Have you ever hammered a nail like this? No, right. You must have hammered a nail like this. Only then it can punch you through the wood. But why? You might say that this end is more pointy. Let's take one more example. We use knives to chop tomatoes, right? But have you ever thought of chopping tomatoes with your finger? No, right? And you might say, Well, the finger is not as sharp as a knife. We will answer these questions in more detail with the help of an activity. So for this activity, I have some flour and this box with some chalks in it. I will place the box like this horizontally. And when I do that, I see that it has left a mark on the flour. And there is this much depth to the mark. Now I will leave the box like this, that is vertically. And I again see that the box has left a mark on the flour. Now there is this much depth to the mark. In which case is the depth more? If we compare these two cases, we can see the mark has a greater depth in this case. Why did that happen? Let's dive deeper. Now every object has a weight of its own, right? Like the box of chalks. When the box was kept horizontally, the force was divided over a larger area. And when it was kept vertically, it was divided over a smaller area. Now because the same force of weight was divided over a larger area in the case on the left, the amount of force that appears or acts on any one point on the flour is very small. For the case on the right, the amount of force that appears or acts on any one point on the flour is larger. So if we have the same force, then the depth of the mark is less when the box was kept horizontal. And the depth of the mark is more when the box was kept vertical. It matters how concentrated the force is. Same force is divided over a larger area in the first case. So it is not that concentrated. But when the same force is divided over a smaller area, then it is more concentrated. And this is what we call pressure. Pressure can be thought of as how concentrated your force is. We can even calculate pressure. Well just like we saw that we are basically calculating how much force gets divided over the area. Mathematically also, pressure that is P is calculated as the force divided by the area. And its units will be Newton per meter square. So in the first case, when the area was very large, the pressure was small. But in the second case, when the area was small, the pressure became large. Now let's come back to our original question. Why do we hammer a nail with a pointy end at the bottom? Well then force is concentrated over a very tiny area. But in the case on the right, the same force is concentrated over a larger area. And as a result, if you now compare the amount of force that appears on the same spot as before, the force has reduced a lot, right? Because it got divided. The contact area was very small in the first case. So the pressure was very high. And the contact area was large in the second case. So the pressure is very low. Similarly, when you use a knife and put a force, then all the force gets concentrated into a very tiny area. Because the knife is very sharp. So that means the tomato experiences a large pressure. But because your finger is not so sharp, the base area of a finger is so wide, at least compared to the knife, that entire force gets divided over a large, larger area. And as a result, the amount of force that appears on the same slice of tomato as before is small. So now the tomato experiences less pressure.


So I decided to rank your favorite Vocaloid songs. Now how did it go? Well, I had my ups. And I had my downs. But most importantly, I had the opportunity to destroy your hearts. Okay. Okay. How do I not be poobam? I'm going to give it an F. Now the way I tried to rank your Vocaloid songs was not by being persuaded by the music video or the lyrics whatsoever. Not one bit. Oh, this is such a good song, except for the fact that it's about someone's side. Okay. I tried to rank them from how I vibe with the song. Did the song have the vibes? Did I have the vibe? Sometimes I did not. Okay. Just sometimes.  I just get used and used again, but not today. Today is different. I got to experience bliss. I did not get pocketed. Yes. I thank you guys for sending in your favorite Vocaloid songs. I actually really enjoyed some of them. Even though I recorded three hours of footage for a Vocaloid video, and then turned it into an attack on Titan naming scheme of part one, part one, part one, part two, part two, part one. And now I'm recording part three, part one, and there might even be a part three, part two. It just all depends on how the weather is going to go. And I don't think it's going to go my way. I did actually have a fun time, even if at some points I was like this. It's just always so good being able to experience other people's favorite songs because, well, it's just a whole new world. Just like this.  Wait, wait, this is just the first one.  I just like it. I liked that. That was beautiful. That was awesome. Wait, how am I supposed to rank this? Wait, wait, no, no. I didn't actually think this far through. I am not one of my, how am I going to, so this is in A. It's just good. It got me in a good mood. It hyped me up. It was just like good all around and not creepy. And what the chocolate said helped me to get motivated and I can understand that. I don't know what the lyrics are. They could be talking about killing something. Who knows?  So how did that go? Yeah, not bad. Am I going to be talking after every song?  I'm too lazy for that. I did it for like 90%. Oh, good. I'm stuck. Okay, we'll just do this until I fall out of the tree. Also, there are multiple times in this video where I am angry at myself. So if you get mad, just be glad because I got mad at myself.  Okay, that was just bad. So let's get into the second song. I see what you mean by that. It's a really well written song. It's a good song. Sounds nice. The lyrics depressing. Very depressing. I think this is like a good like middle ground song. See.   Yeah, why did I give that a C? It is now a B. But of course throughout the video, I found songs like this. Why are they always so depressing? They just absolutely amaze me. It's catchy. I'm enjoying it from the start to the end. It's got good energetic vibes. Reincarnation Apple is that. I like the song a lot. Okay, just let me have fun in my life. It's such a catchy like energetic vibe. And I'm, ah, this is what I like. This is what I like. Ah, I like that. That is a good, that I love the meaning of that song. That is so cool. Holy moly. Wow. I'm ending that to my playlist straight away. I had to play this. My Japanese jam better be strawberry, bro. That was good. Shit. I'm not sure if I want to put that in S or like a high A tier. I'm going to put that in S. I liked it. It was just, it was just like, I like these type of songs. So I gave it an S. Yes. The first S. And we're basically at the start of the video. And then straight after that, I got all phone zombies lead to Rome. Okay. This is just a history lesson in it. The only thing that like, how do I say this? The song isn't really that catchy. It's like a story. And the only reason that the whole thing was good is because of the music video. Like if I included the music video, I'll give it like a B. But if I'm just thinking about the song, it has to be a D. It's just not that. It's not that like song, you know? Man, this is rough. It isn't like Conoco known by everybody in the community, but it was... Sorry if I broke your heart. That didn't mean to. And I gave it a D. The D's nuts. Yeah. So like I said in this video, I will break your hearts. But also you will break mine. The odds and ends by ryo-supercell has to be your number one. Okay. Three, two, one. Yeah. Oh, yeah. Oh, okay. Wait, I'm hooked. I'm hooked.  I'm not going to cry. I'm going to cry. I will cry. This is why I like listen to other people's music. You never realize that you can resonate with it until you give it a shot. But the way the song was composed, the way that Miku's voice was, the lyrics... I can relate to that. Yeah, I can relate to that. That was a really beautiful song. It's made me feel depressed. Coffee. Even though I was crying and stuff, I'm going to have to give this an A. Oh yeah, okay. So this is a good one. So Abnormality Dancing Girl exists, right? And a few of you recommended it to me. So I gave myself mega expectations for the song. Oh, no, no, no, no. They're not good, Logan. You don't do that. You don't give yourself good expectations for songs. Because what happens? I break your hearts. Three, two, one. Now, this reminds me of Resident Evil 1. Like, I want to continue playing Resident Evil. I'm up to the fifth one. I love the sound of the instruments. And this vocaloid voice is pretty cool. I think this is my first time listening to a flower's voice. I can't understand this song, but it sounds good.  No, no, no. That's not okay. We're not giving that a B. We have to give that an A because that is such an amazing song. Yeah, so that's an A. Okay, so you guys might be wondering, why have I given them different ranks? Well, because I had to listen to each song twice, once for my proper reaction. And the second time was when I was editing the video for my Patreon. So the whole video, full reactions to every song, is available to you guys on Patreon for just $2 New Zealand Dollars. And because of that, some of the songs get changed. But yeah, if you guys want me to become a full-time yob tubber, then all you got to do is support me on Patreon and subscribe today. Where can I get some good light? Over here. So back to Breaking Hearts. I gave Kikuo Kaleidoscope a D. Whoa, this is everywhere so far. This is something Kikuo does a lot, like do cool things like that. Yeah, Kikuo just knows how to be so experimental and like go everywhere with their music. It's quite unique. But it is everywhere. And I don't think I could like focus on the song. I don't see, I don't know if we're at the end or not.  