No video :(

Why XDR is your SIEM's new BFF...

Подписаться 13 тыс.

Просмотров 12 тыс.

50% 1

Too many incidents. Too many alerts. Not enough automated response. Your SIEM needs help! Meet, XDR! XDR can correlate alerts across security solutions into an incident to provide full context to a threat - and provide automated remediation. Sending incidents with full alert context to your SIEM is key. Yes you still need a SIEM to pull data from multi-cloud, 3rd party security products, perform custom SOAR and big data analytics, machine learning, etc - to get a complete picture! Let's take a look at Microsoft's XDR solution - Microsoft 365 Defender.
Technical Docs (must read!): docs.microsoft...
Licensing Requirements:docs.microsoft...
FAQ: docs.microsoft...
Turn it on! docs.microsoft...
Create a lab! docs.microsoft...
Table of Contents:
00:00:00 Intro
00:01:05 Why XDR?
00:04:00 XDR to the rescue!
00:05:25 Microsoft 365 Defender

Опубликовано:

16 авг 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 20

@dennishogewoning1386 3 года назад

Awesome and easy explanation of XDR/SIEM/SOAR!

@AnnaSirne-n7r Месяц назад

Awesome explanation! Thank you!

@andrewmccallum5699 3 года назад

Super cool way of visualising what you said re a single payne of glass, re links / will be sharing these links again / thanks!

@fredscholl5250 2 года назад

When SIEM's first came out they were touted as providing event correlation. That was their claim to fame. Looks like they didn't deliver; now we need XDR.

@ramiknfr Год назад

With SIEM you can create correlation rules to contextualize the different incidents, how is that different in XDR?

@abhijeetagrawal4092 2 года назад

As you've mentioned that XDR is able to take the alerts from various security solutions and then create a single incident out of it and then even respond to it, then why would we need to again send this single incident to a SIEM later on? - refer 5.00 timestamp in video.

@MrChrismeenan 2 года назад

Totally agree. SIEM is just another source of alerts for an XDR. XDR should be simplifying workflows for security teams not adding yet another layer of alert triage, investigation and response

@skyw3lker113 2 года назад

Collect, coordinate, correlate These are SIEM features. Are u saying SIEM failed to deliver especially on the correlate part ?!

@senadaruc 2 года назад

I agree this is totally WRONG! SIEM is correlating events to create IOA or IOC alerts on the stored data while the XDR is working purely with ALERTS on the point of time.

@RahulSingh-ut2tj 2 года назад

Just brilliant

@nasnazari1391 Год назад

Where can I find the diagram in the video?

@AlienWarTycoon 2 года назад

Now that Microsoft has updated all of their Defender names, you need to re-record this XD

@Lonewolfww 3 года назад

It could be awesome once it is THE PLACE for policy and alerts, seems to have to bounce all over the place now for endpoint configuration setup, email security setup, etc., like the migration is only half done, or if you have had your tenant since the bpos days some things are still parked on old infrastructure or something. Highly frustrating.

@MattSoseman 3 года назад

Update: techcommunity.microsoft.com/t5/microsoft-365-defender/unified-experiences-across-endpoint-and-email-are-now-generally/ba-p/2278132

@Lonewolfww 3 года назад

@@MattSoseman i know, I saw this reality is that there are still tons of redirects, policy overrides or conflicts in other portals that are sometimes tough to track down. Consolidation can't be easy so I get it, but saying you have a unified experience is different than having one that works end to end. I just checked right now and still have the same redirects especially for policy mgmt. Maybe that wasn't the goal, if it is just consolidation of alerts, it does do a good job of that but honestly its almost easier just to go to the individual portal where the alert links in unified experience send you anyway. I do like the vision however and I think the Microsoft security solutions are excellent, imagine after a few more dev cycles things will become more streamlined and intuitive.

@ethansidelsky2314 3 года назад

What is the benefit of integrating XDR with SIEM? Seems like XDR is able to identify incidents and respond with having to go through massive data log from SIEM. In other words, why doesn't Microsoft just replace their SIEM with XDR?

@MattSoseman 3 года назад

Because SIEM offers: 1) 3rd party data sources 2) advanced data analytics such as machine learning 3) ability to create your own automatic remediation playbooks

@insights3005 2 года назад

@@MattSoseman if u rely on the response(R) in SOAR playbooks for responding to threats ,then what about the response(R) in XDR. What value does the response(R) in XDR have ? OR its 1 and the same thing ?

@umairiqbal8747 2 года назад

because Complaince issues ..you need SIEM as well as some specific use cases since XDR only cater Threat use cases

@MrChrismeenan 2 года назад

@@MattSoseman The output of 1) and 2) are more alerts.. Why are you proposing two separate alert workflows for security teams one in XDR, and another in SIEM /SOAR.