Cantitate/Preț
Produs
Total produse
Vezi coșul
Microsoft Azure Sentinel: Planning and implementing Microsoft's cloud-native SIEM solution de Yuri Diogenes

Microsoft Azure Sentinel: Planning and implementing Microsoft's cloud-native SIEM solution

Autor Yuri Diogenes, Nicholas Dicola, Tiander Turpijn
en Limba Engleză Paperback – 19 aug 2022

În domeniul securității cibernetice, migrarea către soluții cloud-native a devenit o necesitate pentru a face față volumului masiv de date. Microsoft Azure Sentinel, scris de Yuri Diogenes, Nicholas Dicola și Tiander Turpijn, reprezintă ghidul tehnic esențial pentru implementarea unei soluții SIEM (Security Information and Event Management) scalabile. Observăm că autorii, toți experți în cadrul Microsoft, nu se limitează la o prezentare teoretică, ci oferă o foaie de parcurs practică pentru modernizarea operațiunilor de securitate (SecOps). Structura cărții urmărește o progresie logică: începe cu analiza provocărilor actuale de securitate și arhitectura Microsoft Sentinel, continuând cu aspecte critice precum ingestia datelor prin conectori și definirea regulilor de analiză pentru a preveni oboseala generată de alerte (alert fatigue). Ne-a atras atenția includerea detaliată a conceptelor de orchestrare și automatizare (SOAR) prin utilizarea Playbook-urilor, precum și utilizarea notebook-urilor Jupyter pentru vânătoarea de amenințări (threat hunting). Dacă Learn Azure Sentinel de Richard Diver v-a oferit cadrul teoretic și o introducere în configurare, această ediție a doua a Microsoft Azure Sentinel oferă instrumentele practice avansate și cele mai bune practici validate în teren. Subliniem importanța anexelor tehnice, în special introducerea în Kusto Query Language (KQL), limbajul fundamental pentru interogarea logurilor în Azure. Tonul este riguros și aplicat, concentrându-se pe modul în care machine learning și UEBA (User and Entity Behavior Analytics) pot fi integrate pentru a identifica atacurile sofisticate care reușesc să treacă de barierele tradiționale. Este o resursă indispensabilă pentru cei care doresc să automatizeze răspunsul la incidente și să obțină o vizibilitate totală asupra întregii infrastructuri cloud.

Citește tot Restrânge

Preț: 20460 lei

Preț vechi: 25574 lei
-20%

Puncte Express: 307

Carte disponibilă

Livrare economică 18 septembrie-02 octombrie
Livrare express 03-09 septembrie pentru 2943 lei

Livrare prin curier în România Termenul estimat este afișat lângă disponibilitate.
Transport gratuit de la 40000 lei Plată online sau ramburs, în funcție de opțiunile comenzii.
Retur gratuit în 14 zile Comandă securizată și suport în română.
 Adaugă în coș

Wish list
Gift list
Am citit!
Adaugă în listă

Specificații

ISBN-13: 9780137900930
ISBN-10: 0137900937
Pagini: 240
Dimensiuni: 195 x 235 x 14 mm
Greutate: 0.47 kg
Ediția:2. Auflage
Editura: Microsoft Press

De ce să citești această carte

Recomandăm această carte administratorilor de securitate și analiștilor SOC care au nevoie de o metodologie clară pentru implementarea Microsoft Sentinel. Veți câștiga expertiză în automatizarea sarcinilor repetitive prin Playbooks și în utilizarea interogărilor KQL pentru investigații complexe. Este un instrument practic care transformă gestionarea securității dintr-un proces reactiv într-unul proactiv, facilitând decizii rapide bazate pe date vizualizate corect.

