Microsoft Sentinel, SIEM, SOAR, and Incident Response

radio_button_uncheckedshort_text1. Introduction: from log centralization to context-driven response

Security management began with logs produced separately by servers, operating systems, firewalls, and applications. As organizations connected more networks and services, it became unfeasible to analyze each log manually. Event management platforms emerged, followed by SIEM solutions, capable of centralizing data, correlating signals, and supporting investigations. With the growth in alert volume, SOAR added automation and orchestration so that security teams could respond more quickly and consistently.

This evolution directly contributes to the continuity of digital services, the protection of personal data, and the reduction of the impact of attacks. Hospitals, schools, banks, companies, and public agencies rely on systems that produce millions of events. Transforming these records into investigable context allows for discovering threats earlier, prioritizing what really matters, and reducing the time between detection and containment.

Microsoft Sentinel materializes this approach in a cloud-native solution. It collects data from Microsoft and non-Microsoft sources, performs analysis, generates alerts, organizes incidents, enables proactive hunting, and automates responses. AI and machine learning add anomaly detection, alert correlation and prioritization, false-positive reduction, multistage attack recognition, and natural-language assistance. The real value appears when these capabilities form a cycle: an investigation improves detection; detection triggers automation; automation frees the analyst to investigate more complex cases.

Guiding question

If a single failed login can be normal, at what point do hundreds of failures, an anonymous IP, and a privileged change come to represent an incident? The SIEM exists to gather scattered signals and provide context for this decision.

radio_button_uncheckedshort_text2. SIEM, SOAR, XDR and the role of the SOC

2.1 Security Operations Center (SOC)

SOC is the organizational function responsible for monitoring, detecting, investigating, and responding to threats. It can be an internal team, an outsourced service, or a hybrid model. People, processes, and technology need to work together: tools without procedures generate inconsistency; processes without telemetry lead to late decisions; automation without supervision can amplify errors.

2.2 Essential definitions

Evidence trap

SIEM is not just log storage. SOAR is not just a script. XDR does not automatically replace the broad visibility of SIEM. Each concept solves a different part of security operations.

radio_button_uncheckedshort_text3. What is Microsoft Sentinel

Microsoft Sentinel is Microsoft's native cloud SIEM and a security operations platform. Its purpose is to provide scalable collection, analysis, detection, investigation, hunting, visualization, and automated response in multi-cloud and multi-platform environments. Being a cloud service, it reduces the need to maintain the traditional infrastructure of an on-premises SIEM, but it still requires data architecture, governance, permissions, rules, and well-defined operational processes.

3.1 Functional components

3.2 Cloud-native does not mean automatic by default

Sentinel provides ready-made content, but the organization needs to choose sources, retention, coverage, permissions, detections, responsible parties, and response criteria. Collecting everything without a goal can increase cost and noise. Collecting too little can create blind spots. A mature deployment starts with use cases: which critical assets exist, which threats are relevant, which data support detection, and what action will be taken when the signal appears.

Platform update

The current experience converges on the Microsoft Defender portal, bringing together Sentinel, Defender XDR, and AI features. Microsoft announced that, after March 31, 2027, Sentinel will no longer be supported on the Azure portal. For the SC-900, mainly memorize the capabilities, not the exact position of the menus.

3.3 Analytics tier and Microsoft Sentinel data lake

Sentinel stores security information in two complementary tiers. The analytics tier is optimized for near-real-time alerts, advanced hunting, incident management, and other operational queries. Data ingested there is mirrored into the Microsoft Sentinel data lake, which becomes the unified, open-format repository for large-scale and long-term analysis without maintaining a separate infrastructure. The data lake can retain information for up to 12 years and supports KQL, graph analysis, Microsoft Modeling Language, AI-assisted notebooks in Visual Studio Code, and other multimodal analytics over one copy of the data.

3.4 Graph and hosted MCP server

The Microsoft Sentinel graph represents users, devices, resources, data, activities, and attacker actions as connected nodes and relationships. It helps analysts and AI agents reason about impact, exposure, and possible attack paths instead of examining isolated rows. The hosted Model Context Protocol (MCP) server exposes scenario-focused tools for data exploration, incident triage, threat hunting, and Security Copilot agent creation. It uses Microsoft Entra for identity, integrates natively with Sentinel data and Microsoft Defender, and does not require the customer to deploy a separate MCP infrastructure.

radio_button_uncheckedshort_text4. Data connectors and ingestion

A SIEM depends on telemetry. Microsoft Sentinel offers more than 350 built-in connectors for Microsoft and non-Microsoft platforms, plus custom and no-code options. Connectors guide or automate the entry of logs from cloud services, on-premises systems, network appliances, security products, and SaaS applications. Some sources send data directly; others use agents, Syslog, Common Event Format (CEF), APIs, collection rules, or specific integrations. Normalization translates different formats into a more uniform view for correlation.