I just don't know what's happening with Kikuo's music or just like kind of the annoying thing. Like how much longer is there? Still like a minute.  I like to know what's happening. This song makes me not know what's happening. Is it gonna end? No! I was looking at the wrong camera. Oh! I'm sorry to do this. But I'm gonna have to give it the D. It's too abstract different for me, you know?  Where I'm like kind of feeling uncomfortable because of how I don't know what's gonna be happening next. It's like there's a bit of consistencies.  Don't hate. Don't hate. Okay, so how did the end of part one, part one go? Wow! It went like this. Three, two, one. Now. Raphashiya! Oh my god, it starts so, so heavy. But it's got a cool sound. Oh, I like this. This is, this is it. Oh, it's getting distorted. Oi, oi, oi, oi. What? What?  This is going on my playlist. Oh, oh my. This tickles me. Slowly building up. Yeah. I want to know what the song's about. It's going to be like, murder, or something. I don't care. I'm vibing with it.  It's going on my playlist. I'm handing this to my playlist. I just need to wait for the song to be over, so. Fuck! That gave me a fright. Oh my god. I thought it just abruptly ended. Wow, that was cool. Ups. Ups pee? I want to pee. Add to my Japanese jam, Better Be Strawberry. Boom, baby. That was good. Okay, I need to stop recording all three things, and then save the files onto my hard drive, and then I'll get back to it.  That's an S. Oh, it's an S. I forgot to say what it was.  That was good. So now it's time for part two, part one of this attack on time reference of a video, because haha, funny. Oh god. Okay, so how did it start? Okay. This is hype. It's a hype song. I'm not used to this voice, so I need to, this is a brand new voice for me as well, so. Whoa. That was cool. I like, this is like the part that I like the most, the guitars right now. See. It's not something that I'm going to be willingly wanting to search, but if it like comes on, I'll listen to it and not hate it. Like it's a song where I'm like, yeah, this is, this is listenable. I like it. That's kind of what it is. I feel bad, man. But I love that guitar at the start and in the middle. And then at the end, it was cool. I like the guitar. It's hard to choose my number one, but at the moment, I usually listen to a donut hole by Hachi, warning. This video contains everybody changing patterns, my red, blue shifting it. I'm not sure about the voice though. Okay. Let's close the eyes and just listen. I'm put off by the voice. It like has moments where it sounds kind of human and then it sounds very roboticy with like each word and it puts me on. But like the song's fun. I like the fun, but I'm put off by the voice. See, this sounds a lot better. The voice sounds so much better right now. My name is donut hole. Yeah, it went like that. So let's just go to the next song. Oh, depression. It's what I'm...  This is good. This is imprinted the way that... Wow. It's a good consistent song where I'm not going to be thrown off. I know kind of what's going to be happening. The god that instrument sounds so beautiful. The voice is utilising such a good way. I love this.  We already know it. Only slightly depressing. But goddamn, did I like that depression? Spotify! Yeah, it hasn't been a bad start to the day for part one, part two. I've been enjoying that day. Like it's been pretty goddamn chill. It's just been that good so far that there just can't possibly be a reason for there to be any potential bad song coming up next. Another banger. Another one. Straight away. This is good.  Oh wow, Volga. That looks pretty... Volga. I like this. Hey.  Hey. Hey. Why did I give that an A?   It is such a good song. Actually vibed to it. Actually enjoyed it. Fully added it to my Spotify playlist. And I give it an A. I give it an A. I'm gone. I've just had enough. I'm done. So I'm giving it an S. Yes. So then we'll get to the next song. This is good. Dude, the backing vocals are so good. I like this song.  I'm thinking A or B. Like I like the song. No, I think I'm going to go for a high B. And it's got to be a high B. And man, is this song so good. Have you ever heard Miku's voice being utilised in this way? Okay, you probably have. But I haven't. So I give it a B. Next. We got a person on the track. All right, the sound. That was cool. That was cool. That was like a needs more variation. The song just needs that bit more variation. It's kind of bland. I was very excited. And I heard the B. And then the voice was kind of like lacklustre. And since I don't understand the lyrics, I feel like the lacklustre voice is for the lyrics. But it is catchy. It is. I think I hyped myself up from the... Because like when I first heard... Like, come on, when I first heard this. Yeah, I was like, oh, this is going to be so good. But then the voice was kind of... It was kind of like that for the entire song. But then like when it went to... I can't believe I'm actually fucking... When we got that bit of variation, I was like, oh my God, I needed more of that in the song. And then that would put it probably... If there was more variation, I'll probably put this in an A. But because of like, there's not much variation. And it's kind of like...  I'm going to get killed.  I like to live. Uh-huh. Wawaka is next. So I like Wawaka. I actually really enjoy Wawaka's music. I really love Rolling Go and I really, really, really love... Unknown Mother Goose. I almost wanted to call it Untitled Goose Game. I'm sorry. So when I saw this song, I... Got excited. I got high expectations. And what happens when I get high expectations? Bad things happen. Yeah, nice. Oh yeah. I wish I had lyrics. It's so fast though. The way that Wawaka utilizes media is so cool. I'm not sure if I actually like this song that much. As much as I love other Wawaka songs. Am I going to get hated for this? C. I just... I don't think it's as good as his other song. Yeah, I don't know. There's just something... It was just something off about it the entire time that I... I... That just... That was just on my... I don't know. It just wasn't as good as his other songs. Still love Wawaka, by the way. Still do. Okay. So anyways, can we just go on to the next song please? Pretty please? Like, I really want to just go on to the next song now. Can we like cut to me going to the next song? Because like, this is kind of getting ridiculous right now. I'm just hiding. I kind of just... I'm hiding from all the hate. I just want to go to the next song right now. Can we go to the next song right now? Can they even see me? I can't see them, so they can't see me. This is cool. This is cool. I like this song. I'm trying to figure out what the meaning of that is. And I don't know. Like, she's down for mannequins.  What the... How happened there? What the... Oh yeah. That's easily an A. That's A. It's just an A. It's just an A. But in... But... Oh, that looks cool. This one looks cool. Melty Land. Okay. Anyways. I saw a thought. I was thinking during that... That song. About something. That were record song that we listened to beforehand. I'm moving it down to a D. I thought about it. I'm like, I really don't think it should have been a C. I don't... Like, C is like... I think it's like... You know, if it's on, I can... I'll listen to it. But like... God, yeah. Okay. I forgot about that. Okay. Really, I... I've really screwed up this time, haven't I? So I think it's perfectly fine that I can still love where record, but not like a few of his songs. Please spare my life. Please. So anyways, let's get on to the next song that accidentally I chose because I was like, oh, that looks like a cool song now. So I played it and this is how it went. Anyways, what's this song like? I'm just gonna... I'm just gonna listen to it. Melty Land. Nightmare. Fuck.  By the way, always do this to myself. I hate that. Why? This is surprisingly really good. I'm surprised by this. It's legitimately not... Not that bad. The song is a lot longer than I expected though. Four and a half minutes basically. Wow. I'm giving that a B and I put that in the list myself, motherfucker. Yeah, it was pretty good. It was actually like decently good. But what's that? It's the end of part one, part two. And we're going on to part two, part one. And we all know the final part is the most depressing one. Am I right attack on Titan? Yeah, I know because I've read the manga. I mean, let's find out. I'm liking the sound of this. This is... This is... Oh, it's giving me chills. Not because it's cold. This is cool. Oh dude, the sound of this is so good. Holy moly. Damn, that was pretty good. I'm gonna give that a high B. The reason why it's a high B is because I couldn't... Like, it kind of like... Since I couldn't really hear the lyrics that clearly, even though it was in Japanese, I like to still be able to hear the enunciation. It was sounding like something from Animal Crossing. See, it's not a bad start today. I gave it a B. And my second song deserves a higher ranking. This is like a unique weird sound. Oh, that's cool character. Yeah, see, it's a bit more understandable. This is cool though. Oh, dude, come on, man. I love this video. I love this video idea that I did. It's just gonna take me a long time. I love it when we got that. Oh, yes. I love it when I know what's gonna happen and it's gonna catch you part. Yes. I'm calling it. Five, four, three, two, one.  