AZ 500 Azure Security Technologies LAB 15 Azure Sentinel - Hands On Lab from Github

AZ 500 Azure Security Technologies LAB 15 Azure Sentinel - Hands On Lab from Github

Tasks covered:

Task 1: On-board Azure Sentinel
Task 2: Connect Azure Activity to Sentinel
Task 3: Create a rule that uses the Azure Activity data connector.
Task 4: Create a playbook
Task 5: Create a custom alert and configure the playbook as an automated response.
Task 6: Invoke an incident and review the associated actions.

Github:

[nickhairapetian]

Thank You So Much. Your Videos help me avoid repeating the AZ-500 class for the 2nd time. Your explanations and watching you do it a couple of times made me feel comfortable enough to cancel my 2nd session.
Can you please create a session for AZ-140, SC-300, SC-400, and SC-200 labs? :-)

[oscarquinonez]

I wonder if the reason why the alert is not triggering because you set the timers of the app logic to query every 5 minutes, but you are only grabbing a data set that is 5 minutes ago. Which means that if the alert triggered 10 minutes ago, then the block of logs that get analyzed will never contain the JIT deletion?