4.1 What a connector can provide

• Deployment instructions, permissions, and prerequisites.
• Tables or destinations where the records will be stored.
• Parsers and normalization to make events from different sources more consistent.
• Analytics rules, hunting queries, workbooks, and other related content.
• Integrity, volume, and last data reception indicators.

4.2 Content hub and solutions

The Content Hub works as a solutions catalog. A solution can group several artifacts for a product or scenario, preventing the analyst from having to create everything from scratch. Installing a solution does not guarantee that the data is arriving or that all rules should be enabled without adjustment. The content needs to be configured, tested, and adapted to the environment.

Operating principle

Without relevant and intact data, the best analytics rule detects nothing. Before adjusting alerts, confirm coverage, latency, schema, volume, retention, and source quality.

radio_button_uncheckedshort_text5. Data organization, Log Analytics and KQL

5.1 Tables, columns, and records

Security data is organized into tables. Each row represents a record, and the columns store attributes such as time, user, IP address, device, action, and result. Common examples include login records, Azure activity, security events, and alerts. The correct table depends on the connector and the type of data ingested.

5.2 Kusto Query Language (KQL)

KQL is the query language used to search and transform data in Sentinel and in other services based on Azure Data Explorer and Azure Monitor. It is declarative: the analyst describes which data they want to filter, summarize, combine, and project. In SC-900, the most important thing is to recognize that KQL supports queries, hunting, and many analytics rules; it is not necessary to master advanced syntax.

SigninLogs | where TimeGenerated > ago(1h) | where ResultType != 0 | summarize Failures=count() by UserPrincipalName, IPAddress | where Failures >= 10 | order by Failures desc The query above looks for unsuccessful entries in the last hour, groups the attempts by user and IP, keeps groups with at least ten failures, and orders the results. It does not prove an attack: it could represent an old password, a misconfigured application, or password spray. The investigation context decides.

radio_button_uncheckedshort_text6. Analytics rules and threat detection

Analytics rules transform data into security signals. They define what to look for, how often to evaluate, which period to consult, how to map entities, and when to create alerts and incidents. A useful detection needs to balance sensitivity and accuracy: overly broad rules generate alert fatigue; overly restrictive rules let threats pass.

6.1 Types and approaches of detection

6.2 Elements of a rule

• Query or source that defines the detection logic.
• Execution frequency and observation window.
• Threshold that determines when the result becomes an alert.
• Severity, tactics, and MITRE ATT&CK techniques.
• Mapping of entities, such as account, host, IP, URL, file, and process.
• Grouping of alerts and creation of incidents.
• Suppression and adjustments to reduce duplication or noise.

6.3 AI, Fusion, and threat-intelligence matching

Sentinel combines three broad detection approaches. Rule-based detection matches known patterns and defined conditions. AI and machine-learning detection establishes behavioral baselines and uses capabilities such as Fusion to link lower-severity signals from multiple sources into a coherent incident. Threat-intelligence matching compares observed IP addresses, domains, URLs, hashes, and other indicators with known malicious infrastructure. Detection coverage can be mapped to the MITRE ATT&CK framework, and Content hub solutions package connectors, rules, hunting queries, parsers, workbooks, and playbooks for common scenarios.

Detection quality

A rule needs to be testable and actionable. Before enabling it widely, validate whether the data exists, whether legitimate behavior has been considered, and whether the SOC knows what to investigate and respond to.

radio_button_uncheckedshort_text7. Events, alerts, incidents, entities, and evidence

7.1 Why correlate?

An intruder can generate signals at different times and in different products: phishing email, anomalous login, process creation, file access, and network communication. Correlating these signals reduces fragmentation and helps to reconstruct the attack chain. However, correlation does not mean certainty; the analyst still needs to validate the timeline, the legitimacy of the actions, and the affected scope.

Evidence trap

Alerts are signals; incidents are cases organized for investigation. An incident can contain one or several alerts and can end up classified as a false positive, expected activity, or true incident.

radio_button_uncheckedshort_text8. Investigation and incident response

Investigation turns a set of signals into operational understanding. The analyst seeks to answer: what happened, when it started, which entities were involved, what the initial vector was, what actions were taken, which assets were affected, and what containment is needed. Sentinel provides incidents, timeline, relationships between entities, queries, comments, tasks, and action history to organize this work.

