In this article, You will learn how to monitor your on-premises servers and Azure VMs using Microsoft Sentinel. It was called Azure Sentinel, and they recently renamed it to Microsoft Sentinel.
Prerequisite
- Azure Subscription and Log Analytics Workspace
Create a Microsoft Sentinel
Step 1
Sign in to your Azure portal at https://portal.azure.com using your Microsoft credential.
Click the portal menu to select "All Services"
Then Using the Sentinel keywords to search the Microsoft Sentinel
Then select the "Microsoft Sentinel"
Steps 2
Click "Create Microsoft Sentinel"
Steps 3
Select "Create a workspace" to add Microsoft Sentinel
Steps 4
Provide the Project Details
Select the Subscription (Active subscription)
Create a new or use existing "Resource Group" (ex: MsSentinelRG)
Enter the "Workspace name" (ex: sentinelworkspace)
Then Select your "Region"
Then select "Review + Create" to validate the entered details
Steps 5
Once Validation passed, Select "Create"
Steps 6
Add Microsoft Sentinel to a workspace
Select the workspace "sentinelworkspace" and then click "Add"
Connect On-premises server to Microsoft Sentinel
Steps 1
Go to the Resource Group, where the sentinel workspace stored
Then open the SecurityInsights(sentinelworkspace)
Steps 2
Navigate to "Log Analytics Workspace"
Steps 3
Select "Agent"
Then Select your "Operating System Type"
And then "Download Windows Agent" (64/32 bit)
Steps 4
Once the download is completed, double-click to open the Windows Agent Wizard from your on-premises server
Then click "Next"
Steps 5
Select "I Agree" to Accept the Microsoft Software Licence Terms
Steps 6
If you want to store it in a different location, Click Change to select the installation folder.
Then Select "Next"
Steps 7
Select the Agent setup option "Connect the Agent to Azure Log Analytics (OMS)"
Then Select "Next"
Steps 8
Enter the Workspace ID and Workspace key to connect the agent to azure log analytics.
Steps 9
If you want to keep secure your origination, "Use Microsoft Update help keep secure and up to date"
Then Select "Next"
Steps 10
Click "Install" to start the installation of the Microsoft Monitor Agent
Steps 12
Click "Finish" to complete the wizard
Steps 13
Now officially installed Microsoft Agent on a Windows computer, you can check from the Agent management.
Steps 14
After connecting the Log Analytics workspace to Microsoft Sentinel, use existing or create analytics rules to detect threats and anomalous behaviors in your environment.
0 Comments