A Security Operations Centre is a centralised unit that monitors traffic, triage alerts, participates in incident response, perform threat hunting and often performs vulnerability assessments. The individuals who work in a SOC are often referred to as SOC analysts.
When it comes to Microsoft Azure SOC, the analysts work predominantly on Microsoft Security, Compliance and identity products and solutions such as Microsoft 365, Defender for Cloud, Microsoft 365 Defender, Sentinel etc.
Let's go through the top two products that are critical for a SOC. SIEM and SOAR.
A SIEM or Security Information and Event Management provides a centralised management and a holistic view of all events happening in the organisation by collecting and analysing logs from different sources across. SIEM uses correlation to detect anomalies and create alerts based on the conditions. Whereas a SOAR or Security Orchestration Automation and Response helps to handle incidents efficiently and automatically by integrating security orchestration and automation using playbooks.
Microsoft Sentinel is a combination of both SIEM and SOAR capabilities. It provides attack detection, threat visibility, threat hunting and response. Sentinel helps in incident response by collecting logs, detecting anomalies and attacks, investigating and responding to the incident. Sentinel also supports data from multiple cloud environments and on-premises.
Microsoft Sentinel workflow.
1. Collect
Using data connectors, ingest data into Microsoft Sentinel. Microsoft offers a lot of connectors to support this. The logs are stored in Log Analytics workspaces.
2. Detect
Create workbooks, also referred to as a dashboard using Kusto Query Language or KQL to process and filter data from the logs. Then use Analytics rules to provide proactive analytics by inspecting and then alert the SOC team when an event occurs.
3. Investigate
When the analytics rules detect an anomaly or suspicious events, an alert will be generated and raise a security incident ticket. This will be analysed by the SOC analysts and perform the triage by investigating the alert.
4. Respond
Responding to each alert in a large environment is tiresome and often reduces the efficiency. Therefore automation using playbooks helps to respond to the incidents and solves the alert fatigue problem. Recurring issues can be easily triaged and responded to by using playbooks. For other cases, automation helps in gathering information and helps in triaging the alert. This aids in quick and efficient incident response.
Microsoft Defender for Cloud is mainly used to view the security posture, compliance status. Along with Microsoft Sentinel, it provides a holistic security level for your cloud environment.