Cuprins

CHAPTER 1: Security challenges for SecOps
CHAPTER 2: Introduction to Microsoft Sentinel
CHAPTER 3: Analytics
CHAPTER 4: Incident management
CHAPTER 5: Hunting
CHAPTER 6: Notebooks
CHAPTER 7: Automating response
CHAPTER 8: Data visualization
CHAPTER 9: Data connectors
APPENDIX A: Introduction to Kusto Query Language
APPENDIX B: Microsoft Sentinel for managed security service providers

Descriere

Build next-generation security operations with Microsoft Sentinel Microsoft Sentinel is the scalable, cloud-native, security information and event management (SIEM) solution for automating and streamlining threat identification and response across your enterprise. Now, three leading experts guide you step-by-step through planning, deployment, and operations, helping you use Microsoft Sentinel to escape the complexity and scalability challenges of traditional solutions. Fully updated for the latest enhancements, this edition introduces new use cases for investigation, hunting, automation, and orchestration across your enterprise and all your clouds. The authors clearly introduce each service, concisely explain all new concepts, and present proven best practices for maximizing Microsoft Sentinel's value throughout security operations. Three of Microsoft's leading security operations experts show how to: Review emerging challenges that make better cyberdefense an urgent priority See how Microsoft Sentinel responds by unifying alert detection, threat visibility, proactive hunting, and threat response Explore components, architecture, design, and initial configuration Ingest alerts and raw logs from all sources you need to monitor Define and validate rules that prevent alert fatigue Use threat intelligence, machine learning, and automation to triage issues and focus on high-value tasks Add context with User and Entity Behavior Analytics (UEBA) and Watchlists Hunt sophisticated new threats to disrupt cyber kill chains before you're exploited Enrich incident management and threat hunting with Jupyter notebooks Use Playbooks to automate more incident handling and investigation tasks Create visualizations to spot trends, clarify relationships, and speed decisions Simplify integration with point-and-click data connectors that provide normalization, detection rules, queries, and Workbooks About This Book For cybersecurity analysts, security administrators, threat hunters, support professionals, engineers, and other IT professionals concerned with security operations For both Microsoft Azure and non-Azure users at all levels of experience

Notă biografică

YURI DIOGENES is a Senior Content Developer on the CSI Enterprise Mobility and Security Team, focusing on enterprise mobility solutions, Azure Security Center, and OMS Security. Previously, Yuri worked at Microsoft as a writer for the Windows Security team and as a Support Escalation Engineer for the CSS Forefront team. He has a Master of Science degree in Cybersecurity Intelligence and Forensics from Utica College and an MBA from FGF in Brazil, and he holds several industry certifications. He is co-author of Enterprise Mobility Suite–Managing BYOD and Company-Owned Devices (Microsoft Press, 2015), Microsoft Forefront Threat Management Gateway (TMG) Administrator’s Companion (Microsoft Press, 2010), and three other Forefront titles from Microsoft Press.DR. THOMAS SHINDER is a program manager in Azure Security Engineering and a 20-year veteran in IT security. Tom is best known for his work with ISA Server and TMG, publishing nine books on those topics. He was also the leading voice at ISAserver.org. After joining Microsoft in 2009, Tom spent time on the UAG DirectAccess team and then took a 3-year vacation from security to be a cloud infrastructure specialist and architect. He’s now back where he belongs in security, and spends a good deal of time hugging his Azure Security Center console and hiding his secrets in Azure Key Vault.DEBRA LITTLEJOHN SHINDER, MCSE, is a former police officer and police academy instructor who is self-employed as a technol¿ogy consultant, trainer, and writer, specializing in network and cloud security. She has authored a number of books, including Scene of the Cybercrime: Computer Forensics Handbook (Syngress Publishing, 2002) and Computer Networking Essentials (Cisco Press, 2001). She has co-authored more than 20 additional books and worked as a tech editor, developmental editor, and contributor to more than 15 books. Deb is a lead author for WindowSecurity.com and WindowsNetworking.com, and a long-time contributor to the GFI Software blog and other technology publications, with more than 1,500 published articles in print magazines and on websites. Deb focuses on Microsoft products, and has been awarded the Microsoft MVP (Most Valuable Professional) award in the field of enterprise security for 14 years in a row. She lives and works in the Dallas-Fort Worth area and has taught law enforcement, computer networking, and security courses at Eastfield College in Mesquite, Texas. She currently sits on the advisory board of the Eastfield Criminal Justice Training Center Police Academy.