[Sentinel] What's new in Microsoft Sentinel for July 2023

Microsoft has introduced a set of new features in Microsoft Sentinel, its Cloud SIEM (Security Event Information Management) solution.

Here is a summary of the changes and features that Microsoft was able to introduce during the month.

• The following limits regarding entities in alerts and entity matches in analytics rules have been increased

• You can now define up to ten entity matches in an analytics rule (instead of five).

• An alert can now contain up to 500 total identified entities, distributed equally among mapped entities.

• The size of the alert Entities field is limited to 64 KB. (This size limit previously applied to the entire alert record).

• Content Hub is generally available (GA)! The Content Hub centralisation changes announced in February have also been published. As part of the GA rollout, the default view of Content Hub is now the List view. The installation process has also been simplified. When you select Install or Install/Update, the experience behaves like a mass deployment.

• You can des incident response playbooks for SAP in order to leverage Microsoft Sentinel's security orchestration, automation, and response (SOAR) capabilities in conjunction with SAP. Microsoft Sentinel features specially designed playbooks, included in the Microsoft Sentinel solution for SAP® applications. You can use these playbooks to automatically respond to suspicious user activity in SAP systems, by automating corrective actions in SAP RISE, SAP ERP, SAP Business Technology Platform (BTP), as well as in Azure Active Directory.

• Preview of the Microsoft Sentinel Solution for D365 Finance and Operations to collect audit logs and activity logs from the Dynamics 365 Finance and Operations environment, and detect threats, suspicious activities, illegitimate activities, etc. The solution includes the Dynamics 365 Finance and Operations connector and built-in analytics rules to detect suspicious activity in your Dynamics 365 Finance and Operations environment.

• (Preview) Monitor and optimise the execution of your scheduled analysis rules. These tools provide information on the execution of your scheduled analytics rules, based on the health status of Microsoft Sentinel and audit data, as well as a feature enabling the manual re-execution of previous rule runs over specific time windows, for testing and optimisation purposes.

More information at: What's new in Microsoft Sentinel | Microsoft Docs