Microsoft Azure Network Security

Chapter 8

Security monitoring with Azure Sentinel, Security Center, and Network Watcher

WRITTEN BY MIKE KASSIS

The previous chapter explains how to turn on logging and consolidate logs into a few areas. It also touched on some of the querying capabilities across these logs. This chapter explores how to start working with those logs. In some cases, we will have out-of-the-box (OOTB) alerting capabilities and investigation tools, which are extremely useful for handling 80% of your monitoring use cases. For the other 20%, we can build custom queries, playbooks, workbooks, and alerts. Knowing what is available and when to use a specific approach are critical to operationalizing your use of the Azure network security product stack.

First, we look ...