Microsoft Sentinel: Cloud SIEM

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform. It ingests logs and signals from across your entire digital estate — Azure, on-premises, other clouds, and SaaS applications — applies AI and machine learning to detect threats, and helps security analysts investigate and respond to incidents at scale.

Traditional log management tools collect and store logs for compliance and search. A SIEM goes further by correlating events across data sources, applying detection rules to identify attack patterns, and prioritising incidents for human investigation. Sentinel adds the SOAR capability — automating repetitive response actions (like blocking an IP or resetting a password) through playbooks so analysts can focus on complex investigations.

Sentinel is built on top of a Log Analytics workspace. All ingested data is stored as tables in the workspace, queryable with Kusto Query Language (KQL). You enable Sentinel on a Log Analytics workspace, connect data sources, and Sentinel's analytics, hunting, and automation features become available over the data stored there. The workspace serves as the single data plane for both Sentinel and Azure Monitor.

Data connectors stream logs and alerts from sources into Sentinel. Microsoft-native connectors (no-code, single toggle) cover Entra ID sign-in logs, Azure Activity, Defender for Cloud alerts, Microsoft 365, and Defender XDR. Connector hubs cover third-party sources including Cisco, Palo Alto, AWS CloudTrail, Okta, Salesforce, and many more via the Common Event Format (CEF) or Syslog. Over 200 connectors are available from the Content Hub.

Analytics rules are the detection engine of Sentinel. Each rule runs a KQL query on a schedule (every 5 minutes to every 24 hours) and creates an alert when the query returns results. Sentinel provides hundreds of built-in templates covering well-known attack patterns. You can import templates from the Content Hub and customise them, or write your own rules for organisation-specific threat detection logic.

When analytics rules fire, their alerts are grouped into incidents — a container for a potential security breach investigation. The investigation graph visually maps the relationships between the incident's entities: accounts, IPs, hosts, URLs, and files. Analysts traverse the graph to understand the blast radius, pivot to related alerts, and determine whether the incident is a true positive requiring a response or a false positive to be closed.

Threat hunting in Sentinel is the proactive search for threats that have not yet triggered alerts. Security analysts write or use pre-built hunting queries (KQL) to look for subtle indicators of compromise — low-and-slow attacks, lateral movement, data staging — that evade automated detection rules. Interesting rows found during hunting can be promoted to bookmarks and associated with an incident for formal investigation.

Playbooks in Sentinel are Azure Logic Apps workflows that automate incident response actions. When an incident is created (or an alert fires), a playbook can automatically: send a Teams/email notification to the on-call analyst, block a malicious IP in Azure Firewall, revoke a compromised user's refresh tokens in Entra ID, create a ServiceNow ticket, or isolate a VM from the network. This SOAR capability reduces mean time to respond (MTTR) dramatically.

Sentinel maps every analytics rule to the MITRE ATT&CK framework, a globally recognised taxonomy of attacker tactics and techniques. The MITRE ATT&CK coverage view shows you a heatmap of which tactics and techniques your analytics rules cover, and which have gaps. This helps security teams prioritise writing new detection rules to improve coverage against techniques relevant to their threat landscape.

Sentinel includes dozens of built-in workbooks (parameterised dashboards built on Log Analytics) to visualise security data. Templates cover Azure Activity, Entra ID sign-in patterns, Microsoft 365 email threats, firewall traffic, and many more. Security operations centre (SOC) managers use workbooks for shift handover briefings and trend analysis, while analysts use them to quickly spot anomalies without writing raw KQL.

Sentinel is billed based on the volume of data ingested into the underlying Log Analytics workspace. Two pricing models exist. Pay-As-You-Go charges per GB ingested and is suitable for smaller or unpredictable volumes. Capacity Reservations commit to a minimum daily ingestion volume (100 GB, 200 GB, etc.) at a significant discount per GB. Microsoft Defender for Cloud security alerts are ingested free of charge; first 90 days free on new Sentinel-enabled workspaces.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Sentinel is a cloud-native SIEM and SOAR built on Log Analytics workspaces using KQL, analytics rules detect threats by running scheduled KQL queries and generating incidents, and playbooks automate response actions using Logic Apps to reduce MTTR. Next up we explore Azure DDoS Protection and Azure Firewall.