Microsoft Sentinel Enterprise Deployment: 6-Week Implementation

What are BlueVoyant Deployment Services?

With BlueVoyant’s Microsoft Security Deployment services, you don’t need to be an expert to take your security and compliance posture to the next level. Our Deployment services are designed to get you up and running quickly and to maximize your investment in Microsoft with hands-on services that include onboarding and baseline configuration services for the implementation of specific Microsoft Security solutions.

BlueVoyant will perform a detailed analysis of your environment(s) and provide actionable security insights leveraging the BlueVoyant catalog of pre-built playbooks and alert rules. The service includes a detailed assessment of your risks, guidance on how best to leverage Microsoft-powered solutions, and/or deployment and configuration assistance to best meet the requirements of your unique situation. The services are delivered by BlueVoyant Microsoft certified experts who specialize in Microsoft 365 Defender, Microsoft Defender for Cloud, and Microsoft Sentinel. 

What does the Microsoft Sentinel Deployment Enterprise service include?

Onboarding of the following Microsoft log sources into Microsoft Sentinel are included, as they are free of charge from Microsoft. An additional log source, Microsoft Entra ID - SignIn logs, is also included. While this log source is billable by Microsoft, it has a low volume.

The Microsoft Sentinel Deployment Enterprise service is enterprise-ready to onboard a variety of vendor security software and technologies. In addition to the included sources above, you may select up to ten (10) additional Log Source Types, as long as they are in BlueVoyant Data Connectors Library. Types of suggested logs:

• Infrastructure logs (via Syslog/CEF with Log Collector)
• Other Cloud Logs (i.e., AWS Cloudtrail, GCP)
• SaaS applications (i.e., SalesForce, GSuite)
• Non-Microsoft Endpoint Security tools (i.e., Crowdstrike, McAfee)
• Other Security Controls (PAM/PIM solutions, DLP, NAC)
• Azure PaaS
• Windows Events; Security Events

Following setup, BlueVoyant will conduct a cost analysis and optimization workshop as well as a knowledge transfer exercise related to queries and Azure Functions.

Key Services Delivered:

• Connector Configuration: BlueVoyant will onboard customer log sources into Microsoft Sentinel for both on-premises and Cloud devices
• Deployment of Alert Rules from BlueVoyant catalogue
• Microsoft Sentinel Cost Analysis and Optimization
• Deploy a set of 3 playbooks for Microsoft Sentinel in customer’s Microsoft Sentinel subscription
• Customized Playbook automations via Azure LogicApps
• ITSM Integration via playbooks/email
• Customization of Workbooks to customer requirements
• Knowledge Transfer: Introduction to KQL and Azure Functions

Additional Details:

• Typical Enterprise Deployment Sentinel deployments take 10 days, subject to customer’s resource availability to supply devices and log sources.

Why customers choose BlueVoyant