Microsoft's cloud-native SIEM and SOAR. It collects and correlates security events from Azure, Microsoft 365, on-premises environments, other clouds and third-party solutions, detects threats with analytics and AI, and automates the response with playbooks. It was formerly called Azure Sentinel.
In AZ-305 it is distinguished from Microsoft Defender for Cloud: Defender assesses security posture and protects workloads; Sentinel centralizes detection and investigation of incidents from multiple sources (SIEM/SOAR). It runs on top of a Log Analytics workspace. Question: correlate security events from several sources and automate the response → Microsoft Sentinel.
Microsoft Sentinel is a concept that can show up on the exam. Check the full guide to see it in context.