8.1 Simplified response cycle

1. Triage: check severity, context, duplication, asset criticality, and signal credibility. 2. Investigation: reconstruct the timeline, consult additional data, and assess entities and evidence. 3. Containment: limit the damage, for example by isolating a device, blocking an indicator, or disabling a credential. 4. Eradication: remove persistence, malware, malicious rules, vulnerabilities, or configurations used in the attack. 5. Recovery: restore operations with enhanced monitoring and validation of a secure state. 6. Learning: record cause, impact, decisions, and improvements in rules, playbooks, and preventive controls.

8.2 Important metrics

radio_button_uncheckedshort_text9. Threat hunting and proactive investigation

Threat hunting is the proactive search for threats that have not yet produced a reliable alert. Instead of waiting for a rule to trigger, the analyst starts from a hypothesis based on intelligence, changes in the environment, unusual behavior, or adversary technique. The result can confirm legitimate activity, reveal an incident, or lead to a new automated detection.

9.1 Hunting query, hunt and bookmark

Hunting should not be confused with random research. A clear hypothesis defines the expected behavior, the necessary data, the validation criteria, and the subsequent action. Without this discipline, queries can produce many results without generating knowledge or operational improvement.

radio_button_uncheckedshort_text10. Workbooks, visualizations, and monitoring

Workbooks are interactive experiences for data visualization and analysis. They can combine queries, charts, tables, metrics, filters, and explanatory texts to track operational posture, incident trends, identity activity, data source coverage, or detection performance. Solutions installed from the Content hub often include ready-made workbooks for specific sources.

10.1 Workbooks are not detection rules

10.2 Useful Visualization

• Define the audience and decision that the panel should support.
• Shows trends and context, not just isolated numbers.
• Allows filtering by period, severity, origin, entity, or environment.
• Avoid excessive charts and metrics without corresponding action.
• Documents queries, limits, and possible data gaps.

Example

A workbook can show authentication failures by country and user. It helps to observe trends, but it does not block access or necessarily create an incident. An analytics rule or identity policy performs that other function.

radio_button_uncheckedshort_text11. SOAR: automation rules and playbooks

Sentinel implements SOAR capabilities mainly through automation rules and playbooks. Automation rules manage the flow of incident and alert handling in a central point. They can assign responsibility, change severity or status, add tags, create tasks, and execute playbooks in a defined order.

Playbooks are workflows built in Azure Logic Apps. They use triggers, conditions, connectors, and actions to interact with Sentinel and external systems. A playbook can be executed automatically by an automation rule or manually by an analyst on an incident, alert, or entity.

radio_button_uncheckedshort_text12. Designing safe and reliable automations

Automation can reduce response time, but it also performs actions at scale. Therefore, it should be treated as production software: have an owner, version control, testing, monitoring, error handling, minimal permissions, and a rollback procedure. The decision to automate depends on the confidence in detection and the impact of the action.

12.1 Example: possible account compromise

7. An analytic rule identifies multiple failures followed by a successful login from anonymous infrastructure. 8. Sentinel creates an alert, maps the account and IP address, and groups the signal into an incident. 9. An automation rule adds the “Identity” tag, assigns the incident to the appropriate queue, and creates triage tasks. 10. A playbook queries IP reputation, identity risk data, and recent account activity. 11. If high-confidence criteria are met, the playbook revokes sessions and notifies the team; account disabling may require human approval. 12. The analyst validates impact, completes containment, and records the outcome to adjust the rule and playbook.

12.2 Levels of automation

radio_button_uncheckedshort_text13. Integration with Microsoft Defender XDR

Microsoft Defender XDR gathers native signals from endpoints, identities, email, applications, and other Defender products. Integration with Sentinel allows combining this XDR depth with the breadth of SIEM, which receives Microsoft and non-Microsoft data. Incidents and events can be synchronized and investigated in the Microsoft Defender portal, reducing tool switching.

13.1 Benefits of unification

• More consolidated incident and investigation queue.
• Correlation between Defender ecosystem signals and external sources.
• Advanced hunting over integrated data.
• Better context of entities and attack chain.
• Automation and coordinated response.
• Access to built-in experiences of Security Copilot, when licensed and enabled.

Essential difference

Defender XDR offers deep detections and responses in protected domains. Sentinel expands collection, correlation, hunting, and SOAR to a broader ecosystem. The integration combines depth and breadth.

radio_button_uncheckedshort_text14. Microsoft Security Copilot in the context of Sentinel

Microsoft Security Copilot uses generative AI and security data to assist analysts. In the context of Sentinel and the Microsoft Defender portal, it can summarize incidents, explain scripts and commands, assess suspicious files, summarize identities and devices, generate reports and KQL queries, consolidate threat intelligence, and guide investigation and response. The integration surfaces context faster without replacing analyst judgment; results must still be checked against the organization's evidence, permissions, and procedures.

