Skip to content

Commit 37a93c8

Browse files
committed
Adding other best practices links
1 parent 591c670 commit 37a93c8

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

articles/sentinel/best-practices.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ More than ingesting alerts and logs from other sources, Microsoft Sentinel also:
5252
- Provides **[threat response capabilities](overview.md#respond-to-incidents-rapidly)**, such as playbooks that integrate with Azure services and your existing tools.
5353
- **Integrates with partner platforms** using [Microsoft Sentinel data connectors](connect-data-sources.md), providing essential services for SOC teams.
5454

55+
## Create custom integration solutions (partners)
56+
57+
For partners who want to create custom solutions that integrate with Microsoft Sentinel, see [Best practices for partners integrating with Microsoft Sentinel](partner-integrations.md).
58+
5559
## Plan incident management and response process
5660

5761
The following image shows recommended steps in an incident management and response process.
@@ -71,6 +75,14 @@ The following table provides high-level incident management and response tasks a
7175
|Entity behavior | Entity behavior in Microsoft Sentinel allows users to review and investigate actions and alerts for specific entities, such as investigating accounts and host names. For more information, see:<br><br>- [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](enable-entity-behavior-analytics.md)<br>- [Investigate incidents with UEBA data](investigate-with-ueba.md)<br>- [Microsoft Sentinel UEBA enrichments reference](ueba-reference.md) |
7276
|Watchlists | Use a watchlist that combines data from ingested data and external sources, such as enrichment data. For example, create lists of IP address ranges used by your organization or recently terminated employees. Use watchlists with playbooks to gather enrichment data, such as adding malicious IP addresses to watchlists to use during detection, threat hunting, and investigations. <br><br>During an incident, use watchlists to contain investigation data, and then delete them when your investigation is done to ensure that sensitive data doesn't remain in view. <br><br> For more information, see [Watchlists in Microsoft Sentinel](watchlists.md). |
7377

78+
## Optimize data collection and ingestion
79+
80+
Review the Microsoft Sentinel [data collection best practices](data-collection-best-practices.md), which include prioritizing data connectors, filtering logs, and optimizing data ingestion.
81+
82+
## Make your Kusto Query Language queries faster
83+
84+
Review the [Kusto Query Language best practices](/kusto/query/best-practices) to make queries faster.
85+
7486
## Related content
7587

7688
- [Microsoft Sentinel operational guide](ops-guide.md)

0 commit comments

Comments
 (0)