Azure Sentinel is not just another SIEM
Aug 5th, 2021 by Jesper Kråkhede
I get the question quite often: What is the difference between Azure Sentinel and the SIEM we already have?
On the surface they do the same thing. Collect logs, correlate them and raise alerts. But a few differences matter a lot in practice.
First, it is cloud native. There are no servers to size, no storage to buy up front and no upgrades to plan. You pay for what you ingest, and it scales when an incident suddenly needs you to bring in ten times the data.
Second, the connectors. Logs from Microsoft 365, Azure AD, Defender and Azure come in with a few clicks, and for many of them the ingestion is free. That changes the economics of logging, which I wrote about in a post on which logs you really need.
Third, it is built for hunting, not only for alerts. With KQL you can search through huge amounts of data in seconds, and there is a large library of hunting queries and detection rules, many of them shared by the community and updated when new attacks show up.
Fourth, automation. Playbooks can take action directly when something is detected, which is exactly what a SOC needs to go from reporting to acting.
It is not magic. You still need people who know what to look for. But it removes a lot of the heavy lifting.
A SIEM should help you find the attacker, not keep you busy maintaining it.