Windows Ransomware Detection and Protection

3

Security Monitoring Using Microsoft Sentinel and Defender

In the previous chapter, we took a closer look at some of the fundamental parts of building a secure foundation related to networking, identity, vulnerability, and patch management, as well as into the basics of security monitoring.

Now, we will focus on how we can set up security monitoring within our environment, regardless of whether it is running on-premises or in the public cloud. We will be using Microsoft Sentinel, Microsoft Defender for Endpoint, as well as Microsoft Defender for Servers, which are useful tools to have in our toolbox to detect abnormal activities within our environment. We will take a closer look at how the services work and how we can use them, before taking ...