365, combs for threats, and combines findings with other security data for analysis. Its integration extends beyond Microsoft: Users can leverage Azure Sentinel to pull data from clouds and software built by companies including Cisco, Check Point, Palo Alto Networks, and Symantec, said Ann Johnson, Microsoft's corporate vice president of security solutions, in a briefing ahead of next week's RSA Conference.

"An early goal of Azure Sentinel was to be able to integrate well with the infrastructure and services actually in use at these large enterprises," Dispensa says. This isn't just Microsoft cloud, he points out, and not just on-prem infrastructure, but apps and services in third-party clouds.

Data import for Office 365 is free, though you need to be a licensed Office 365 customer. Azure Sentinel is limited to Azure subscribers and is available in public preview starting today, Feb. 28. The preview period is also free; pricing will be announced in the future, Microsoft says.

Microsoft Threat Experts: Now Your Threat Experts
Alongside its Azure Sentinel announcement, Microsoft unveiled a service dubbed Microsoft Threat Experts, which connects the company's security experts with its in-house security staff. The idea is to give businesses an opportunity to augment security as part of Microsoft 365.

Microsoft Threat Experts is a managed threat-hunting service built into Windows Defender Advanced Threat Protection. It's intended to provide two capabilities. The first is targeted attack notifications, which are alerts tailored to organizations' critical threats. They're intended to inform the victim with timeline, scope of breach, and method of intrusions, for example.

The second is "experts on demand." When a breach exceeds the target's ability to investigate, Microsoft's security experts will provide technical consultation. If full incident response is necessary, the client can transition to working with Microsoft incident response services.

Dustin Duran, lead for Microsoft Threat Experts, says all participants in the program are full-time Microsoft employees who can provide either of the service's capabilities. "The same set of people have intimate knowledge of the operating system and features of security products, so they're able to do both," he explains.

Windows Defender ATP customers can now apply to join the preview of this service via the Windows Defender Security Center.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15138
PUBLISHED: 2020-08-07
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin...
CVE-2020-9490
PUBLISHED: 2020-08-07
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerab...
CVE-2020-11852
PUBLISHED: 2020-08-07
DKIM key management page vulnerability on Micro Focus Secure Messaging Gateway (SMG). Affecting all SMG Appliance running releases prior to July 2020. The vulnerability could allow a logged in user with rights to generate DKIM key information to inject system commands into the call to the DKIM syste...
CVE-2020-11984
PUBLISHED: 2020-08-07
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-11985
PUBLISHED: 2020-08-07
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively...