1
00:00:00,000 --> 00:00:02,860
So what happens to your data when a former employee

2
00:00:02,860 --> 00:00:05,080
logs into your tenant six months after they quit?

3
00:00:05,080 --> 00:00:06,320
I'm serious, think about it.

4
00:00:06,320 --> 00:00:08,320
You disabled their account when they left.

5
00:00:08,320 --> 00:00:11,180
But did you check if a device still holds cash credentials?

6
00:00:11,180 --> 00:00:12,720
Did you look to see if an app registration

7
00:00:12,720 --> 00:00:14,120
they created still works?

8
00:00:14,120 --> 00:00:16,360
Most Microsoft 365 admins have no idea,

9
00:00:16,360 --> 00:00:17,720
not because they're bad at their jobs,

10
00:00:17,720 --> 00:00:19,040
but because the information they need

11
00:00:19,040 --> 00:00:20,800
is scattered across 20 different places.

12
00:00:20,800 --> 00:00:21,640
Here's the old way.

13
00:00:21,640 --> 00:00:23,440
You want to investigate a suspicious sign in,

14
00:00:23,440 --> 00:00:26,360
so you open the EntraAdmin Center to check the audit logs,

15
00:00:26,360 --> 00:00:28,640
then you hop over to exchange to see if any mail rules

16
00:00:28,640 --> 00:00:29,560
were created.

17
00:00:29,560 --> 00:00:31,840
Then you check SharePoint for unusual file access,

18
00:00:31,840 --> 00:00:34,960
then Defender for any alerts, then Teams for any strange activity.

19
00:00:34,960 --> 00:00:36,920
By the time you've checked five dashboards,

20
00:00:36,920 --> 00:00:38,160
you've already lost the thread.

21
00:00:38,160 --> 00:00:40,000
And that's just one user on one day.

22
00:00:40,000 --> 00:00:41,800
This is where Microsoft Sentinel comes in.

23
00:00:41,800 --> 00:00:43,720
Think of it as the security camera system

24
00:00:43,720 --> 00:00:45,200
for your entire digital building.

25
00:00:45,200 --> 00:00:47,040
You know how a physical office has cameras

26
00:00:47,040 --> 00:00:49,520
at every entrance, every hallway, every door.

27
00:00:49,520 --> 00:00:51,280
And one security guard can watch all of them

28
00:00:51,280 --> 00:00:52,480
from a single screen.

29
00:00:52,480 --> 00:00:55,240
That's what Sentinel does for your Microsoft 365 tenant.

30
00:00:55,240 --> 00:00:57,840
It takes all those separate logs from Entra from Exchange,

31
00:00:57,840 --> 00:00:59,280
from SharePoint from Defender

32
00:00:59,280 --> 00:01:01,640
and puts them in one place where you can actually see

33
00:01:01,640 --> 00:01:02,480
what's happening.

34
00:01:02,480 --> 00:01:04,160
By the end of this episode, you'll understand

35
00:01:04,160 --> 00:01:05,600
what Sentinel actually does.

36
00:01:05,600 --> 00:01:08,000
How its new data lake changes the game for keeping logs

37
00:01:08,000 --> 00:01:09,320
without breaking the bank.

38
00:01:09,320 --> 00:01:13,000
And why this matters for every Microsoft 365 admin,

39
00:01:13,000 --> 00:01:15,600
not just security teams with fancy titles,

40
00:01:15,600 --> 00:01:17,360
grab your coffee and let's dive in.

41
00:01:17,360 --> 00:01:18,960
What a seam actually does.

42
00:01:18,960 --> 00:01:21,440
Sentinel is what the industry calls a CM.

43
00:01:21,440 --> 00:01:23,920
That stands for Security Information and Event Management.

44
00:01:23,920 --> 00:01:25,280
Let's say that in plain English.

45
00:01:25,280 --> 00:01:27,680
A CM is a tool that collects logs from everywhere,

46
00:01:27,680 --> 00:01:29,800
your servers, your firewalls, your apps,

47
00:01:29,800 --> 00:01:32,120
your identity systems and then connects the dots

48
00:01:32,120 --> 00:01:32,880
between them.

49
00:01:32,880 --> 00:01:33,960
Here's why that matters.

50
00:01:33,960 --> 00:01:35,800
A single log entry is just noise.

51
00:01:35,800 --> 00:01:37,520
Someone tried to log in and failed.

52
00:01:37,520 --> 00:01:38,200
Big deal.

53
00:01:38,200 --> 00:01:40,000
That happens hundreds of times a day.

54
00:01:40,000 --> 00:01:41,960
But a seam doesn't look at one log entry.

55
00:01:41,960 --> 00:01:43,520
It looks at all of them together.

56
00:01:43,520 --> 00:01:45,160
So it can see that the same IP address

57
00:01:45,160 --> 00:01:47,720
tried to log into five different accounts in 30 seconds.

58
00:01:47,720 --> 00:01:48,640
That's not noise anymore.

59
00:01:48,640 --> 00:01:50,080
That's a brute force attack.

60
00:01:50,080 --> 00:01:51,720
The magic is in the correlation.

61
00:01:51,720 --> 00:01:53,640
A seam takes a suspicious log in from Entra

62
00:01:53,640 --> 00:01:55,880
and connects it to a file download from SharePoint

63
00:01:55,880 --> 00:01:57,960
and an email-forwarding rule from Exchange.

64
00:01:57,960 --> 00:02:00,000
Alone, none of those things look like an attack.

65
00:02:00,000 --> 00:02:01,280
Together they tell a story.

66
00:02:01,280 --> 00:02:03,160
Someone got in, found what they wanted

67
00:02:03,160 --> 00:02:05,240
and set up a way to keep getting your mail.

68
00:02:05,240 --> 00:02:07,040
Think of it like a traffic control center.

69
00:02:07,040 --> 00:02:08,360
You don't just watch one camera.

70
00:02:08,360 --> 00:02:09,520
You watch all of them at once

71
00:02:09,520 --> 00:02:11,640
and you look for patterns, a car that passes

72
00:02:11,640 --> 00:02:13,400
the same intersection four times,

73
00:02:13,400 --> 00:02:15,680
a person who enters the building but never leaves.

74
00:02:15,680 --> 00:02:17,960
That's what a seam does for your digital environment.

75
00:02:17,960 --> 00:02:19,800
The key inside here is simple but powerful.

76
00:02:19,800 --> 00:02:21,560
You can't protect what you can't see.

77
00:02:21,560 --> 00:02:23,880
If your security data is scattered across 20 dashboards,

78
00:02:23,880 --> 00:02:24,720
you're blind.

79
00:02:24,720 --> 00:02:26,200
You might catch the obvious stuff

80
00:02:26,200 --> 00:02:28,320
but the subtle attacks, the ones that happen slowly

81
00:02:28,320 --> 00:02:31,000
over weeks or months, those will slip right past you.

82
00:02:31,000 --> 00:02:32,480
Now here's the thing about Sentinel.

83
00:02:32,480 --> 00:02:35,080
It is a CM but it's more than that.

84
00:02:35,080 --> 00:02:37,680
The soar part, why Sentinel has hands?

85
00:02:37,680 --> 00:02:39,880
A traditional CM works like a security camera.

86
00:02:39,880 --> 00:02:41,240
It shows you everything going on

87
00:02:41,240 --> 00:02:43,160
but it can't actually do anything about it.

88
00:02:43,160 --> 00:02:45,600
It sees a break in but can't call the police.

89
00:02:45,600 --> 00:02:46,920
That's where Soar comes in.

90
00:02:46,920 --> 00:02:49,400
Soar stands for security orchestration, automation

91
00:02:49,400 --> 00:02:52,280
and response, the part of Sentinel that has hands.

92
00:02:52,280 --> 00:02:54,880
Here's how it plays out. Sentinel spots a threat.

93
00:02:54,880 --> 00:02:56,880
A user's account gets compromised.

94
00:02:56,880 --> 00:02:59,240
Someone logs in from a country they've never visited

95
00:02:59,240 --> 00:03:01,560
and starts downloading files they've never touched.

96
00:03:01,560 --> 00:03:03,280
A traditional CM would create an alert

97
00:03:03,280 --> 00:03:05,920
and wait for a human to respond which could take hours

98
00:03:05,920 --> 00:03:07,520
and by then the damage is already done.

99
00:03:07,520 --> 00:03:08,640
Sentinel doesn't wait.

100
00:03:08,640 --> 00:03:09,920
It acts automatically.

101
00:03:09,920 --> 00:03:11,680
It can disable that user's account,

102
00:03:11,680 --> 00:03:13,600
block their device from company resources,

103
00:03:13,600 --> 00:03:16,560
revoke active sessions and notify the security team

104
00:03:16,560 --> 00:03:19,440
all in seconds without a human touching anything.

105
00:03:19,440 --> 00:03:22,400
This automation runs on something Sentinel calls playbooks.

106
00:03:22,400 --> 00:03:25,520
Basically they're automated to do lists for security incidents.

107
00:03:25,520 --> 00:03:27,080
When a specific alert fires,

108
00:03:27,080 --> 00:03:28,800
Sentinel runs the matching playbook.

109
00:03:28,800 --> 00:03:30,480
If this happens, do that.

110
00:03:30,480 --> 00:03:33,360
Simple and you don't need to be a programmer to build them.

111
00:03:33,360 --> 00:03:35,120
They're created with a visual designer

112
00:03:35,120 --> 00:03:36,480
just like drawing a flowchart.

113
00:03:36,480 --> 00:03:39,920
So why does this matter for you as a Microsoft 365 admin?

114
00:03:39,920 --> 00:03:41,520
Because you don't want to wake up at 3am

115
00:03:41,520 --> 00:03:43,160
to manually block an IP address.

116
00:03:43,160 --> 00:03:44,480
You've got better things to do

117
00:03:44,480 --> 00:03:46,600
and honestly you won't be fast enough anyway.

118
00:03:46,600 --> 00:03:49,040
By the time you stumble to your laptop and log in,

119
00:03:49,040 --> 00:03:51,160
the attack has already done what they came to do.

120
00:03:51,160 --> 00:03:52,440
Automation isn't a luxury.

121
00:03:52,440 --> 00:03:53,520
It's a necessity.

122
00:03:53,520 --> 00:03:56,120
So Sentinel detects threats and correlates signals

123
00:03:56,120 --> 00:03:57,680
across your entire environment.

124
00:03:57,680 --> 00:03:58,880
And when something bad happens,

125
00:03:58,880 --> 00:04:00,080
it responds automatically.

126
00:04:00,080 --> 00:04:01,760
That's seam and so are working together.

127
00:04:01,760 --> 00:04:04,920
But where does Sentinel actually live in the Microsoft world?

128
00:04:04,920 --> 00:04:06,600
That's what we'll cover next.

129
00:04:06,600 --> 00:04:09,080
Sentinel's place in the Microsoft security stack.

130
00:04:09,080 --> 00:04:11,560
Microsoft has a whole portfolio of security products,

131
00:04:11,560 --> 00:04:13,240
Defender for endpoint protection,

132
00:04:13,240 --> 00:04:14,960
Entra for identity and access,

133
00:04:14,960 --> 00:04:17,920
Per view for data security and Intune for device management.

134
00:04:17,920 --> 00:04:19,520
Each one does its own job well.

135
00:04:19,520 --> 00:04:22,280
But here's the thing, they don't naturally talk to each other.

136
00:04:22,280 --> 00:04:24,400
Defender spots a suspicious file,

137
00:04:24,400 --> 00:04:26,120
Entra flags a weird log in,

138
00:04:26,120 --> 00:04:28,360
Per view catches unusual data access,

139
00:04:28,360 --> 00:04:30,760
three separate alerts, three separate dashboards,

140
00:04:30,760 --> 00:04:32,160
three separate investigations.

141
00:04:32,160 --> 00:04:33,480
That's where Sentinel comes in.

142
00:04:33,480 --> 00:04:35,080
It sits underneath all of them.

143
00:04:35,080 --> 00:04:37,440
Not as a competitor, but as the foundation.

144
00:04:37,440 --> 00:04:39,000
Think of it like the floor of a building.

145
00:04:39,000 --> 00:04:41,800
The rooms are Defender, Entra, Per view and Intune,

146
00:04:41,800 --> 00:04:43,400
each with their own purpose.

147
00:04:43,400 --> 00:04:44,880
But the floor is what connects them,

148
00:04:44,880 --> 00:04:46,560
letting you walk from one room to another

149
00:04:46,560 --> 00:04:47,880
without stepping into the void.

150
00:04:47,880 --> 00:04:50,400
Notice I didn't say Sentinel competes with Defender.

151
00:04:50,400 --> 00:04:51,080
It doesn't.

152
00:04:51,080 --> 00:04:53,480
Defender is great at detecting threats on endpoints

153
00:04:53,480 --> 00:04:55,440
and across Microsoft 365,

154
00:04:55,440 --> 00:04:56,720
but it only sees what it sees.

155
00:04:56,720 --> 00:04:59,320
It doesn't know about your on-premises firewall logs

156
00:04:59,320 --> 00:05:01,840
or your AWS cloud trail logs.

157
00:05:01,840 --> 00:05:03,920
Sentinel is the platform Defender sits on,

158
00:05:03,920 --> 00:05:05,520
not the product that replaces it.

159
00:05:05,520 --> 00:05:07,000
Here's a big shift you need to know about.

160
00:05:07,000 --> 00:05:09,600
Microsoft is consolidating everything into one place.

161
00:05:09,600 --> 00:05:11,920
After March 30, 2027,

162
00:05:11,920 --> 00:05:15,040
Sentinel will no longer be available in the Azure portal.

163
00:05:15,040 --> 00:05:17,520
It will only live in the Microsoft Defender portal.

164
00:05:17,520 --> 00:05:19,840
For years, you have to jump between the Azure portal

165
00:05:19,840 --> 00:05:22,720
for Sentinel and the Defender portal for XDR.

166
00:05:22,720 --> 00:05:23,560
That's going away.

167
00:05:23,560 --> 00:05:26,240
Microsoft is building one unified security operation center

168
00:05:26,240 --> 00:05:28,160
and the Defender portal is where it lives.

169
00:05:28,160 --> 00:05:29,480
What does this mean for you?

170
00:05:29,480 --> 00:05:30,760
Fewer portals to learn.

171
00:05:30,760 --> 00:05:32,120
Less context switching.

172
00:05:32,120 --> 00:05:34,160
One place where you can see your incidents,

173
00:05:34,160 --> 00:05:36,960
hunt for threats and manage your security posture.

174
00:05:36,960 --> 00:05:38,240
It's a move towards simplicity

175
00:05:38,240 --> 00:05:39,880
and for Microsoft 365 admins

176
00:05:39,880 --> 00:05:41,880
who already live in the Defender portal,

177
00:05:41,880 --> 00:05:43,640
that's good news, but the real game changer,

178
00:05:43,640 --> 00:05:44,720
that's the data lake.

179
00:05:44,720 --> 00:05:46,120
We'll cover that next.

180
00:05:46,120 --> 00:05:48,360
The new unified data lake, what changed?

181
00:05:48,360 --> 00:05:50,200
So here's the problem Sentinel always had,

182
00:05:50,200 --> 00:05:53,400
keeping logs around cost a lot, not just a little, a lot.

183
00:05:53,400 --> 00:05:55,240
The default retention was 90 days.

184
00:05:55,240 --> 00:05:57,840
After that, you either paid a premium to keep the data

185
00:05:57,840 --> 00:05:59,720
or said goodbye to it forever.

186
00:05:59,720 --> 00:06:03,000
Most organizations chose to delete logs after three months,

187
00:06:03,000 --> 00:06:05,240
which meant they were flying blind past that point.

188
00:06:05,240 --> 00:06:07,520
Microsoft solved this with the unified data lake

189
00:06:07,520 --> 00:06:09,160
and it changes the math completely.

190
00:06:09,160 --> 00:06:11,160
Sentinel now separates storage from compute.

191
00:06:11,160 --> 00:06:12,720
In the old model, you paid one price

192
00:06:12,720 --> 00:06:16,080
that covered both storing data and being able to query it quickly.

193
00:06:16,080 --> 00:06:18,160
That made sense for active investigations,

194
00:06:18,160 --> 00:06:20,400
but it was terrible for long term retention.

195
00:06:20,400 --> 00:06:22,240
You were paying for speed you didn't need on data

196
00:06:22,240 --> 00:06:23,240
you barely touched.

197
00:06:23,240 --> 00:06:24,560
The data lake flips that.

198
00:06:24,560 --> 00:06:26,640
You store your data in a low cost tier.

199
00:06:26,640 --> 00:06:29,160
It's still there, still accessible, still searchable,

200
00:06:29,160 --> 00:06:30,360
but you only pay for compute

201
00:06:30,360 --> 00:06:32,040
when you actually run a query against it.

202
00:06:32,040 --> 00:06:33,720
Think of it like the difference between

203
00:06:33,720 --> 00:06:36,120
renting a storage unit versus having a basement.

204
00:06:36,120 --> 00:06:37,600
The storage unit costs you every month,

205
00:06:37,600 --> 00:06:38,920
whether you use it or not.

206
00:06:38,920 --> 00:06:39,960
The basement is just there.

207
00:06:39,960 --> 00:06:42,440
You only spend money when you go down and look for something.

208
00:06:42,440 --> 00:06:43,680
The numbers speak for themselves.

209
00:06:43,680 --> 00:06:46,240
Microsoft says storing data in the data lake costs less

210
00:06:46,240 --> 00:06:49,400
than 15% of what traditional analytics logs cost.

211
00:06:49,400 --> 00:06:51,880
That's the difference between keeping logs for three months

212
00:06:51,880 --> 00:06:53,680
versus three years or even 12 years,

213
00:06:53,680 --> 00:06:55,320
which is the new retention maximum

214
00:06:55,320 --> 00:06:56,680
or without breaking the bank.

215
00:06:56,680 --> 00:06:58,960
And the best part, you don't have to do anything extra.

216
00:06:58,960 --> 00:07:00,760
Every log, you're already ingesting,

217
00:07:00,760 --> 00:07:03,240
gets mirrored into the data lake automatically.

218
00:07:03,240 --> 00:07:05,320
No configuration, no new connectors.

219
00:07:05,320 --> 00:07:07,080
It just happens.

220
00:07:07,080 --> 00:07:08,720
This opens up some powerful possibilities

221
00:07:08,720 --> 00:07:09,920
like threat hunting at scale,

222
00:07:09,920 --> 00:07:12,040
which is exactly what we'll get into next.

223
00:07:12,040 --> 00:07:15,160
Threat hunting, finding attacks hiding in plain sight.

224
00:07:15,160 --> 00:07:17,480
Most people don't realize this about cyber attacks.

225
00:07:17,480 --> 00:07:19,440
They don't happen fast, they happen slowly.

226
00:07:19,440 --> 00:07:21,560
Security pros call it low and slow.

227
00:07:21,560 --> 00:07:23,600
An attacker might test a password on one account,

228
00:07:23,600 --> 00:07:25,920
get it wrong and disappear for a month.

229
00:07:25,920 --> 00:07:27,880
Then they try again on a different account.

230
00:07:27,880 --> 00:07:30,600
Another month passes, they test a third account.

231
00:07:30,600 --> 00:07:33,400
Each attempt looks harmless, someone who forgot their password.

232
00:07:33,400 --> 00:07:34,520
But here's the problem.

233
00:07:34,520 --> 00:07:36,680
With the old 90 day retention window,

234
00:07:36,680 --> 00:07:37,920
you'd never see the pattern.

235
00:07:37,920 --> 00:07:39,640
By the time the third attempt happened,

236
00:07:39,640 --> 00:07:42,280
the first one was already deleted from your logs.

237
00:07:42,280 --> 00:07:44,600
You'd see a single failed log in with no context,

238
00:07:44,600 --> 00:07:46,760
no pattern, no way to connect the dots.

239
00:07:46,760 --> 00:07:48,320
The data lake changes that completely.

240
00:07:48,320 --> 00:07:51,440
Now you can run queries across years of data, not months.

241
00:07:51,440 --> 00:07:53,720
You are sentinel to show you every failed log in

242
00:07:53,720 --> 00:07:56,080
from a specific IP over the last 12 months.

243
00:07:56,080 --> 00:07:57,960
Suddenly the pattern becomes crystal clear,

244
00:07:57,960 --> 00:07:59,400
three attempts from the same IP

245
00:07:59,400 --> 00:08:01,680
using the same technique across different accounts.

246
00:08:01,680 --> 00:08:03,200
That's an attack, not forgetfulness.

247
00:08:03,200 --> 00:08:05,840
The tool for asking these questions is KQL,

248
00:08:05,840 --> 00:08:07,200
Kustoquery Language.

249
00:08:07,200 --> 00:08:09,520
Think of it as a search engine for your security logs.

250
00:08:09,520 --> 00:08:11,720
You type what you're looking for, like failed logins

251
00:08:11,720 --> 00:08:14,640
from a suspicious IP or unusual forwarding rules created

252
00:08:14,640 --> 00:08:17,240
after hours and sentinel returns the results.

253
00:08:17,240 --> 00:08:19,800
It lets you ask questions you didn't even know you needed to ask.

254
00:08:19,800 --> 00:08:22,520
That's why security teams are excited about the data lake,

255
00:08:22,520 --> 00:08:24,200
not because of a flashy new feature,

256
00:08:24,200 --> 00:08:25,600
but because they can finally see what's

257
00:08:25,600 --> 00:08:26,960
been hiding in plain sight.

258
00:08:26,960 --> 00:08:28,960
Attackers who operate slowly, who test the waters

259
00:08:28,960 --> 00:08:30,400
and blend in with normal traffic,

260
00:08:30,400 --> 00:08:32,080
relied on the fact that you couldn't look back

261
00:08:32,080 --> 00:08:33,480
far enough to connect the dots.

262
00:08:33,480 --> 00:08:35,320
The data lake takes that advantage away.

263
00:08:35,320 --> 00:08:37,600
But sentinel isn't only about looking backwards,

264
00:08:37,600 --> 00:08:39,360
it's also about looking forward.

265
00:08:39,360 --> 00:08:42,400
Graphs and AI, the future that's already here.

266
00:08:42,400 --> 00:08:44,920
Attackers think in graphs, not lists.

267
00:08:44,920 --> 00:08:46,720
They don't see individual users and devices,

268
00:08:46,720 --> 00:08:48,200
they see the connections between them.

269
00:08:48,200 --> 00:08:50,240
This user has access to that server.

270
00:08:50,240 --> 00:08:52,040
That server connects to this database,

271
00:08:52,040 --> 00:08:54,320
and that database holds exactly what they want.

272
00:08:54,320 --> 00:08:57,280
They map the entire path before they ever make a move.

273
00:08:57,280 --> 00:08:58,320
Now here's the problem.

274
00:08:58,320 --> 00:09:00,160
Defenders have always thought in lists.

275
00:09:00,160 --> 00:09:02,080
A list of alerts, a list of IP addresses,

276
00:09:02,080 --> 00:09:02,960
a list of users.

277
00:09:02,960 --> 00:09:06,280
Sure, lists are useful, but they don't show you the connections.

278
00:09:06,280 --> 00:09:08,440
They don't show you the path an attacker can take.

279
00:09:08,440 --> 00:09:09,960
Sentinel graph changes that.

280
00:09:09,960 --> 00:09:12,640
It lets defenders do what attackers have been doing all along.

281
00:09:12,640 --> 00:09:14,960
It shows you the map, not just the dots.

282
00:09:14,960 --> 00:09:17,000
You see that user A has access to server B,

283
00:09:17,000 --> 00:09:19,040
server B connects to database C.

284
00:09:19,040 --> 00:09:21,800
And database C contains your most sensitive customer data.

285
00:09:21,800 --> 00:09:23,960
That's not just information, that's context.

286
00:09:23,960 --> 00:09:26,360
And context turns a good investigation into a great one.

287
00:09:26,360 --> 00:09:27,760
This works two ways.

288
00:09:27,760 --> 00:09:29,880
Before a breach happens, you use the graph

289
00:09:29,880 --> 00:09:31,600
to see potential attack parts.

290
00:09:31,600 --> 00:09:33,320
You find choke points.

291
00:09:33,320 --> 00:09:36,880
A single user who's compromised would open up half your network,

292
00:09:36,880 --> 00:09:39,640
then you can prioritize that user, apply extra controls,

293
00:09:39,640 --> 00:09:42,080
and shrink the blast radius before anything goes wrong.

294
00:09:42,080 --> 00:09:44,840
After a breach, the graph shows you the real blast radius,

295
00:09:44,840 --> 00:09:45,760
and alert fires.

296
00:09:45,760 --> 00:09:47,920
Sentinel graph instantly shows you every system

297
00:09:47,920 --> 00:09:50,280
that user touched, every file they accessed, every connection

298
00:09:50,280 --> 00:09:50,960
made.

299
00:09:50,960 --> 00:09:53,200
No guessing, no manual tracing, the graph does it all.

300
00:09:53,200 --> 00:09:54,320
Now let's talk about AI.

301
00:09:54,320 --> 00:09:56,760
Microsoft Security Co-Pilot brings natural language

302
00:09:56,760 --> 00:09:57,720
into the picture.

303
00:09:57,720 --> 00:10:00,080
Instead of writing complex KQL queries,

304
00:10:00,080 --> 00:10:02,120
you just ask questions in plain English.

305
00:10:02,120 --> 00:10:04,120
Show me all the sign-ins from unusual locations

306
00:10:04,120 --> 00:10:05,040
in the last week.

307
00:10:05,040 --> 00:10:07,160
Security Co-Pilot turns that into a query,

308
00:10:07,160 --> 00:10:09,320
runs it against your data, and shows results.

309
00:10:09,320 --> 00:10:10,560
It lowers the barrier.

310
00:10:10,560 --> 00:10:12,960
You don't need to be a KQL expert to hunt threats.

311
00:10:12,960 --> 00:10:14,400
There's also the MCP server.

312
00:10:14,400 --> 00:10:16,440
MCP stands for Model Context Protocol.

313
00:10:16,440 --> 00:10:19,920
In plain English, it lets AI agents, smart bots,

314
00:10:19,920 --> 00:10:21,640
interact with Sentinel directly.

315
00:10:21,640 --> 00:10:23,840
An agent can ask Sentinel questions, run queries,

316
00:10:23,840 --> 00:10:25,960
analyze results, and even take actions,

317
00:10:25,960 --> 00:10:27,360
all without a human in the loop.

318
00:10:27,360 --> 00:10:30,000
It sounds futuristic, but it's already rolling out.

319
00:10:30,000 --> 00:10:32,280
So Sentinel lets you hunt across years of data.

320
00:10:32,280 --> 00:10:34,440
You see the relationships attack as exploit.

321
00:10:34,440 --> 00:10:36,800
And you can ask questions in plain language using AI,

322
00:10:36,800 --> 00:10:38,320
but how do you actually start

323
00:10:38,320 --> 00:10:39,960
without being a security expert?

324
00:10:39,960 --> 00:10:41,400
That's what we'll cover next.

325
00:10:41,400 --> 00:10:43,360
Getting started without the overwhelm.

326
00:10:43,360 --> 00:10:44,560
You might think this sounds like something

327
00:10:44,560 --> 00:10:47,280
only a security team with a six-figure budget can handle.

328
00:10:47,280 --> 00:10:47,800
That's not true.

329
00:10:47,800 --> 00:10:49,800
You don't need a so-key analyst certification.

330
00:10:49,800 --> 00:10:52,040
You just need a Microsoft 365 tenant

331
00:10:52,040 --> 00:10:53,680
and a willingness to start small.

332
00:10:53,680 --> 00:10:55,720
The basic setup is really straightforward.

333
00:10:55,720 --> 00:10:58,160
You enable Sentinel in the Microsoft Defender Portal.

334
00:10:58,160 --> 00:10:59,520
Then you connect your data sources.

335
00:10:59,520 --> 00:11:00,280
That's it.

336
00:11:00,280 --> 00:11:01,960
You don't need to configure everything at once.

337
00:11:01,960 --> 00:11:03,080
In fact, you shouldn't.

338
00:11:03,080 --> 00:11:05,720
Start with just a few sources that matter most to you.

339
00:11:05,720 --> 00:11:08,560
Enter ID sign-in logs, exchange online mail flow logs,

340
00:11:08,560 --> 00:11:10,360
Defender for Office 365 alerts.

341
00:11:10,360 --> 00:11:12,200
Those three alone give you more visibility

342
00:11:12,200 --> 00:11:14,200
than most organizations have today.

343
00:11:14,200 --> 00:11:15,560
Here's what makes this easier.

344
00:11:15,560 --> 00:11:17,280
Sentinel has a content hub.

345
00:11:17,280 --> 00:11:19,320
Think of it like an app store for security rules.

346
00:11:19,320 --> 00:11:22,200
You browse by category, identity threats, email threats,

347
00:11:22,200 --> 00:11:25,320
compliance monitoring, and install pre-built detection rules.

348
00:11:25,320 --> 00:11:26,840
You don't write queries from scratch.

349
00:11:26,840 --> 00:11:28,400
You don't need KQL on day one.

350
00:11:28,400 --> 00:11:29,920
The content hub gives you a starting point

351
00:11:29,920 --> 00:11:31,360
that works out of the box.

352
00:11:31,360 --> 00:11:32,920
Now let's talk about cost.

353
00:11:32,920 --> 00:11:34,320
That's the question everyone asks.

354
00:11:34,320 --> 00:11:36,160
Sentinel uses a pay as you go model.

355
00:11:36,160 --> 00:11:39,000
You pay for the data you bring in, but you can control the cost.

356
00:11:39,000 --> 00:11:41,600
Commitment tiers let you commit to a minimum volume

357
00:11:41,600 --> 00:11:43,000
and get a big discount.

358
00:11:43,000 --> 00:11:44,040
And remember the data lake?

359
00:11:44,040 --> 00:11:45,520
It changes the economics.

360
00:11:45,520 --> 00:11:48,440
High volume, low fidelity logs like firewall traffic

361
00:11:48,440 --> 00:11:51,120
go straight to the data lake tier at a fraction of the cost.

362
00:11:51,120 --> 00:11:53,120
So you don't have to choose between visibility

363
00:11:53,120 --> 00:11:54,320
and your budget anymore.

364
00:11:54,320 --> 00:11:56,000
The hardest part isn't the technology.

365
00:11:56,000 --> 00:11:57,200
It's knowing where to begin.

366
00:11:57,200 --> 00:11:58,280
So here's my advice.

367
00:11:58,280 --> 00:12:00,560
Start with one data source and one detection rule.

368
00:12:00,560 --> 00:12:02,040
Connect Enter ID logs.

369
00:12:02,040 --> 00:12:04,040
Install a rule that alerts when a global admin

370
00:12:04,040 --> 00:12:05,920
signs in from an unusual location.

371
00:12:05,920 --> 00:12:07,360
See what Sentinel tells you.

372
00:12:07,360 --> 00:12:08,680
That's enough to get started.

373
00:12:08,680 --> 00:12:10,200
Then expand as you get comfortable.

374
00:12:10,200 --> 00:12:12,000
Let's bring this all together.

375
00:12:12,000 --> 00:12:13,080
The big picture.

376
00:12:13,080 --> 00:12:14,640
Why this changes your job?

377
00:12:14,640 --> 00:12:16,080
Sentinel is evolving.

378
00:12:16,080 --> 00:12:18,280
It started as a tool for security pros

379
00:12:18,280 --> 00:12:20,520
and now it's becoming the platform behind all of Microsoft's

380
00:12:20,520 --> 00:12:21,480
security.

381
00:12:21,480 --> 00:12:24,320
For you as an M365 admin, that means your security

382
00:12:24,320 --> 00:12:26,480
gets a big upgrade without you having to build it yourself.

383
00:12:26,480 --> 00:12:27,880
Think about what we've covered.

384
00:12:27,880 --> 00:12:31,040
Sentinel collects signals from across your entire environment.

385
00:12:31,040 --> 00:12:33,960
It correlates them to find patterns you'd never spot manually.

386
00:12:33,960 --> 00:12:36,600
It can respond automatically when something goes wrong.

387
00:12:36,600 --> 00:12:38,480
The new data lake makes it affordable to keep

388
00:12:38,480 --> 00:12:40,200
years of data instead of months.

389
00:12:40,200 --> 00:12:43,040
The graph shows you attack paths before they're exploited.

390
00:12:43,040 --> 00:12:45,160
AI lets you ask questions in plain English.

391
00:12:45,160 --> 00:12:46,680
All of this is built into the platform.

392
00:12:46,680 --> 00:12:49,280
You don't have to piece it together from separate tools.

393
00:12:49,280 --> 00:12:52,160
The data lake removes the trade off between cost and visibility

394
00:12:52,160 --> 00:12:54,320
so you no longer have to decide between keeping logs

395
00:12:54,320 --> 00:12:55,120
and saving money.

396
00:12:55,120 --> 00:12:56,240
You can do both.

397
00:12:56,240 --> 00:12:58,240
That changes how you think about security.

398
00:12:58,240 --> 00:13:00,640
Instead of asking can we afford to monitor this?

399
00:13:00,640 --> 00:13:02,880
You ask, what else should we be watching?

400
00:13:02,880 --> 00:13:05,600
You don't need to be a so-see analyst to benefit from Sentinel.

401
00:13:05,600 --> 00:13:08,600
You just need to be someone who cares about keeping your tenants safe.

402
00:13:08,600 --> 00:13:10,400
And if you're listening to this, that's you.

403
00:13:10,400 --> 00:13:12,720
The integration with Defender, Entra and Pervue means

404
00:13:12,720 --> 00:13:15,080
fewer portals to manage, less context switching,

405
00:13:15,080 --> 00:13:16,520
and more control from one place.

406
00:13:16,520 --> 00:13:18,840
Microsoft is betting that security should be built in,

407
00:13:18,840 --> 00:13:19,840
not bolted on.

408
00:13:19,840 --> 00:13:23,160
Sentinel is the foundation of that bet and it's paying off.

409
00:13:23,160 --> 00:13:24,160
Your next step.

410
00:13:24,160 --> 00:13:25,800
So here's what you now understand.

411
00:13:25,800 --> 00:13:28,520
Sentinel is the central brain for your security data.

412
00:13:28,520 --> 00:13:30,960
It collects everything, correlates the signals,

413
00:13:30,960 --> 00:13:33,200
and acts automatically when something goes wrong.

414
00:13:33,200 --> 00:13:35,560
The data lake makes it affordable to keep logs for years

415
00:13:35,560 --> 00:13:36,640
instead of months.

416
00:13:36,640 --> 00:13:39,080
Graphs and AI make it smarter over time.

417
00:13:39,080 --> 00:13:41,120
And all of this lives in the Defender portal,

418
00:13:41,120 --> 00:13:43,600
right alongside the tools you already use.

419
00:13:43,600 --> 00:13:45,000
You don't need to master it overnight.

420
00:13:45,000 --> 00:13:46,120
My advice is simple.

421
00:13:46,120 --> 00:13:47,280
Go to security.

422
00:13:47,280 --> 00:13:50,040
Microsoft.com, Open Sentinel, and browse the content hub.

423
00:13:50,040 --> 00:13:51,520
Just explore, see what's available.

424
00:13:51,520 --> 00:13:53,640
Pick one connector and one detection rule.

425
00:13:53,640 --> 00:13:55,000
That's your starting point.

426
00:13:55,000 --> 00:13:56,720
A lot of people won't take that first step.

427
00:13:56,720 --> 00:13:58,720
They'll read about Sentinel, not along,

428
00:13:58,720 --> 00:14:01,120
and then close the browser and go back to their day.

429
00:14:01,120 --> 00:14:02,400
That's why you'll be ahead.

430
00:14:02,400 --> 00:14:04,800
Because you actually did something with what you learned.

431
00:14:04,800 --> 00:14:07,440
If this episode helped you understand Sentinel a little better,

432
00:14:07,440 --> 00:14:09,480
subscribe to Microsoft Knowledge Nuggets.

433
00:14:09,480 --> 00:14:12,080
We break down Microsoft Security and M365 topics

434
00:14:12,080 --> 00:14:14,000
in plain English every episode.

435
00:14:14,000 --> 00:14:15,600
Share this with someone who's been wanting to learn

436
00:14:15,600 --> 00:14:18,000
about Sentinel, but wasn't sure where to start.

437
00:14:18,000 --> 00:14:20,000
See you in the next one.