Microsoft Sentinel is a scalable, cloud-native security information and event management (SIEM) solution built on Azure.
Key capabilities
- Log collection: Ingest data from Azure, Microsoft 365, and third-party sources.
- Analytics rules: Detect threats using built-in and custom rules.
- Incidents: Correlate alerts into actionable incidents.
- Hunting: Proactive threat hunting with KQL queries.
- Automation: SOAR playbooks using Logic Apps.
- Workbooks: Visualization and reporting dashboards.
Data connectors
- Microsoft services (Azure AD, Defender, Office 365).
- Cloud platforms (AWS, GCP via connectors).
- Security products (firewalls, EDR, identity).
- Custom sources via API or syslog.
Integration with Azure security
- Microsoft Defender for Cloud alerts.
- Azure Activity Logs and diagnostics.
- Azure AD sign-in and audit logs.
- Microsoft 365 Defender incidents.
Pricing model
- Pay-per-GB ingested data.
- Commitment tiers for volume discounts.
- Free data sources (Azure Activity, Office 365).
Best practices
- Start with Microsoft data sources (free tier).
- Tune analytics rules to reduce false positives.
- Use automation playbooks for common responses.
- Implement hunting queries for proactive detection.
Related Articles
View all articlesService Account Security: Managing Non-Human Identities in Cloud Environments
Non-human identities now outnumber human users 50:1. Learn how to secure service accounts, API keys, and machine identities across AWS, Azure, and GCP to prevent the most common cloud breaches.
Read article →
Cloud Incident Response: A Step-by-Step Guide for AWS, Azure, and GCP
Learn how to respond to cloud security incidents effectively. This guide covers preparation, detection, containment, and recovery.
Read article →FedRAMP Authorization Guide: Cloud Security for Federal Government Compliance
Complete guide to FedRAMP authorization for cloud service providers. Learn impact levels, JAB vs Agency authorization paths, 3PAO assessment, continuous monitoring requirements, and documentation essentials with practical timelines and costs.
Read article →Zero Trust Architecture: A Practical Guide for Cloud Security
Learn how to implement Zero Trust architecture in AWS, Azure, and GCP. This guide covers the core principles, implementation strategies, and common pitfalls.
Read article →Explore More Security Operations
View all termsChronicle Security Operations
Google Cloud security analytics platform that provides threat detection, investigation, and response using Google infrastructure and intelligence.
Read more →Endpoint Detection and Response (EDR)
Security software that monitors endpoints for malicious activity, enabling rapid detection and containment.
Read more →Managed Detection and Response (MDR)
A security service that combines technology and human expertise to detect, investigate, and respond to threats 24/7.
Read more →SBOM (Software Bill of Materials)
A comprehensive inventory of all components, libraries, and dependencies that make up a software application, enabling transparency in the software supply chain.
Read more →Secrets Management
The practice and tooling for securely storing, accessing, rotating, and auditing sensitive credentials like API keys, passwords, certificates, and encryption keys.
Read more →Security Information and Event Management (SIEM)
A platform that ingests security telemetry, correlates events, and surfaces alerts for investigation.
Read more →