Topic 4 of 8
Microsoft Sentinel
With remote work and cloud services, the attack surface is huge, and watching dozens of systems by hand is no longer viable. SIEM and SOAR solve that, and Sentinel is Microsoft's solution that brings them together. The exam asks about the difference between the two concepts, what each part of Sentinel does, and how response is automated.
Contents
What is a SIEM?
A security information and event management system collects data from the whole digital environment (infrastructure, software, services, and resources, on-premises or in the cloud) and analyzes it to find threats.
Log aggregation
Gathers logs and events from firewalls, servers, identity systems, apps, and endpoints into one platform.
Correlation
Looks for patterns and relationships: a late-night sign-in isn't worrying on its own, but it is if the same user then downloads lots of sensitive files.
Alerting
Raises alerts on suspicious activity so an analyst can decide whether there's a real threat.
Incident creation
Groups related alerts into incidents: case files representing a potential threat.
It also provides centralized visibility. Without a SIEM, detecting a breach can take days or weeks; with one, minutes.
What is a SOAR?
A security orchestration, automation, and response system takes alerts from the SIEM and other tools and triggers automated workflows to respond.
Orchestration
Connects tools so they work together: on a threat, it queries the identity system, checks a threat intelligence feed, and notifies the team, all coordinated.
Automation
Runs repetitive tasks without manual effort, instead of an analyst repeating the same steps every time.
A playbook is a predefined sequence of actions triggered by an alert or incident type. Example for a suspicious sign-in:
Disable the account
Notify the security team
Open a help desk ticket
Gather context on the user's recent activity
| SIEM | SOAR | |
|---|---|---|
| Provides | Visibility | Speed |
| Does | Collects, correlates, and detects | Responds automatically |
| Key piece | Incidents | Playbooks |
Together they form the foundation of a modern SOC: a single source of data and context, less time between detection and containment, repeatable processes with fewer human errors, and more time for complex investigations.
AI and alert fatigue
Attackers use automation and AI to attack at scale, so AI-powered defenses are no longer optional. Common capabilities in modern SIEM/SOAR:
- Anomaly detection against a baseline of normal behavior
- Alert correlation and prioritization into incidents with severity
- False positive reduction with models trained on historical data
- Multistage attack detection: reconnaissance one day, persistence days later, exfiltration weeks after
- Natural language assistance for queries, summaries, and response guidance
Alert fatigue
Thousands of alerts a day lead analysts to dismiss them without review, exactly the gap attackers exploit. It's fought with incident grouping, severity scoring (informational, low, medium, high), and automatic enrichment with threat intelligence, user history, device compliance, and location.
What is Microsoft Sentinel?
A scalable, cloud-native SIEM and SOAR solution, with AI-powered security analytics and threat intelligence across multicloud and multiplatform environments. It collects and correlates signals from users, devices, apps, and infrastructure on-premises, in Azure, AWS, and GCP. Today it's both a SIEM and a security platform.
Collect
More than 350 built-in connectors and format normalization
Detect
Analytics rules and AI-powered detections, with fewer false positives
Investigate
AI-assisted tools and proactive hunting to the root cause
Respond
Built-in orchestration and automation
Where it's used
The recommended access point is the Microsoft Defender portal, with a unified operations experience. The Azure portal experience retires on March 31, 2027; after that, Sentinel will be available only in the Defender portal.
Sentinel as a platform
Sentinel data lake
Analytics tier
A Log Analytics workspace: data lands here first, and this is where rules, real-time alerts, advanced hunting, and incidents run. It's queried with KQL.
Data lake tier
Low-cost long-term storage with an open-format copy. It keeps data for up to 12 years to investigate persistent threats and build baselines from months of history. It supports graph analytics and AI notebooks.
It centralizes logs from Microsoft 365, Defender, Azure, Entra ID, Purview, Intune, and more than 350 connectors, including AWS and GCP.
Sentinel graph
Models relationships among assets, identities, activity, and threat intelligence to reason over connected data instead of isolated tables. Example: which paths an attacker could take from a compromised identity to a critical asset.
Sentinel MCP server
A hosted model context protocol interface so teams and AI agents can query the data in natural language, without knowing the schema or writing code.
Threat detection
Analytics rules query the data regularly, generate alerts, and group related ones into incidents. In the Defender portal, custom detections unify rule creation over Sentinel and Defender XDR data, with real-time detections and lower ingestion costs.
Rule-based
Matches data against known signatures and conditions. Templates from Microsoft experts in the Content hub.
AI and machine learning
Behavioral baselines and the Fusion engine, which links low-severity signals from several sources into high-confidence incidents to surface multistage attacks.
Threat intelligence
Matches ingested data against known malicious IPs, domains, and URLs from threat actors.
