What are BlueVoyant Deployment Services?

With BlueVoyant’s Microsoft Security Deployment services, you don’t need to be an expert to take your security and compliance posture to the next level. Our Deployment services are designed to get you up and running quickly and to maximize your investment in Microsoft with hands-on services that include onboarding and baseline configuration services for the implementation of specific Microsoft Security solutions.

BlueVoyant will perform a detailed analysis of your environment(s) and provide actionable security insights leveraging the BlueVoyant catalog of pre-built playbooks and alert rules. The service includes a detailed assessment of your risks, guidance on how best to leverage Microsoft-powered solutions, and/or deployment and configuration assistance to best meet the requirements of your unique situation. The services are delivered by BlueVoyant Microsoft certified experts who specialize in Microsoft 365 Defender, Microsoft Defender for Cloud, and Microsoft Sentinel.

What does the Microsoft Sentinel Deployment Enterprise service include?

Onboarding of the following Microsoft log sources into Microsoft Sentinel are included, as they are free of charge from Microsoft. An additional log source, Microsoft Entra ID - SignIn logs, is also included. While this log source is billable by Microsoft, it has a low volume.

Azure Activity Logs	Defender for Cloud Apps (Alerts Only)
Office 365	Azure Activity
Defender for Endpoint (Alerts Only)	Azure Identity Protection
Defender for Office 365 (Alerts Only)	Microsoft Defender for Cloud (Alerts Only)
Defender for Identity (Alerts Only)

The Microsoft Sentinel Deployment Enterprise service is enterprise-ready to onboard a variety of vendor security software and technologies. In addition to the included sources above, you may select up to ten (10) additional Log Source Types, as long as they are in BlueVoyant Data Connectors Library. Types of suggested logs:

Infrastructure logs (via Syslog/CEF with Log Collector)
Other Cloud Logs (i.e., AWS Cloudtrail, GCP)
SaaS applications (i.e., SalesForce, GSuite)
Non-Microsoft Endpoint Security tools (i.e., Crowdstrike, McAfee)
Other Security Controls (PAM/PIM solutions, DLP, NAC)
Azure PaaS
Windows Events; Security Events

Following setup, BlueVoyant will conduct a cost analysis and optimization workshop as well as a knowledge transfer exercise related to queries and Azure Functions.

Key Services Delivered:

Connector Configuration: BlueVoyant will onboard customer log sources into Microsoft Sentinel for both on-premises and Cloud devices
Deployment of Alert Rules from BlueVoyant catalogue
Microsoft Sentinel Cost Analysis and Optimization
Deploy a set of 3 playbooks for Microsoft Sentinel in customer’s Microsoft Sentinel subscription
Customized Playbook automations via Azure LogicApps
ITSM Integration via playbooks/email
Customization of Workbooks to customer requirements
Knowledge Transfer: Introduction to KQL and Azure Functions

Additional Details:

Typical Enterprise Deployment Sentinel deployments take 10 days, subject to customer’s resource availability to supply devices and log sources.

Why customers choose BlueVoyant

Delivery Expertise

Over 500+ Sentinel deployments, battle-tested processes, and proprietary IP to quickly deploy and configure security solutions.

Increased security and visibility

Powered by our team of security experts, 600+ proprietary alert rules, Threat Intelligence,

Automation and AI capabilities.

Data Privacy and Cost Optimization

Our customers keep data in their own environment, ensuring stronger compliance and reducing cost.

MissionOps - Secure 24/7 operations for business-critical Azure environments

Reply

Detalhes