You're reading from Microsoft Sentinel in Action Architect, design, implement, and operate Microsoft Sentinel as the core of your security solutions

Product type Paperback

Published in Feb 2022

Publisher Packt

ISBN-13 9781801815536

Length 478 pages

Edition 2nd Edition

Tools

Azure Functions

Concepts

Cybersecurity

Authors (2):

Richard Diver

Gary Bushey

View More author details

Table of Contents (23) Chapters

Preface

1. Section 1: Design and Implementation

2. Chapter 1: Getting Started with Microsoft Sentinel FREE CHAPTER

3. Chapter 2: Azure Monitor – Introduction to Log Analytics

4. Section 2: Data Connectors, Management, and Queries

5. Chapter 3: Managing and Collecting Data

6. Chapter 4: Integrating Threat Intelligence with Microsoft Sentinel

7. Chapter 5: Using the Kusto Query Language (KQL)

8. Chapter 6: Microsoft Sentinel Logs and Writing Queries

9. Section 3: Security Threat Hunting

10. Chapter 7: Creating Analytic Rules

11. Chapter 8: Creating and Using Workbooks

12. Chapter 9: Incident Management

13. Chapter 10: Configuring and Using Entity Behavior

14. Chapter 11: Threat Hunting in Microsoft Sentinel

15. Section 4: Integration and Automation

16. Chapter 12: Creating Playbooks and Automation

17. Chapter 13: ServiceNow Integration for Alert and Case Management

18. Section 5: Operational Guidance

19. Chapter 14: Operational Tasks for Microsoft Sentinel

20. Chapter 15: Constant Learning and Community Contribution

21. Assessments

22. Other Books You May Enjoy

Overview of the Entity behavior details page

No matter how you have selected the entity, the Entity behavior details page is where you will see all the information about that entity. Depending on what type of entity you have selected, the actual data will vary, but the page will follow the same format as the one shown in the following screenshot:

Figure 10.7 – Entity behavior details page

As you can see, there are three sections to this page, each of which will be described in more detail in the sections that follow.

Identifying information

This pane will show the data that can be used to identify the entity to make sure you have the correct entity and can gather more information about the entity.

Depending on the entity type, the data shown will vary, as will the source of the data. For instance, as shown in the preceding screenshot, the host type will show information regarding the OS, the last time its heartbeat was sent, as well as Azure...

The rest of the chapter is locked

You're reading from Microsoft Sentinel in Action Architect, design, implement, and operate Microsoft Sentinel as the core of your security solutions

Table of Contents (23) Chapters

Overview of the Entity behavior details page

Identifying information

Unlock this book and the full library FREE for 7 days

Authors (2)

Personalised recommendations for you