Microsoft Sentinel is a cloud-native SIEM and SOAR solution. Microsoft 365 offers integrated security functions for Azure Active Directory (Entra), Microsoft Defender for Office 365, Microsoft Defender for Endpoint and Microsoft Cloud App Security. However, these features do not cover all possible attack vectors and vulnerabilities that hackers could exploit. In this blog post, I explore how Microsoft Sentinel extends the capabilities of Microsoft Defender XDR (and other Defender products).<\/p>\n\n\n\n
Note: Microsoft 365 Defender was rebranded at Microsoft Ignite 2023 and is now called Microsoft Defender XDR.<\/p>\n\n\n\n
Microsoft 365 Defender provides comprehensive protection against a wide range of attack vectors such as phishing, malware, ransomware, identity theft and data breaches. It uses artificial intelligence and machine learning to analyze vast amounts of signals in Microsoft services and third-party sources and automatically block or remove threats where possible. While Microsoft 365 Defender is a very valuable and powerful tool, the solution does not completely cover all possible attack vectors and vulnerabilities, as already described in the introduction. There is also potential for improvement in terms of efficient incident handling, automatic response and hunting. This is where Microsoft Sentinel comes into play.<\/p>\n\n\n\n
The SIEM solution \"Microsoft Sentinel\" collects data from various sources and analyzes it. The data comes from deployed Azure services, local systems and other cloud providers as well as Microsoft 365 Defender. Sentinel enables organizations to gain a holistic overview of the security landscape, identify anomalies and suspicious activities and conduct investigations with KQL-Queris. These functionalities help to automate the response to incidents using playbooks (logic apps) and to create user-defined alerts and appropriate dashboards (workbooks).<\/p>\n\n\n\n
But now back to the actual topic. What is the effective benefit of linking my Microsoft 365 Defender with Microsoft Sentinel? As already mentioned several times, the functions of Microsoft 365 Defender do not cover all possible attack vectors and vulnerabilities. For example, lateral movement, cross-domain attacks or advanced persistent threats may not be detected.<\/p>\n\n\n\n
The following table provides a rough overview and a better understanding of how the functions of the two products differ.<\/p>\n\n\n\n As can be seen from the table, Microsoft Sentinel offers more flexibility and functionality than the Microsoft 365 Defender standalone solution. This is the reason why Microsoft 365 Defender should be supplemented with Sentinel. The integration of Microsoft 365 Defender into Microsoft Sentinel offers the following advantages:<\/p>\n\n\n\n Microsoft Sentinel is an Azure solution based on the Log Analytics Workspace resource. Log data that is written to this workspace and therefore to Sentinel incurs additional costs. The costs are calculated from several factors.<\/p>\n\n\n\n The costs are therefore largely dependent on how much log data is produced and how long it is stored (although it should be noted that 90 days of retention is free). The actual costs are therefore difficult to predict and caution is advised. However, there are various data types that do not incur any additional costs for Sentinel or Log Analytics Workspace and can be fed into Sentinel free of charge. These are the following connectors and data types.<\/p>\n\n\n\nCapability<\/th> Microsoft 365 Defender<\/th> Microsoft Sentinel<\/th><\/tr><\/thead> Data sources<\/strong><\/td> Microsoft 365 data mainly <\/td> Microsoft 365 data and other cloud and on-premises data (any)<\/td><\/tr> Analytics rules<\/strong><\/td> Predefined rules only<\/td> Predefined rules, user-defined rules, and community rules (GitHub)<\/td><\/tr> Investigation<\/strong><\/td> Graphical interface and advanced hunting queries<\/td> Graphical interface and advanced hunting queries<\/td><\/tr> Response<\/strong><\/td> Predefined actions and automation <\/td> Predefined playbooks, user-defined playbooks and integration with other tools<\/td><\/tr> M365 Log Retention<\/strong><\/td> 7 - 180 days, max 30 days active (depending on plan & type<\/a>)<\/td> Active for 90 days (free of charge), up to 2 years. Additional 10 years of archiving possible.<\/td><\/tr> Integration<\/strong><\/td> Mainly integrated with other Microsoft security solutions<\/td> Integrates with other Microsoft security solutions and third-party solutions.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \n
Additional costs<\/h2>\n\n\n\n
\n