Ursina Livers, Cyber Security Engineer at AMINA Bank AG

Leveraging Sentinel and Microsoft Security Suite to its fullest: Lessons Learned
In today's rapidly evolving threat landscape, maintaining a robust Security Operations Center (SOC) with limited human resources is a significant challenge. This presentation explores how AMINA Bank AG successfully implemented Microsoft Sentinel and Microsoft Security Suite to achieve an almost fully automated SOC, significantly enhancing our security posture while optimizing resource allocation.

We will delve into the different challenges we faced and how the Microsoft Security Suite helped us to overcome them. By leveraging the capabilities of Microsoft Security Suite, we streamlined our security operations, enabled near real-time threat intelligence consumption, and built reliable automated remediation workflows.

Join us to learn how automation and intelligent security solutions can transform your SOC operations, ensuring robust protection with efficient use of resources.

Jonas Mücksch, Consultant & Paul Montague, Digital Infrastructure Consultant at Eraneos

A scalable approach to monitor application security logs with Microsoft Sentinel
Monitoring application (layer 7) security logs further hardens an enterprise’s security, as this layer encompasses e.g. critical business logic, deployments, and user actions, which are not monitored through classical monitoring on lower layers. However, a key challenge of application log monitoring is the lack of standardization in application logs, impeding effective detection and response. To address this, we developed a scalable and flexible security log monitoring solution that enhances visibility on the application layer.
 
Our approach collects and securely transfers diverse on-premise application logs to a cloud-native analytics environment centered around Azure Log Analytics Workspace and Microsoft Sentinel. Advanced monitoring, threat detection, and incident response are performed within Sentinel, empowering application teams to capture actionable insights from rich application context. The application onboarding is streamlined by means of standardized base use cases and log transformations. This approach supports rapid and consistent integration regardless of log format variability. Moreover, a robust CI/CD pipeline with infrastructure-as-code (Terraform) supports rapid adjustments. 
 
This presentation details our end-to-end architecture, pragmatic choices, and encountered challenges, demonstrating how seamless application log monitoring advances threat detection and resilience for critical applications across a complex and diverse enterprise landscape.

Umberto Annino & Leander Sabel will moderate:

Your voice matters!
We want to hear your experiences – the successes, the roadblocks, and everything in between. Whether you’re dealing with Sentinel, Defender, or the broader Microsoft Security ecosystem, your unique perspective helps the entire community grow.

Bring your questions, share your needs, and let’s shape the conversation together. Every contribution counts, and everyone has something valuable to offer.

We would also like to know what other topics you are interested in so that we can organize the topics for future meetings