Microsoft Sentinel is a scalable, cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for attack detection, threat visibility, proactive hunting, and threat response.
200+ built-in connectors for Microsoft services, AWS, GCP, Syslog, CEF, and third-party solutions. Ingest data at cloud scale with Log Analytics.
Scheduled, NRT (near-real-time), fusion, and anomaly rules to detect threats. Map detections to MITRE ATT&CK framework tactics and techniques.
Proactive threat hunting with built-in queries, custom KQL queries, Jupyter notebooks, and bookmarks. Stream results with livestream for real-time monitoring.
Interactive dashboards and reports built with Azure Monitor Workbooks. Visualize security data, trends, and KPIs for SOC operations and executive reporting.
Automated response workflows using Logic Apps. Enrich incidents, isolate devices, block users, send notifications, and create tickets automatically.
Integrate threat intelligence feeds (STIX/TAXII), Microsoft TI, and custom indicators. Correlate IOCs against telemetry for proactive detection.
KQL is the primary query language for Sentinel. Master these patterns to effectively hunt threats and build analytics rules.
// Hunt for brute-force sign-in attempts
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == "50126" // Invalid username or password
| summarize
FailedAttempts = count(),
DistinctUsers = dcount(UserPrincipalName),
TargetUsers = make_set(UserPrincipalName, 10)
by IPAddress, Location = tostring(LocationDetails.city)
| where FailedAttempts > 20
| order by FailedAttempts desc// Detect impossible travel (scheduled analytics rule)
let timeWindow = 1h;
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType == 0
| project TimeGenerated, UserPrincipalName,
City = tostring(LocationDetails.city),
Country = tostring(LocationDetails.countryOrRegion),
Lat = toreal(LocationDetails.geoCoordinates.latitude),
Lon = toreal(LocationDetails.geoCoordinates.longitude)
| order by UserPrincipalName, TimeGenerated
| serialize
| extend PrevCity = prev(City), PrevTime = prev(TimeGenerated),
PrevUser = prev(UserPrincipalName),
PrevLat = prev(Lat), PrevLon = prev(Lon)
| where UserPrincipalName == PrevUser
| extend TimeDiffMinutes = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiffMinutes < 60 and City != PrevCity
| project TimeGenerated, UserPrincipalName, City, PrevCity, TimeDiffMinutes// Analyze security events by category over time
SecurityEvent
| where TimeGenerated > ago(7d)
| summarize EventCount = count() by bin(TimeGenerated, 1h), Activity
| render timechart
// Top 10 IPs with most failed connections
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceAction == "Deny"
| summarize DenyCount = count() by SourceIP
| top 10 by DenyCount
| render barchartThe Content Hub provides packaged solutions with data connectors, analytics rules, workbooks, hunting queries, and playbooks. ready to deploy for specific scenarios.
Complete solutions for Microsoft 365, Azure AD, AWS, GCP, and 200+ vendor integrations.
Pre-built detection rules mapped to MITRE ATT&CK with customizable thresholds.
Community and Microsoft hunting queries for proactive threat discovery.
Pre-built visualizations for security monitoring, compliance, and operational insights.
Automation workflows for incident enrichment, response actions, and notification.
Connect first-party and third-party data sources with guided setup experiences.
Enterprise-grade labs that walk you through real-world Sentinel deployments. from initial setup to advanced threat hunting.
Provision a Log Analytics workspace, deploy Microsoft Sentinel, configure the Azure Active Directory data connector, verify sign-in log ingestion, and create a basic analytics rule that triggers on repeated failed sign-ins across a multi-tenant environment.
Write KQL queries to detect password-spray and brute-force patterns, create a scheduled analytics rule with proper entity mapping, configure alert grouping and suppression, and validate detections with simulated sign-in events in a production-like workspace.
Create a Logic App playbook that auto-enriches incidents with threat intelligence lookups, posts formatted alerts to a Teams SOC channel, isolates compromised user accounts via Microsoft Graph, and updates the incident with remediation evidence.
Build hunting queries mapped to MITRE ATT&CK techniques, use bookmarks to track and promote findings to incidents, configure livestream queries for real-time monitoring, and create a custom workbook that visualizes your hunting coverage across the kill chain.