Comparing Azure Sentinel and ML-Extended Solutions Applied to a Zero Trust Architecture

This paper explores the efficacy of Azure Sentinel as a standalone solution versus an ML-extended implementation for predictive maintenance and failure prediction, advanced anomaly detection, and threat hunting within a Zero Trust Architecture. Azure Sentinel, a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution, is renowned for its robust security monitoring and threat detection capabilities. However, as cyber threats become more sophisticated, traditional methods may not suffice. Integrating Machine Learning (ML) with Azure Sentinel can significantly enhance its capabilities, providing more accurate and timely insights. This study evaluates the performance of various ML algorithms, including Random Forest and XGBoost for predictive maintenance, Logistic Regression and SVM for anomaly detection, and Isolation Forest and Autoencoders for threat hunting. The results indicate that the ML-extended solution significantly outperforms the standalone implementation across all key metrics, such as Precision, Recall, F1 Score, and False Positives. The findings underscore the potential of ML-enhanced security measures in fortifying defenses within a Zero Trust Architecture, offering a more proactive approach to cybersecurity.