SIEM Visibility and IT Infrastructure Hardening
A technical consultancy wanted to improve its ability to detect, analyse and respond to cyber threats in its IT environment. The goal was to move from a more reactive approach to cybersecurity towards better visibility and centralised monitoring.
The project included the deployment of Microsoft Sentinel, review of log collection, alert management, architecture and hardening measures in the on-premises environment.
The work helped turn individual security observations into a managed development initiative, where technical visibility, risk prioritisation and practical hardening measures supported each other.
Key areas
- Microsoft Sentinel deployment
- Development of SIEM visibility
- Integration of logs and data sources
- Definition of alerts and analytics rules
- KQL queries and security analytics
- Review of AD and Entra ID risks
- On-premises environment hardening
- Consideration of NIS2 and ISO 27001 perspectives
What was done
The work included, among other things:
- deployment of the Microsoft Sentinel environment
- creation and basic configuration of Sentinel workspaces
- integration of logs and data sources
- configuration of analytics rules
- development of models for handling security alerts and incidents
- strengthening competence in KQL queries and security analytics
- fine-tuning Sentinel alerts and reducing false positives
- architecture review
- consideration of NIS2 and ISO 27001 perspectives in cybersecurity processes
- increasing cybersecurity awareness among staff and management
Technical monitoring alone is not enough. Alerts need to become understandable observations, observations need to support decisions, and decisions need to lead to practical changes in the environment.
Technical approach
The technical approach combined cloud-based monitoring, assessment of the local IT infrastructure and practical hardening work.
The key areas included:
- Microsoft Sentinel as the SIEM solution
- use of Microsoft Defender services
- review of Entra ID and identity-related risks
- log collection and analytics rules
- KQL queries and analysis of security incidents
- hardening of the domain environment
- consideration of continuity and recovery planning
During the work, the importance of the on-premises environment was especially highlighted. Protecting cloud services alone is not enough when local infrastructure still plays a critical role in business operations.
- Microsoft Sentinel was deployed as the foundation for SIEM visibility
- Defender services were integrated into threat detection
- AD and Entra ID risks were brought under review
- On-premises hardening measures were carried out based on the findings
Outcome
As a result of the project, the customer’s visibility into events in the IT environment improved significantly. Sentinel provided a more centralised way to monitor alerts, analyse anomalies and develop response capability.
The hardening work strengthened the protection of the on-premises environment in particular.
The outcome was a stronger technical foundation, better detection capability and a clearer direction for continuous cybersecurity development.