- Coverage maps to the MITRE ATT&CK framework, a global knowledge base of adversary tactics and techniques, to see what your rules cover and where the gaps are.
- The Content hub deploys packaged solutions for a complete scenario: data connectors, workbooks, analytics rules, hunting queries, and playbooks.
Investigation and hunting
An incident is a case file that brings all the evidence together: alerts, affected entities, timeline, and context. It's assigned, triaged, and investigated in the Defender portal, where Sentinel and Defender XDR incidents appear in the same queue.
Threat hunting is proactive: instead of waiting for an alert, the team runs queries to find suspicious activity that hasn't triggered any rule yet. A significant finding can be turned into a custom analytics rule so it alerts automatically in the future.
Response and automation
Automation rules
Centrally manage how incidents are handled. You define conditions (severity, source, entity type) and actions: assign to an analyst, add tasks, change status, or trigger a playbook.
Playbooks
Automated workflows built on Azure Logic Apps. For a compromised account they can disable it, open an ITSM ticket, and notify the team before an analyst even opens the incident. They also run on demand, with one click.
Together they cut the time between detection and mitigation and free the team for investigations that require human judgment.
Security Copilot in Sentinel
It doesn't replace analyst judgment: it surfaces context faster. It works embedded in the Defender portal (for any incident, including Sentinel's) and in the standalone experience with the Microsoft Sentinel and Natural language to KQL for Microsoft Sentinel plugins.
Incident summaries
What happened, entities, impact, timeline, indicators of compromise (IoCs), and actors.
Guided responses
Triage, containment, investigation, and remediation recommendations. They're suggestions, not automated actions.
Script analysis
Explains obfuscated scripts (like PowerShell), whether they're malicious, and which MITRE ATT&CK techniques they use.
File analysis
A summary with detections, certificates, API calls, and strings found in the file.
Identity and device summaries
Role, role changes, sign-ins, risk, posture, vulnerable software, and Intune data.
Incident reports
Summary, actions, analysts, and classification, exportable to PDF or to the activity log.
Natural language to KQL
For example: "show sign-in attempts from unfamiliar locations in the last 48 hours" generates the query.
Threat intelligence
Summarizes the most relevant threats based on your exposure or industry.
- Security Alert Triage Agent: classifies alerts at scale (phishing, identity, cloud) and separates real attacks from false positives, with step-by-step reasoning.
- Dynamic Threat Detection Agent: an always-on service that correlates alerts, events, and intelligence to detect what rules miss.
- In the standalone experience, the incident investigation promptbook chains prompts: report, related alerts, reputation, users, and devices.
Exam scenarios
| Need | Answer | Why |
|---|---|---|
| Gather logs from firewalls, servers, identities, and endpoints in one place | SIEM (Sentinel) | Log aggregation and correlation. |
| Automatically disable a compromised account and open a ticket | Playbook (SOAR) | An automated workflow in Azure Logic Apps. |
| Assign every high-severity incident to a specific analyst | Automation rule | It handles incidents based on conditions. |
| Look for suspicious activity that didn't trigger any rule | Threat hunting | It's proactive. |
| Join weak signals from several sources into a multistage attack | Fusion | Machine learning correlation engine. |
| See which attack techniques your rules cover and where the gaps are | MITRE ATT&CK mapping | It visualizes detection coverage. |
| Keep years of logs at low cost for long investigations | Data lake tier | Retention of up to 12 years. |
| Write a hunting query without knowing KQL | Natural language to KQL (Security Copilot) | It generates the query from the question. |
Common exam traps
❓ Which service are Sentinel playbooks built on?
Azure Logic Apps. Automation rules decide when to trigger them.
❓ You want to find threats that haven't generated alerts yet. Which feature?
Threat hunting. Analytics rules only detect what's already defined.
❓ Which component links low-severity signals from multiple sources into a high-confidence incident?
Fusion, the machine learning correlation engine.
❓ Does SIEM or SOAR automatically disable a compromised account?
SOAR. The SIEM detects and alerts; SOAR runs the response with playbooks.
❓ Does Sentinel only collect data from Azure?
No. It's multicloud and multiplatform: on-premises, Azure, AWS, and GCP, with more than 350 connectors.
❓ Do Security Copilot's guided responses run on their own?
No. They're recommendations; the analyst decides.
❓ Where will Sentinel be used after March 31, 2027?
Only in the Microsoft Defender portal; the Azure portal experience retires.
Did you get this topic?
Test what you just learned
A team wants to install, all at once, the connectors, workbooks, analytics rules, and playbooks to protect a specific product in Sentinel. Where does it get them?
Ready to test "Microsoft Sentinel"?
Original questions, each with a full explanation.
Start a mock exam