Centralizing Cloud Logs and Events with Microsoft Sentinel

Centralized cloud logging and monitoring is a crucial aspect of enterprise multicloud environments. Pulling cross-cloud events into a central SIEM / SOAR solution offers a consolidated view of all important logs and events generated across various accounts and regions, providing a single point of log access and an opportunity for log correlation.

In this webcast, join the authors of SEC549: Cloud Security Architecture to explore the push and pull logging architecture used by Microsoft Sentinel to ingest cross-cloud audit logs. Attendees will see the log journey from both AWS CloudTrail and Google Cloud Audit Logs into Microsoft Sentinel and learn some fun Kusto Query Language (KQL) queries to investigate cloud events.

Learning Objectives:
* Understand push and pull log export architecture patterns
* Learn how to set up a Sentinel data connector for AWS S3
* Learn how to run Kusto Query Language (KQL) queries to find suspicious events

About the Speakers:

SANS Cloud Security focuses the deep resources of SANS on the growing threats to The Cloud by providing training, GIAC certification, research, and community initiatives to help security professionals build, deploy and manage secure cloud infrastructure, platforms, and applications.

Twitter: @SANSCloudSec

[noname-vlvy]

this is a big help
but can you have a session where you filter the logs from the aws side before sending it to sentinel? is it even possible? how?