Those, those, those. Yeah. Thank you. Yeah, thank you. Thank you. God damn. That's an A. That was an A. I like that. I love it. It's good. It's great. It's good. That's what I like. I gave traffic jam an A. A. An A. It's like the only song that I can actually remember up to now. And then I gave it an A. What the flip-flap, flip-flap, flip-flap is that? Nah, not cool. Right. See? It deserves an S. So I'm giving it an S. Come on. Let's give it an S. Let's just do it. We all know it's an S. Let's go. And then everything is the complete opposite for the next song. And I still gave it an S. You've already got my attention. I love these type of songs. This is just so beautiful. This is the, yes, yes, yes. The voice, you can sing along to it. It's so relaxing and it's good. It's great. It's a nice, beautiful vibe. This is what I like, man. That was good. I'm putting that in S. Yes. You got a problem with me liking soft, beautiful bullets? Because goddamn, bullets are life. Bullets are great. Hey, Rainer. How's it going? It's my girl. Oh, she just, I'm going to sit down then. Go, me. Yeah, you got a problem with me liking soft, beautiful, soft, beautiful, bullet songs. That's not okay. That's not cool. Oh, and then I got two English Vocaloid songs in a row. That is so freaking awesome. I want to do a video on my English Vocaloid songs because I feel like that would just be a cool type of thing.  I'll do a video on it. Don't you guys love my framing?  Three, two, one, now. Alrighty, alrighty. Yeah, we've had good songs so far, I think. Yeah, we've had good songs. Oh, English. Oh, what voice is this? I wouldn't know what voice, I like this. Culpability. Big words today. So there's multiple voices in this one song. Cool. This is so catchy, man. Oh, it's finished. Damn. Okay. Oh, this is hard. I'm going to give it a low A. It's just got that catchiness, you know? It's got that like repetitive catchiness and I'm like, yeah. Woo. Uh-huh. Wow. And Island New Word. Responsibility for a fault or wrong blame. Culpability. Damn. Vocaloid out here teaching me more English than I really knew, which is not much because English bad. I like that. Thank you. Thank you for sharing. World domination. How to for me. See, I'm like kind of going through it a lot, like kind of fast. English version. Do I go for the English version? It does have 1.2 million views. These lyrics are very, these lyrics are very good. I like this song. The lyrics are good. Oh, it's not over. It is over. It was over. Wow. Okay, those lyrics. Those lyrics are what kind of carried the song for me. Like just listening to the lyrics is kind of what kept it going. It would have been a C. Just like from the sound and everything. But just because of how the lyrics were quite motivating and stuff for me, I'm going to put it in B. That was good. I like that. Thank you. Now up to this point, I haven't really given out that many Fs. If any, actually. Now that I've said that, I think it's a great time to say that I'm in a downward spiral of goddamn depression. Watch my pain. Oh no. Oh no, it's happening. It's happening. There's something that I'm constantly picking up in the song and I can only hear that and nothing else. Oh God. Wait, give me a second and let me think of something else. I don't want this to ruin the song for me. I don't want this to ruin the song for me. Okay. Oh no. I can only hear it. Oh God. Okay. Okay. How do I not be poobum? I'm going to give it an F. I'm sorry.  Hide and Seek by Ruru. Let's hope Hide and Seek by Ruru is goo goo. I don't know what I'm saying anymore.  It's happened again. I hate it. Oh God, mate. Oh no. Oh God, it's just, it's just torture to me, man. I feel bad for saying that, but that's literally like, oh, I can hear it almost.  Okay, we've got seven left to do. Let's just hope I don't have the third one to be the exact same as the previous two. Here's hoping. It's just a song, isn't it? It's like nothing to me that's screwing special. I feel like a, I feel, I feel like a, like a murderer today. I'm just being harsh now.  There's nothing I love about it. It's just listenable. It's just listenable, isn't it? Or otherwise, yeah. I was going to give that a C, but it went on for so long. I'm going to give that a D. Oh my God. I can be da Pinocchio P. We've got another P, dude. I know that the P guys are good guys, so let's do this. Genuinely kind of feel bad for like, like, because it's your guy's favorite songs, but you know, like, not everyone's taste is the same. It's just sometimes it's just like, it also depends on my mood that I'm currently in. And it's, oh, let's just play this. Peanut butter. I'll give that a C. I'm not sure if I actually talked at all during that entire song. It was just like, it was just there. I don't know. I feel like there just needs to be that, that oomph thing, you know, that little bit of, I don't know. It's just, it's just, it's just a C for me.   That was my pain. I cannot believe it.  You, you, yes you, I'm looking at you. You're evil to me. I cannot believe you did this to me and I want to refund. Of my sanity.  I legitimately didn't talk for the entirety of one of those songs. I'm a YouTuber. I'm in Yub-Tubber. I'm supposed to be talking, but no, not for that song. That was like a goddamn, that would spiral depression. But anyways, here's Katakurti Beirst. The song feels just so leg-luster. It's a rock song and it's got stuff that sounds cool, but it just ultimately feels super leg-luster. That was probably the coolest part of the song at ending. I'm going to probably give it like a D or maybe even an F. It just felt like there was no emotion. Now we're up to the final part of part two, part one, baby. Goddamn. And we're always at the end of part three, part one at the same time. This is just, whoa, deck on Titan. But my very last song was Ego. Okay, three, two, one, now. Did I click play? Did I click play? Oh, yes, okay.  I was kind of scared I was going to end on a bad note, but no, this song was good. Wow. I liked that. That was a good song. I'm giving it an A. Oh my God, we ended on an A. I looked so dead when I was reacting to this that downward spiral of depression really got to me. But I still really liked the song and I gave it an A. And yeah, that was the end of part two, part one. We're at the end of the video. Isn't this awesome for me? And yeah, this is what the final list looks like. I hope you guys like it. Is it how you like it? Let me know how you like the list. Does that make sense? Anyways, let's go back to me. I hope you guys enjoyed this video. I had a lot of fun reacting to everything and a lot of fun doing this part of the video. I was scared that I got stuck in that tree over there. So that was cool. That was an experience. But I kind of want to do more videos where I could be a bit more like active with the camera and like, I don't know, have like automatic sliding shot thing. I just, I don't know, I quite enjoy it like this. What are your thoughts on videos like this? I would actually like to do this again, but do it in a better way where I could be lazier and basically like be lazy. That's the goal in life. Be lazy. But I do got to say it is the end of part three, part one right now. And the final word, what should the final word be? Subscribe. Oh yeah. Also, I'm going to be doing a video on why you should listen to Fujikaze Next or maybe why you should watch Oden High School Host Club. So I don't know what I want to do. I'm just going to figure it out when I figure it out. So anyways, ciao ciao.


Hello, everybody. I'm joined today by senior security PM, Sarah Liatten, and we're going to talk about the whole implementation of Azure Sentinel on a hybrid implementation. Sarah, is Azure Sentinel only a cloud-based solution that can protect your cloud implementations? Or is there a story or something that we can share that can protect your on-premises implementation as well? Oh, definitely. The whole thing with a seam, I'm going to say seam, you might know depending on where you are in the world, you might know it as a SIM. It's S-I-E-M, so Security Information and Event Management System, that which is what Azure Sentinel is. It's really important that a seam looks at your entire environment. So whether that's on-prem or cloud or both in a hybrid implementation, which is what most people have these days, it's really important that a seam can look at both of those environments, because attackers aren't just going to look at your cloud environment, they're not just going to look at on-prem. They're going to traverse through different things. So that's why you're seeing needs to be able to ingest events and logs from everywhere in order to get security telemetry and potentially find attackers. So no, definitely, it's not just for cloud. It runs in the cloud and we use a lot of in-built cloud features to allow the service to scale, but it's certainly not just for monitoring cloud and not just for monitoring Azure. Wouldn't it be a very good seam if that's the only thing it did? That's just it, right? The whole aspect of attackers trying to get access to your information as a new currency and especially because we're all working from home, the situation is elevated in regards to the attacks that occur, because more data is traveling in more places. So a lot of organizations having that on-premises implementation, they worry, do they need a security solution just for their on-premises implementation, and then one for the cloud, meaning that I have multiple control vectors for my security piece, or something decentralized that I can go to the one portal and have an understanding in regards to what attacks are occurring and what I can do to automate to address those attacks. Yeah. I mean, one of the things that's really difficult for organizations nowadays is that our environments are getting more and more complicated. So you'll have some on-prem infrastructure. I mean, even Microsoft still has a bit of on-prem infrastructure. That's normal. You'll have some on-prem infrastructure. You've probably got something in the cloud. It may even be that you have something in other clouds as well. So you might have multiple clouds plus you're on-premise, and you need to be able to monitor all of these from a security perspective and operational as well, because if you don't, you don't have visibility of what's going on in your environment. But I mean, even before Cloud happened, it was still tricky to get appropriate monitoring and logging just across on-prem. So nowadays, when we've got the Cloud and on-prem in hybrid