Interpreting technical threat intelligence and recommending risk mitigations
Microsoft is at the forefront globally for reviewing and recognizing threats through its alliances and participation in the cyber threat intelligence (CTI) network. The information that is gathered through the CTI reports, communities, investigation feeds, and organizational security investigations are used within Microsoft’s cloud services for customers to identify threats and vulnerabilities within their environments.
SIEM solutions are the primary tools that customers can use for evaluating CTI. Within Microsoft and Azure, that solution is Microsoft Sentinel. Microsoft Sentinel utilizes CTI from a variety of security solutions within Microsoft and other third-party solutions to provide a single source to identify and interpret potential threats and attacks within your company environment.
Figure 6.24 shows this flow of information within Microsoft Sentinel:
...
