Microsoft Sentinel - 2.5 day Implementation

Microsoft Sentinel Deployment Engagement

This engagement delivers the initial deployment and configuration of Microsoft Sentinel, providing organisations with a strong foundation for cloud-native SIEM and SOAR capabilities. The service begins with a kick-off and discovery session to align objectives and understand the current environment, followed by a comprehensive workshop covering Microsoft Sentinel functionality, architecture, and capabilities. As part of the planning phase, a cost estimation exercise is completed based on existing and anticipated log sources.

The engagement includes the creation and configuration of a core Microsoft Sentinel instance, incorporating data retention and data lake considerations. Key Microsoft cloud-based data connectors such as Microsoft 365, Azure, Defender XDR, Threat Intelligence, and Entra ID are enabled to ensure broad visibility across the security estate. Out-of-the-box analytical rules are deployed and initially tuned to reduce noise and improve detection quality, alongside the configuration of workbooks to support SOC reporting, monitoring, and operational checks. The outcome is a fully operational Microsoft Sentinel environment, ready to support ongoing security operations and future expansion.

Activities

• DAY 1 - Kick off and discovery session to discuss engagement objectives and current environment.
• DAY 1 - Provide a workshop overview of Microsoft Sentinel functionality and capabilities. Deliver a cost estimation exercise based on existing log sources. Provide a planning and architectural workshop on Microsoft Sentinel.
• DAY 2 - Create and configure the initial instance of Sentinel, including retention and data lake settings.
• DAY 2 - Configure the core Microsoft cloud-based data connectors (Microsoft 365, Azure, Defender XDR, Threat Intelligence, Entra ID).
• DAY 2 - Configure key analytical rules based on core data connectors and provide initial tuning activities (maximum 30).
• DAY 2.5 - Configure key workbooks for reporting based on SOC activities/checks and data log sources (maximum 30).