environments, it's even harder and it's definitely complicated, which is why you need to look at products that have that capability to look at everything. And as you said, to be able to centralize all that data, because the reality is you can't log into three, four, five, six, seven, even in double figures, number of portals, to try and work out what's going on in your environment. It's too time-consuming, it's too siloed. You need to be able to have a central place to be able to look at what's happening in your environment, because there's just no way that any one person, or even a big team of people, can efficiently run things without a centralized store. So, yeah, you're absolutely right. You need one place to go. And when hackers are chasing after your data, I don't think it matters to them if it's on-premise or in Cloud. They're going to chase it throughout your architecture regardless. And so, a new evolution like Sentinel has that ability to be that overseer of your entire architecture and not worry if it's on-premise or in Cloud, because it manages throughout. Yeah, exactly. Yeah, as you said, I have a sticker on the back of my laptop, which I can't hold up that says that's out of scope, said no attacker ever. And it's totally true that an attacker doesn't care where your data is. They're just going to go after whatever is valuable to them and whatever they can either resell or they can use. I mean, different attackers have different motivations. And so, yeah, they don't care where it is. And they will just go looking for it and they will take what they can find. So, certainly, there's no point just monitoring Cloud and saying, oh, we'll forget about on-premise and vice versa. It's, yeah, attackers go where the value is. And for most organizations, the reality is they will probably have valuable assets and data on-premise and in the Cloud. And attackers will just move around as they need to in your environment. So, yeah, you've got to look at all of those things. It's really important. So let's kick off with the first demo. And there's numerous demos you want to show us. What's the first demo we're going to go through? Okay, so, oh, so many things to go through. But I'll start with, I'm going to start talking about data connectors because a SIEM doesn't do anything until it has data in it. Now, I'm not going to go through all of these. You can see at the moment in the top there, I have 74 connectors. If you've been following Sentinel since it went GA about 18 months ago, you will know that we have a heck of a lot more connectors than we used to and we're adding them all the time. We do have, of course, have Cloud ones, as you would expect. We've got a lot of Microsoft products like Azure AD. We have Azure Firewall.  We've got a lot of third-party products. So if you're using Barracuda's checkpoints, and as I said, I'll just scroll down slowly so people can read. If you're using Microsoft 365 Defender, Cloud App Security, Office 365. Now, that's looking at the cloud side of things, but of course, as we've just talked about a lot, there's a lot of telemetry that we can bring from on-premise as well. Because there's 74 connectors here, I don't have time to go through them all. Otherwise, we'd be here all day and I think people would be quite bored, but I did want to highlight a couple of important ones here. So the first one that I wanted to talk about, they kind of go together is the common event format one. So common event format, or CEP, C-E-F, uses the log analytics agent, which is something we use in other environments as well. And it's an agent that you can install either on Linux or Windows. And what it will do is it will collect CISLog, common event format and CISLog messages if it's Linux. And it also does something with Windows Events, which I'll talk about in a second. But if you've got a device that outputs in CEP, which many firewalls do, many third-party products do, you can send that into Sentinel using this collector. So you essentially can make a collector, a centralized collector, and you can send that to Sentinel. Now, you can either make that collector on-premise and send it up to Sentinel, or you can create a virtual machine scale set and you can actually have that centralized connector and it can scale in and scale out as required. We actually have a template for that in our Sentinel GitHub repo, which I'll talk loads about later, and we can put a link to that as well. So it's actually already been configured, we've actually already built a template for it for you to use. So that's a great way to collect things, both SysLog and any device that outputs in CEP. Now, I did wanna talk about, I'm talking about CEP and SysLog together and there's a reason for that, which is CEP is actually just a more formatted version of SysLog. So of course, SysLog, as we know, that's where you get a lot of things in Linux. So if you've got a lot of Linux machines in your estate on-prem, you can bring them in using, you install the log analytics agent and then you can either have a central collector or each individual machine can send SysLog up into Sentinel. Now, again, generally we find that most customers will create a central collector and then send that up to Sentinel, but we can accept it individually as well. So that's the first side of things, the Linux side. So the other thing that you can use a log analytics agent for is to take security events from Windows machines. Now, we use the Windows version of the same log analytics agent to do that. As you can see, we've actually got, you can install the agent here. We have a different, obviously slightly different installs for things that are in Azure and things that are not in Azure, but basically we can collect security events. Now, how it works at the moment is you can actually, within Sentinel you can actually select which events to stream. So you can see we've got four different levels per se here. All events, which as you can see is everything, Windows security and AppLocker. Common is a standard set of events for auditing purposes. There is a list on our Microsoft documents that shows you which event IDs are actually collected and common. And minimal is just the very bare minimum that might be of note from a security perspective and then there's non. Now, one would assume if you're looking at installing these you probably don't want to use non, but definitely look at the other three. The reason that we give you different options is of course, because when you send events up to Sentinel and log analytics you are paying for the ingestion. So you may, although a lot of people will automatically jump to all events and say, I want to put every single event in here that might actually not be the smartest thing to do because you always need to think when you're doing security logging because you pay for what you ingest you need to think if I'm ingesting this and paying money, is it worthwhile? Am I getting a useful detection from it? So, and each business is going to have different ideas about whether it's worth it or not, whether a particular log is worth ingesting or not. But do be careful, don't necessarily go straight to all events because you can end up with very, very noisy, very, very noisy logs and ingesting a lot of data. And if you're not getting some interesting security detections from it it's probably worthwhile thinking if that's actually worthwhile ingesting. Usually what I abide by in those scenarios is whatever the organization that you support has agreed to based on the business rules for that organization, they'll be okay with if they've asked for full documentation or full analysis of the inputs that are coming through to analyze all, then you're allowed to analyze all. Don't do it on your own. Make sure that you have the buy-in from the organization that you support. And if there isn't that need, possibly there is because of ISO standards or specific verticals like finance and healthcare there might be that requirement. But if there isn't that requirement there isn't a standard to adhere to and your organization is okay with not capturing everything put the rules in place that agree with what your organization is trying to accomplish. Definitely. And something again, traditionally on premise seams they did work in a different way. What you would have is you would build a number of virtual machines. You would buy licenses for those virtual, well they wouldn't need to be virtual machines but typically they would be. You would buy licenses for your seam and all the machines that were part of your seam infrastructure on premise. And then it wouldn't be on how much data you ingested. It would just be on the literally the processing capacity of the machines that you bought, which means you could, traditionally what people did was they would throw as many logs as they could at their on premise seam because that's how you got value for money is that from what you paid for the license. Now that's the traditional way of doing it. Now of course as seams have moved into cloud they've gone to this ingestion based charge. So there is also a bit of a strategic mindset shift here that you need to be aware of that it's not necessarily, it's not cost effective anymore just to collect all the things for the sake of it. So what we do find is a lot of customers making that transition, they do have to have a bit of an evaluation because it might be that they've literally never evaluated it before because it was just, oh, we just send everything to our seam. Whereas now of course there, it makes sense to be more efficient about that. So it brings up a good question. If I do send all my data up to the seam, does that provide latency in terms of a response or a detection? No, so the good thing, I mean, if you did want to send all the things to Sentinel, that is absolutely fine. I mean, Sentinel sits on top of Log Analytics, which is part of the wider Azure Monitor platform. It's our entire monitoring platform for Azure. It