From 41ca54046bb07dd12a911a27d816b8a5c1bb436f Mon Sep 17 00:00:00 2001 From: Sean Kwach Wasonga <67633117+KwachSean@users.noreply.github.com> Date: Wed, 22 Jan 2025 15:25:25 +0300 Subject: [PATCH] Update README.md --- Monitoring/IngestSecurityCopilotAuditlogs/README.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Monitoring/IngestSecurityCopilotAuditlogs/README.md b/Monitoring/IngestSecurityCopilotAuditlogs/README.md index e3fa13c8..58821495 100644 --- a/Monitoring/IngestSecurityCopilotAuditlogs/README.md +++ b/Monitoring/IngestSecurityCopilotAuditlogs/README.md @@ -1,4 +1,6 @@ -# Ingest Copilot for Security Audit logs +# Ingest Microsoft Security Copilot Audit logs and Deploy Audit Workbook +Technical community blog : [Monitor User Activities and System Events with Security Copilot](https://techcommunity.microsoft.com/blog/securitycopilotblog/monitor-user-activities-and-system-events-with-security-copilot-and-microsoft-se/4303368) + Auditing is a critical feature in any security solution, providing visibility into user activities and system events, detect usage and activities anomalies, and ensure compliance with regulatory requirements. By sending Copilot for Security audit logs into your cloud native SIEM - Microsoft Sentinel, users can gain deeper insights into their Security Copilot usage and take proactive measures to mitigate risks # Prerequisites @@ -9,7 +11,7 @@ Security Administrators can also access this option through the Owner settings p Use the following steps to update the audit log settings: -1. Sign in to Security Copilot (https://securitycopilot.microsoft.com). +1. Sign in to Microsoft Security Copilot (https://securitycopilot.microsoft.com). 2. Select the home menu icon. 3. Navigate to the Owner settings > Logging audit data in Microsoft Purview. ![Security Copilot](./images/cfs_setting_1.png)
@@ -23,11 +25,12 @@ To integrate with Microsoft Defender XDR make sure you have: ![Microsoft Defender XDR](./images/sentinel_XDR.png)
- ### Deploy Analytical Rules [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FSecurity-Copilot%2Fmain%2FMonitoring%2FIngestSecurityCopilotAuditlogs%2Fazuredeploy_analytics.json) +![image](https://github.com/user-attachments/assets/c0def0de-9fe0-41e8-9ec4-69866094fa55) ### Deploy Workbook [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FSecurity-Copilot%2Fmain%2FMonitoring%2FIngestSecurityCopilotAuditlogs%2Fazuredeploy_workbook.json) +![image](https://github.com/user-attachments/assets/ea8f42f4-afb2-4bb2-9f9f-d9c4b44d0a31)