Azure Sentinel Insecure Protocols Workbook Implementation Guide

This blog post is authored by Jon Shectman and Brian Delaney.In this blog article, we’ll examine the Insecure Protocols Workbook(IP Workbook) and how, with minimal on-premise configuration, you can leverage its capabilities. In this article, I’ll provide the configuration instructions you need to successfully use the IP Workbook.If you’re not familiar with the IP Workbook, that’s ok. However, for the purposes of this blog entry, I’m going to presume a general familiarity with Azure Sentinel and with Workbooks.Edit: when you're done here, pop over to the blog entry covering some recent functionality enhancements.Stage 0/Background: the Sentinel IP WorkbookThe Azure Sentinel IP Workbook allows you to gain insights into insecure protocol traffic by collecting and analyzing security events from Microsoft products. You can view analytics and quickly identify sources of legacy protocol traffic, like NTLM and SMBv1. You will also have the ability to monitor use of weak ciphers as well as lega...