will scale as required. And unless I believe that we have tested it to something insane like 10 petabytes of data. So if someone, if anyone out there can send more than 10 petabytes of data at Sentinel, then that would be an interesting thing to look at. But realistically, any organization, even our big large global customers wouldn't be able to send enough data up to Sentinel to get it to slow down. What is worth mentioning there though, because that's a very good point, is if you were collecting events from Syslog and Windows events, because we have our intermediary, the machine that's running the agent, you would need to scale that appropriately. And that's what I was referring to, talking about what's in our GitHub repo. We do have some virtual machine scale set templates that we've already made. And if you're not familiar with a virtual machine scale set, what that is, is a way that you can set some thresholds. And if, say, the processing gets to, or the IO gets to 80%, then Azure will automatically build another machine and scale out. You can also scale up. Scaling up isn't great. I'm not a big fan. Always scale out. And by scaling out, we mean adding more machines. Scaling up is when you increase the power to a single machine. But in order to do that, you have to reboot things. So that will provide a service interruption. So we prefer scaling out. So for these two that I've just talked about, which are more aimed at on-premise, you do need to think about how you size the number of collectors, depending on how many events you expect to send up to Sentinel. But when it actually hits the actual Sentinel system, the platform, it's not a problem from there. So you're right. There are a couple of considerations to take in there, but not with the actual processing power of the seam itself. Now, from the GitHub repo for the templates themselves, anybody can go in and extrapolate that and use it for their own purposes. Have you seen the reverse in terms of, you know, organizations contributing to the repo and providing their own spam on templates specific to possible verticals like healthcare and what have you? We're getting there. So I have the honor slash very, very busy job. I'm one of the people who review some of the submissions we get into our GitHub repo. There is quite a big team that do that because you can imagine we get a lot of submissions. So we get submissions from our customers, from our partners and also from internal Microsoft resources as well who've been doing work. So we do get some of customers sharing things back with us. Of course, it does depend on what it is. Sometimes customers have written proprietary things that they're not able to share, which we completely understand. But we do get people sharing their workbooks, their playbooks, detection rules. I had a partner. I know they shared a very cool little way or it was a cool little script and a template that were just made security events sending more efficient. And we really encourage you, if it's something you're able to share with the community, please submit it to our GitHub repo. We do review everything and we'll give you feedback. We are quite busy. We're trying to get faster. So do apologize if you don't hear from us for a bit, but we are trying to go through them because the fact is that when we're talking about security and I was told this in an old job by a manager of mine, and I think it's a really nice, I think it's a really nice way of looking at security in that insecurity, we're all in this together. We're not rivals. We're not rivals. We're not competitors. Everybody who runs computer systems needs to keep them secure. Now, and we can really benefit from knowledge sharing with each other. And even companies that are in the same industry, so whether it's finance or if it's retail or whatever it is, they may be competitors on a commercial level, but when it's security, they actually face similar threats and often it's really helpful to share that knowledge. Now, of course, as I was saying, there will sometimes be proprietary things that can't be shared outside, but I think sharing knowledge as best we can is one of the best things that we can do as a security community and an industry because we will face similar threats and we have similar issues. So the more collateral we can share, the better. So yeah, if you're out there and you're listening and you've done, you've written a cool hunting query, you've done some cool automation, if it's something that you don't need to keep internal, we really, really encourage you to submit it to the repo you can now get, which is very exciting, you can get some badges and we did do last year and I believe we're gonna do it again later on this year is we didn't do an Azure Sentinel hackathon and that was judged by some of our top security VPs like and Johnson and the winners actually got cash prizes and some other cool things. So it's definitely worth doing, like go do it. I'll stop talking about it because I love people to submit to the repo and we're always happy. Even if it's your first time, we've got loads of guidance on how to do it and you know that if you submit something to the repo it's being reviewed by an engineer and we can help you if there are just some mistakes or it doesn't fit with our templates, like we'll tell you and help you. So don't be scared to submit. We really appreciate your submissions. And that's the important piece, right? It's not only your creativity from the outside coming in in terms of what you're sharing with us at Microsoft, it's where is the mindset going in terms of security? What are the things that people are thinking about that provides us a better idea in terms of, well, what services do we need to address? How can we make Sentinel that much better to achieve what organizations are trying to accomplish? Definitely. And yeah, we do look at things submitted to the repo for ideas for new things that the product needs. And also we do have the Sentinel user voice. That's something that we have for most Microsoft products where you can submit ideas. You can also upvote ideas that have already been submitted. So if you've never looked at the Sentinel user voice go and look at that. Add your votes to anything you'd like to see and if you can't find the thing you want on there feel free to add it as a new idea. That's something we really appreciate too. We do look at it and we do submit those ideas from user voice to the Sentinel product group who are the engineering team who decide on the new things we're going to develop and the new things we're going to put on the product. And we're always listening to customers because of course, if it doesn't do what our customers need it to do then no one's going to use it. So that's really important for us. So let's move on to the next demo. So what are you going to show us next? Oh, so I'm going to show you a little bit. I realize we've just gone on a tangent there but I'm going to show you something that is just worth mentioning because it does confuse a couple. It does sometimes confuse some folks and it's worth mentioning for that reason. Now I talked before about, I talked before about the log analytics agent and having security events and syslog already going into your log analytics work space where Sentinel can see it. It's worth mentioning that if you already have a log analytics workspace you may already have this configured. So I'm going to start just by showing you something that is worth mentioning here because sometimes it does confuse people. We have here log analytics. So log analytics is what sits underneath Sentinel. And it's just worth mentioning that if you are already using log analytics you may already be collecting Windows event logs and security logs and syslog because that's not a feature specific to Sentinel. So it's worth looking if you're putting Sentinel on top of an existing log analytics workspace you may already find here that we're already collecting those things. So you can see here for example, I've got syslog coming in already. You can actually be quite granular on what you choose that the agent will send to you. If you're already doing it here and then you've got Sentinel on top you don't need to configure this in Sentinel. This is specifically for Windows events and for syslog. It is, I realize there's a bit of an overlap there but it's just worth mentioning. So if you're not starting from scratch just have a look and see if your log someone has already configured it in your log analytics workspace because they might have done. And so the connectors and it's already feeding the information into Sentinel you're capturing that information. What is the next steps in terms of analytics? What is the next steps in terms of reporting that you would want to look at? Yeah, so next step is we would look if we were wanting to get this going as quickly as possible which is what I assume most people would we would go and have a look at analytics. Now we have loads of out-of-the-box rules and if you're new to Sentinel this is always where I would recommend you start. And we're adding to them all the time. So it's always worth having a look to see if we've got any new ones. So you can see here we've got in use and marked on the ones that are already turned on but what I would do is have a look at these rules. So for example, I'm gonna look at this I'm gonna look at user login from different countries. Now you can see here the data source is octa. This is actually preview so it's quite new. In here it tells you data source octa single sign on. Now because it's gray here it says that we don't have this data source coming in and I know in this demo I'm using here we don't have octa. So that's gonna appear as gray. So there's probably no point turning that on. We won't stop you from turning on a rule template where the data source isn't actually coming into Sentinel but you can do if you want to. So instead let's have a look at this first access