Monitoring and Incident Response in Azure AD
Автор: SANS Cyber Defense
Загружено: 2021-11-02
Просмотров: 4698
We are going to present our Azure AD Sec Ops guidance, so SOC teams know what to monitor, alert on and investigate. With so many events to monitor we will present the high-importance alerts recommended for investigating users, privileged accounts, apps and service principles as well as and core changes in your Azure AD environment. Key takeaways are for SOC teams to be able to collect the right logs, alert on the important events and investigate on these alerts. Will also showcase our playbooks for incident response when one of these alerts is triggered so these can be used and adapted by SOC teams so they can respond and remediate some of the most common attacks we see against Azure AD.
Yochana Henderson, Identity Program Manager, Microsoft
Thomas Detzner, Senior Program Manager, Microsoft
View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#BlueTeamSummit #Azure
Доступные форматы для скачивания:
Скачать видео mp4
-
Информация по загрузке:
