Investigate Windows Security Events with Azure Sentinel

Lab Scenario

To help you walk through the lab, consider the following scenario:

You work as a cyber security engineer, and you have a large Windows server fleet that you need to manage the security for. You are looking at Azure Sentinel as a possible solution to collect, detect, investigate and, respond to security threat events.

Using an exsting resource group, you will complete the following:

1. Deploy Azure Sentinel by adding it to the existing Log Analytics workspace.
2. Configure the Windows Security Events data connector and enable some of the built-in analytics rules to alert when security events occur.
3. Log in to the Windows VM and perform actions that generate security events.
4. Use Azure Sentinel to investigate the incidents created by those events.

Lab Setup

The objectives for this hands-on lab can be completed using the Azure portal and the provided Windows virtual machine.

Note: To complete this lab, you will need to use a remote desktop client.

• Windows: Microsoft Remote Desktop on Windows 10
• MacOS: Microsoft Remote Desktop
• Linux: Remmina

From the lab page, launch the Azure portal in a private browser window. (This option will read differently depending on your browser — for example, in Chrome, it reads Open Link in Incognito Window.) Then, sign in using the credentials provided.