credential added to an application or service principle when no credential was present. So of course this is an identity one. So we're looking at Azure AD and you can see in order to have this rule working properly we need Azure AD audit logs. Now you can see it's green. So we have Azure AD audit logs going into this going into this workspace which means we can turn the rule on. So what you would do I realized this rule is already turned on but let's go with it. You would click create rule and then everything here is fully customizable. So if you don't like the name of it you can change it. You can change the description. We also map these rules to the Mitre attack framework. So there are quite a few different tactics. It's something that a lot of SOCs are using or trying to adopt. So we've put this one under credential access which makes sense but if you disagreed and wanted to change it, arguably maybe you could put this one also under privilege escalation potentially we won't go there. And then we can also change the severity here as well which I think for most people when you're just turning on the templates for the first time is most likely to be the thing you might change because we've considered at Microsoft when you've been writing this template that it's gonna be high. This is a high severity incident if this rule is triggered but you might not think it's high. You might want to change it to medium or low. And again, this depends on your organization's security policies, risk tolerance, et cetera. So you can change that. In the next tab, we've got the set the rule logic. So you can see here this is actually the rule logic. So this is written in KQL. If you KQL is Kusto query language we have a lot of different tutorials on KQL that are free. There's a great plural site course. You may have already used KQL in Defender for Endpoint. We use it there. It's used in log analytics as your data explorer. If you're not familiar with it it is a really nice query language that's pretty easy to pick up quite high level but also really flexible. I'm not in this particular video we don't have time to go into the nitty-gritty of KQL but... If there's an ask for it we would create that video later on down the road if that's something that you can reach out to us and let us know. And we'll set up more time with staring and get that done. Yeah, we love a bit of KQL. I do KQL tutorials reasonably regularly. And yeah, we're definitely keen to do that. And again, there's a lot of material online that Microsoft provides for free as well to digest in your own time but we can do videos as well. We map entities here. Now entities are sometimes... Entities are important because they help us match more things together. So an entity, as you can see there we've got five entities, account, host, IP, URL and file hash. Now the reason entities are important is because we start to see patterns with entities because if you have a host if you see a host coming up in a number of different alerts that suggests maybe that there's something bad going particularly bad going on with that host. It helps us join together a lot of what's going on. Now for some of these queries, it will already be defined but if it's not defined you can actually choose one of the columns from the logs to say, okay, this is where the host is. Then you don't have to define all of them. It's not necessary. And in these rule templates, we've done it for you but that's just if you're writing your own. Coming down to the next bit, we have query scheduling. Now in Sentinel we do, we run our rules on a fixed time period. The most frequently you can run them is every minute. You can't do them any quicker than that. And we can't fix a set time. I get asked about this a lot by customers. And the reason for that, there's not a particular reason for that but to be honest with you when we're doing things and saying run this rule every hour, run this rule every day, run this rule every six hours or run this rule every five minutes. It's not really necessary to say please run this at a fixed time because that's quite static. And an attacker, for example, if an attacker knows you run a rule at midnight every day and maybe they'll do all their attacking and dodgy things up to 11.59 PM.  It's much better to run them on a frequent basis rather than run things on a specific time. And then we have event grouping. Now event grouping is something that's very flexible. What it says is you can, it basically means an event is something that is of note but it doesn't mean we wanna necessarily trigger on alert and create an incident. So what we can do is if this triggers we can make one alert and group the events together. Otherwise we can trigger an alert for each event. So different, this is very, very business. Writing rules can be tricky because this is very, very contextual depending on the organization. Some organizations might want an alert every single time something's triggered. Some businesses will want to group them together and say for the last hour just group them all as one. Again, that's so, so, so dependent on the organization and the industry and their environment. And that's one of the things that's super interesting about SIEM but also makes it really kind of tricky because it's very difficult to do a one-size-fits-all. So of course with these templates this is a good way to start and you can just tweak them rather than having to go from scratch. Then we go even further than that saying you can also group the alerts that have been created. You can group them if all the entities match. You can group them if only certain entities match. So you can put all the alerts into one incident if the account matches or if the IP matches. There's tons of different things here. I could talk about this for a long time. If you're familiar with SIEM, this won't come as anything new to you. If you're brand new to doing security operations you'll kind of get a feel for it. It don't feel bad if you have to tweak these rules quite a lot at the beginning. That's what most SIEMs you have to do. And to be honest with you, it's an ongoing effort for all organizations because your environment isn't static, things change. You may need to tweak these. The great thing about Sentinel is because we've got these built-in templates and rules and we have a nice UI, it can be very easy to tweak them rather than having to run your own analytics to work out whether your rule is working or not. The other thing to remember that you had brought up earlier is don't do it on your own. Make sure that you have the business decision maker at your organization in lockstep with your efforts in deploying appearance because you wanna make sure that the business is bought in in terms of the efforts that you're putting forth for the reporting and detection of what's important to your organization. You know, gone are the days where the traditional IT Pro was the gatekeeper and all the rules were abided by what the IT Pro had put forth in this new age of information and information being the new currency that hackers wanna gain access to. It's very important to have the business decision makers involvement and investment in terms of what's actually being detected, how it's being detected and what's of importance to the organization to keep safe. Definitely. And that leads on to something that I will talk about in a second. Automated response. Now I managed to pick one that doesn't have playbooks in here, well done. But this is where we would add a playbook and add our automation, which I will talk about later. But for example, automation is where we would add like sending an email, posting in Teams. We can also do remediation. So we would tag that there. And then when we're finished, we can review and create this rule. Now I think it's going to, yes, it's gonna fail this validation. I knew that it was gonna do that. But obviously the idea is that you would validate it like we do with other Azure resources and then you could click create. So there's a big bit of work to do here. There's a fair bit of work to do here, but much less than the traditional scene when you'd write from scratch. In going through these rules and looking to see what is relevant. In particular, I will show you, we can filter here on the data sources to make it a bit easier. So of course I was talking quite a lot about security events in Syslog and Seth that would often come from on-premise. So if I just filter on those and I didn't do that properly, then we can have a look at the rules that use those data sources. So if I do that properly, we can see here there's a lot. We've still got like quite a significant number of rules here that are using those data sources. So for example here, we can see PowerShell Empire Commandlets. That is not something you want to see in your Windows security events. And so you can see what's relevant to turn on and then this will generate incidents. So here we've got an incident. Now this one's very busy. I've picked a very, very busy one here, but this as you can see is a multi-stage incident. And I'm not, this is the investigation graph. Now this shows all the different alerts that have been generated. Now I realize you probably can't read them. Don't worry too much because I'm going to show you them down the side here in the timeline and all the different entities that are involved. So we have some PCs, some users, but we've got a timeline here. So we can see the first thing that happened was a suspected credential theft activity. Now if I click on that alert, it'll tell me more about that. Now that came from Microsoft Defender ATP. If you're unfamiliar with that product, Defender ATP, it has just been given a new name. We did rename a lot of things at Ignite. That is our product that does security for on-premise active directory. So this is coming from on-prem and we can see here that the program exhibits suspect characteristics associated with credential theft. So that looks like