Security Monitoring Using Microsoft Sentinel and Defender
In the previous chapter, we took a closer look at some of the fundamental parts of building a secure foundation related to networking, identity, vulnerability, and patch management, as well as into the basics of security monitoring.
Now, we will focus on how we can set up security monitoring within our environment, regardless of whether it is running on-premises or in the public cloud. We will be using Microsoft Sentinel, Microsoft Defender for Endpoint, as well as Microsoft Defender for Servers, which are useful tools to have in our toolbox to detect abnormal activities within our environment. We will take a closer look at how the services work and how we can use them, before taking a closer look at Microsoft Defender and some of the capabilities it has for vulnerability management.
In this chapter, we will cover the following topics:
- Understanding Microsoft Sentinel and Microsoft Defender
- Designing and implementing...