14.1 Embedded and standalone experiences

In the embedded experience, Sentinel incidents are unified with Microsoft Defender XDR incidents in the Defender portal, so analysts can use Copilot while investigating without changing tools. In the standalone Security Copilot portal, Sentinel is connected as a data source through the Microsoft Sentinel and Natural language to KQL for Microsoft Sentinel plugins. That conversational experience lets analysts ask about incidents, entities, reputation, and stored data. Licensing, capacity, permissions, and onboarding determine availability in both experiences.

14.2 Analyst-driven capabilities

14.3 Natural language, plugins, and promptbook

Natural language to KQL lowers the entry barrier to threat hunting: an analyst describes the desired search, receives a ready-to-run KQL query, and can execute or refine it in the standalone experience or advanced hunting. The generated query still needs validation of tables, filters, time range, permissions, meaning, and cost. The Microsoft Sentinel incident investigation promptbook assembles a structured sequence of prompts that retrieves the incident report, related alerts, reputation scores, and user and device details, giving the analyst a consistent starting point rather than a final verdict.

14.4 Autonomous AI agents

14.5 Human control and safeguards

• Answers may contain incorrect inferences or incomplete information.
• Access respects permissions, but the user must avoid exposing data beyond what is necessary.
• Generated queries need to be executed and interpreted by someone who understands the environment.
• Containment actions continue to require responsibility and human supervision.
• Clear prompts should indicate objective, context, source, and expected format.

Principle of responsibility

Security Copilot accelerates analysis; it does not transfer the responsibility of the decision. In high-impact incidents, the evidence and the approved process prevail over the fluency of the generated response.

radio_button_uncheckedshort_text15. Integrated practical scenario: attack on a privileged account

Consider a company that connects to Sentinel records from Microsoft Entra ID, Defender XDR, firewall, Linux servers, and a financial application. An administrative account experiences multiple authentication failures, followed by a successful login from an unusual location. Minutes later, there is a privilege change and atypical access to the application.

15.1 What could go wrong

• The auditing connector was not active, hiding the privilege change.
• The rule generated so many false positives that the alert was ignored.
• The playbook had excessive permissions or failed silently.
• Logs had insufficient retention to reconstruct the timeline.
• The incident was closed without recording classification and lessons learned.

Systemic vision

Sentinel alone does not compensate for an identity without MFA, a vulnerable device, or excessive permissions. It integrates signals and response, but risk reduction depends on preventive controls, detection, people, and processes.

radio_button_uncheckedshort_text16. Conclusion and review for the SC-900

Microsoft Sentinel represents the evolution of SIEM into a cloud-native, AI-ready security operations platform. It collects and organizes data from various sources, uses rules, AI, and threat intelligence to detect threats, correlates signals into incidents, offers investigation and hunting with KQL, stores long-term context in its data lake, represents relationships in the Sentinel graph, exposes hosted MCP tools, and automates responses with automation rules and Azure Logic Apps playbooks.

In my assessment, the main value of Sentinel is not in a single feature, but in the ability to transform scattered telemetry into a repeatable operational process. A mature organization does not measure success by the number of logs or alerts, but by the coverage of relevant risks, the quality of detections, the speed of investigation, the consistency of response, and continuous learning.

Integration with Defender XDR expands the context between identities, endpoints, email, and applications. Microsoft Security Copilot accelerates summaries, analysis, queries, reports, and guided responses, while autonomous agents help triage alerts and identify detection gaps. Even so, technology does not eliminate the need for analysts, governance, reliable data, and human validation.

16.1 Quick review

radio_button_uncheckedshort_text17. Review questions

1. Which Microsoft Sentinel feature is primarily used to connect log and alert sources?

A) Workbook B) Data connector C) Playbook D) Incident

Answer with explanation

Correct answer: B. Data connectors integrate sources into Sentinel and guide ingestion. Workbooks visualize data; playbooks automate responses; incidents organize investigation.

2. Which alternative correctly describes the relationship between alert and incident?

A) Every event is an incident. B) Incidents are used only to store dashboards. C) An alert is a signal of a possible threat, and an incident organizes one or more alerts and context for investigation. D) Alerts are created only by playbooks.

Answer with explanation

Correct answer: C. Alerts represent signals. Incidents group alerts, entities, evidence, and actions for triage, investigation, and response.

3. Which statement correctly differentiates an automation rule from a playbook?

A) Both are just KQL queries. B) The automation rule coordinates when and in what order actions occur; the playbook executes a workflow based on Azure Logic Apps. C) Playbooks only create charts. D) Automation rules are only used for ingestion.

Answer with explanation

Correct answer: B. The rule manages the treatment flow and can call a playbook, while the playbook implements integrations and response logic.

4. What is the main objective of threat hunting?

A) Replace all preventive controls. B) