An Approach to Managing and Handling Events and Incidents Using Microsoft Sentinel

Abstract

The study in question aimed to analyze how Microsoft Sentinel can help companies in the management and automated treatment of events and security incidents. For this, the case study methodology was used, following the post-implementation use of a Security Information and Event Management System (SIEM) in a company. The main focus of the research is to highlight the benefits that the cloud-native tool, Microsoft Sentinel, can offer to improve the security of an organization's information. In this way, the resources available in Sentinel will be analyzed, such as artificial intelligence and machine learning, which allow the detection and prevention of threats in real time, allowing a faster response to possible security incidents. At the end of the research, it was possible to have an overview of the benefits of Microsoft Sentinel for corporate information security and an understanding of its use in a corporate environment. The main contribution achieved at the end was the possibility of working with Microsoft Sentinel in a corporate environment and with a large volume of data, helping to implement security solutions in other organizations.