potentially something has happened there. So if we go back to the timeline, we can then see we've got another alert here. The next thing that's happened is a malicious credential theft tool has been executed. If I click on that, again, it's come from ATP and this looks like if we scroll down, so someone's used a credential theft tool. It doesn't say which one is there, but of course credential theft tool. You don't have to be a security expert to know that's not a good thing. And then we're going to suspected golden ticket usage. Now, golden ticket is an on-prem AD attack. It's attack against Kerberos, which is an authentication method used an on-premise AD. It's not used in the cloud. So you can see that we've got an attack here against Kerberos that's been detected and it's used to access six different resources. So if we actually hover over that, we can see those six different resources there. There's a number of PCs and some accounts involved. I'm not going to go through this whole thing, but you can see there's some more suspected golden ticket usage. Then we've got local admin users using .NET commands. Again, that suggests that it may be that a user's been compromised that's got admin access and they're creating a new account to do nefarious things with because what lots of attackers will do is create brand new accounts, do all their bad things, delete that account, and then it's kind of covered up their activity. So that's a fairly typical attack pattern. So as you can see, there's a lot of things going here. We've had remote code execution enumeration of SMB. So again, this is mostly an on-prem attack from what we can see here so far. This is mostly an attack that's happened on-premise, but we're looking at it in the cloud using various different sources. So it's a great example of a hybrid scenario and we can dig into this investigation graph more to understand what's happening. We can start digging into these, if I zoom in a little bit, we can start to see all these different entities. We've got the PCs, we've got the hashes, we've got, you see good old Mimicats there? That's the credential theft tool being used. So we can start to dig into this by clicking on the related entities. So a SOC analyst can really quickly start to understand and piece together what's happening without jumping between loads of different portals, which is good because with incident response, whether it's security or otherwise, we know that the first thing you need to do is establish what's happening and the bounds of what's happening so you can contain it and stop it going any further. So that's investigation. I know this is a very, very busy one to look at but I think it's a good one. As you can see, if I zoom out, that investigation graph gets really big. Of course, this is gonna change every time you do an investigation what you see here and the sources but I think this is a great illustration of what you can do with Sentinel to do your investigations. Now we've gone through data ingestion, we've gone through reporting, we've talked about investigations now. The next step I would think would be what is the response? Now that we've detected an attack is occurring, we've done the investigation in terms of how the attack is occurring, what is the next step that Azure Sentinel provides that now addresses this attack? Yeah, so there's a couple of things here. Mostly I'm gonna talk about logic apps and automation. Now logic apps is the way that we do automation throughout the whole of Azure. It's not a Sentinel specific thing but we do use it in Sentinel and we use it for three main things. One is alerting, one is remediation. So actually automatically remediating things and one is enrichment. So there's, and there are different use cases for different things, but typically every single customer really should be, as a starting point, you should be using the automation to do alerting. So if you're not familiar with logic apps, it's a really nice way to do automation, very simply. It has a nice GUI interface like you can see here. You don't have to know any code. For those of you who are interested in the background, it is running JSON. So we're gonna use logic apps. If you haven't seen logic apps before, it's the way we do automation across the whole of Azure. It provides a really nice GUI interface to write automation. In the backend is JSON. You can look at that in the code view. I personally am not the best coder in the world. I'd much rather just use the interface here. So what we can do is we can say, when in a response to an Azure Sentinel alert is triggered, what do we want to do? So we've added a box here that says, get the incident details from the alert. So we're grabbing here the subscript, we're grabbing the details. So we have to take the subscription ID, the resource group, the workspace ID and the system alert ID. Now the reason that we're taking these, and we have to take these every time we generate an alert, so we can pass them into another place, another program. We might be passing it to an API, but what we're doing here is we're adding it to Teams. So we're saying, if an alert is triggered, take all the details of that alert and send them to Teams. So you connect to Teams. It's very straightforward. And then you pick the Teams tenant, the channel you want it to go in and then you can post a message. Now you can see here the message can be dynamic content. So we take the alert severity, the title, the status, et cetera. And basically we would post that, for example, in your SOC Teams channel and say, hey, this is an alert. We need to, here's an alert that's been raised, someone needs to look at it. We can also send emails. You can raise tickets. So if you've got a ticketing system like ServiceNow or JIRA, something like that, you can do exactly the same thing. You can automatically create a ticket. You can assign it to different people, depending on the department you work for, because sometimes in some organizations, different tickets will go to different departments. There's a ton of things you can do here. And that's kind of your basic alerting, setting up the incident. The next thing you might... So sorry. No. That's huge because a lot of the questions we get about Sentinel is, does it always provide that automated response in terms of now addressing that issue? Can it do the notification? Because I have a trouble ticket system in place that I have to adhere to because of my requirements of my vertical. And I can't have that automated response in place. So Sentinel is not for me or my organization because under my understanding, that's what it does. It does the automated response. What you're telling us here is from this logic app, I can pretty much put my business rules in play. I don't have to have a coding background to do so. And I can make it so that it's a notification or set up of a trouble ticket for follow-up or something that's based on the business rules that my organization abides by, as opposed to, no, no, this is just going to address the issue and walk away. Yeah, no, totally. I mean, to be honest with you, most organizations I would not expect to just, I'm going to fix it and walk away because there's no, you can't report on that and you need to operationally understand what's happening in your business from a security perspective. In an ideal world, yeah, we'd automate and we should automate away as many things as we can. But the nature of security operations and the variety of things you see means that we will never be able to automate everything. There will always be a proportion of tickets and issues that have to be looked at by a person. The idea with automation is that we automate away the routine things where we know how we want to respond and where there's a lot of manual process and just very repetitive actions. And anyone who's worked in a SOC will know that there are a lot of repetitive actions that often have to be taken. Now, the idea with automation is we automate those away to leave SOC analyst to work on the really interesting duty things that have never been seen before. And that's exactly what we do internally within Microsoft as well. We try and clear away and automate away nine out of 10 alerts and incidents before they get to a real person. It's tricky to do. It takes a lot of, it's tricky. I'm not gonna lie, like it does require upfront work because of course, you have to think if we see this situation, how do we want to respond to it? Then you need to build some automation. And realistically for most organizations, it's a journey. A lot of customers I've worked with might just start off with this basic alerting. Raising a ticket, posting in teams, letting everyone know what's happening. And then further down the line, they might say, hey, we're keeping this incident and we do exactly the same thing every time. Can we work some automation into that? So it is a journey, definitely. But certainly if you need to raise tickets in your ticketing system for operational reporting, et cetera, Sentinel can definitely fit into whatever your operational procedures are. And although Sentinel does have its own incidents handling pages where you can write comments and do your own incident and write things in there, a lot of customers, because it aligns with their wider operational procedures, choose to use a third party ticketing system. And I would definitely say there is nothing wrong with that at all. If that's what you need to do, you do it. And that's been one of the biggest changes, right? And the fact that Microsoft is working with third party software because of that requirement, if you're in healthcare and you're finance, retail, whatever that may be, there's a current course of action that takes place. And you have to continue on using those applications. It's amazing that partnering with those third parties to have this rules in place and automation of a lot of the tasks that would be mundane or tedious before can now be quick in terms of the process of something as simple as creating a trouble-ticking number. Exactly, because realistically, and I have seen this in my career, it used to be that the scene would generate an alert and someone would have to go into whatever ticketing system they use and manually copy and paste things over, which is just a waste of a sock analyst time. It's not a constructive use of their time, really. And so it's cool that we can get rid of that. And so yeah, there's so many things we can do with automation. You've probably seen, and I've talked about many times before, we can do things like call virus total and look and see if the IP or the hash is in virus total. If you're not familiar with virus total, it is a third party system that has a store of things that have been identified as malicious because that might help you decide the urgency of an incident. You might want to block a user in Azure and NAD. So for example, the incident that we just looked at previously where there had been some, it looks like some accounts have been compromised, it might be that we say, okay, let's take that entity, let's block it. Now, it might be you don't want to block it, you might force them to change their password or ask them to re-authenticate with MFA. Again, what precisely you want to do, and I think this is one of the trickiest things, aside from writing rules and your thresholds, is how you want to respond to an incident. Because again, that's going to really depend on the business. Some businesses might have a very low tolerance for, might have a really, really low tolerance for accounts being compromised, so they might want to block anything that looks suspicious. But on the flip side of that, if you run automation where you're just blocking users all the time, it's going to, if there's a false, if it's a false positive and we have to, realistically, you will always have a, whilst we're always trying to bring them down as much as we can, there's always going to be some false positives. You don't want to block somebody and block their account when actually there's nothing wrong and it might increase calls to your service there to unblock people. So there's a huge balancing act there and I mean, that's security generally, right? You've got to balance security with the business running smoothly. And that's a line that's very difficult to tread. And it always will be, I think, but we have to keep trying. Now, from a business rules perspective, what was interesting, you talked about the whole aspect of Azure AD and if an account has been compromised, so that individual would be put through, okay, now you have to change your password because we did detect this. So Sarah, you shared the scenario about Azure AD and when a password has been compromised for a user, that user changed their password. What about in an instance where it's Active Directory and it's on-premises implementation? That's a really good question and a very good one to ask. Now, it's going to depend on how your Azure AD and on-premise AD is set up. If your Azure AD is synchronizing with your on-premise AD and Azure AD is the boss of all of that, then all we need to do is actually issue the commands to Azure AD and it would take care of it on-premise as well. If you're not syncing them, then that's a little bit different. So this is why we do recommend it is Microsoft Best Practice that you sync your Azure AD, your on-premise AD and you have Azure AD as the sort of master source and also this is controversial and we probably don't wanna go here. We also recommend that you do actually store all your password hashes, you don't just synchronize the user accounts, you also synchronize the hashes of your on-prem passwords in the cloud. That is Microsoft Best Practice. Some people, as I said, we won't go there because that can go into a heck of a debate. Some people feel very strongly about that, but just so you know, we don't store the actual password, we store sort of a hash, something that's been hashed and salted about a thousand times. There are many, many advantages to doing that. It helps us be able to use our threat intelligence on your on-premise AD passwords. So if you're not doing that and some organizations and some individuals I know feel very strongly about this because I've talked to people, do you go back and have a look and consider doing it? There's a ton of benefits, but that's probably a different session that we could go into that one. So we've gone through the full scenario, data ingestion, we've gone through reporting, we've gone through event investigation, we've gone through in terms of response. This covers everything from an on-premises implementation to cloud and a hybrid scenario with both scenarios, both instances connected into the one architecture. If somebody wants to start down their journey of now doing the investigation of Azure Sentinel for their hybrid implementation, what would be the best first steps? So I think the best thing, there's a couple of things. We have a heap of learning resources. We have, very recently, well, when we're recording this in the past month, we've released Microsoft Learn, MS Learn modules that you can go and work through to get familiar with Sentinel. We have the Azure Sentinel Ninja training. I've mentioned this before, but one of our amazing program managers in Israel took the downtime over Christmas and New Year to update it for 2021 because we've got so many more things in there. So that is, I mean, it's probably 20 odd plus hours of material about how to set up Sentinel, how to set up the connectors, how to set up particularly the log analytics agents that I talked about for taking things from on-prem. There's so much stuff in there and it has been very recently updated with all the new features in Sentinel, which we haven't even managed to talk about all of those because I talked too much and there's way too much in Sentinel to talk about, but it's all in there. Also, keep an eye, we've got the Azure Sentinel GitHub. Of course, I've already talked about that, but even if you don't feel like you're ready to contribute, we have loads and loads of templates and things where you can just deploy it into your subscription. So if you see something that either we have created or somebody else has and you think it would be useful for your organization, most things will have an ARM template, which means you just click deploy to Azure and it will go off and push it into your environment. You may need to configure some variables, but you get the idea. So, yeah, we've got the Microsoft security community where we do regularly, we do webinars, the program managers and engineering for Sentinel. We talk about new features, but we may just do a focus session on something in particular that's sort of a hot topic in Sentinel. I'm gonna be doing one later on this week about monitoring Azure Sentinel itself for how you audit what people do in Sentinel. We save them all onto YouTube so you can go back through the back catalog and see what's there. We've definitely got some things on running it in a hybrid environment. And yeah, they're probably the main ones I would start with, but there's so much out there. So definitely have a look. If you can't find something or you have specific questions, you can find me on Twitter. I do reply to people. And we're always happy to help. Sentinel's a really cool thing. It's still very new in the grand scheme of things. So we know lots of people have questions. So we're really keen to hear your questions, help you out and get you started with it. So, just reach out. But there is quite a lot of stuff out there and we'll have all the links to that as well accompanying this video. So yeah, it's a good way to start. The links themselves will be included on the video as well as there'll be an accompanying blog post that this video will be embedded into. So if you're watching this video on YouTube or on any other platform, channel nine, what have you, we will also share the link below that is the corresponding blog post that will have all the links as well as replicating all the steps that Sarah had gone through in terms of the demos themselves. Sarah, so awesome to have you on to run through this because I love your passion for security and your passion for enabling those to be more secure, to help the organizations be more secure. Again, one more time, if they wanna get ahold of you, what's the best way to get ahold of you on social media? Yeah, you can get ahold of me. I am at underscore Sarah Yo, Sarah Y.O. I've got a far too common name to be able to just have at Sarah or at Sarah Young. But yeah, you can get ahold of me on my Twitter handle. I do check my DMs, they actually are open. So, you know, do reach out to me. There's the Microsoft tech community where myself and my engineering colleagues, we answer questions as well. And yeah, please have a go with Sentinel. I'm a big believer, my main belief in life, not just with Sentinel in life, maybe just security, is that security doesn't have to be hard. Security should be easy. It is a lot of common sense. Of course, there are many things in real life, in business world, you know, there are competing pressures, et cetera, that don't make it that straightforward and black and white. But certainly here at Microsoft, we're trying to make that stuff as easy as we can and make good security straightforward. So yeah, have a go at Sentinel and see how you go because it's definitely a great thing and it's changing a lot. We're getting so many new features so quickly. It's even hard for me to keep up and it's my job. So yeah, go out there and have a go. Now, if you have any additional questions, we have a Discord server that's set up specifically for this session, for session ops 103. And if you want to get ahold of me for some reason, you can get ahold of me on Twitter at Wireless Life. Sarah, thank you very much for your time and everybody, we'll just get you on the next video. Thanks, bye.