Monitoring and Incident Response in Azure AD

Monitoring and Incident Response in Azure AD

Channel:
United States SANS Cyber Defense
Subscribers:
23,600
Published on ● Video Link: https://www.youtube.com/watch?v=T-ZnAUt1IP8


Duration: 41:31
2,773 views
71

We are going to present our Azure AD Sec Ops guidance, so SOC teams know what to monitor, alert on and investigate. With so many events to monitor we will present the high-importance alerts recommended for investigating users, privileged accounts, apps and service principles as well as and core changes in your Azure AD environment. Key takeaways are for SOC teams to be able to collect the right logs, alert on the important events and investigate on these alerts. Will also showcase our playbooks for incident response when one of these alerts is triggered so these can be used and adapted by SOC teams so they can respond and remediate some of the most common attacks we see against Azure AD.

Yochana Henderson, Identity Program Manager, Microsoft
Thomas Detzner, Senior Program Manager, Microsoft

View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#BlueTeamSummit #Azure



Other Videos By SANS Cyber Defense


2021-11-22Bringing the Sexy Back to Blue Team, with Eric Conrad and Seth Misener
2021-11-17Modern Authentication for the Security Admin
2021-11-15DeTT&CT(ing) Kubernetes ATT&CK(s) with Audit Logs
2021-11-13Ransomware Preparation, Containment and Recovery Strategies
2021-11-12Building on the Foundations of OSINT with SEC587: Advanced Open-Source Intelligence
2021-11-12AI & ML in the Modern SOC
2021-11-11YARA for Mere Mortals
2021-11-09Threat Sightings: The Power of Observation for Driving Cyber Threat Detection Improvements
2021-11-07Blue-Team-as-Code: Lessons From Real-world Red Team Detection Automation Using Logs
2021-11-05Measuring Detection Engineering Teams
2021-11-02Monitoring and Incident Response in Azure AD
2021-11-01Threats & Challenges 2021: What Cyber Defenders Need to Know – and Do
2021-10-30Knocking on Clouds Door: Threat Hunting Powered by Azure AD Reports and Azula
2021-10-29Random Forests: Still Useful?
2021-10-28Data Science for SOC: A Practical Example of Detecting Advanced Credential Attacks
2021-10-26TShark: Leveraging statistics | Nik Alleyne
2021-10-26The Yellow Brick Road: Where Lions and Tigers and Bears Meet
2021-10-24Adversary Simulation: Measure and Close the Gaps in Your Security Posture
2021-10-22Can we REALLY 10X the SOC?
2021-10-21Zero Trust Architecture – Applying ZTA in Today’s Environment
2021-10-20A River Runs Through IT: What Whitewater Rafting Taught Me About Incident Response


Tags:
sans institute
blue team
blue team operations
blue team summit
sans blue team summit
yochana henderson
thomas detzner
incident response
incident resonse monitoring
incident response in azure ad
azure active directory
azure active directory (ad)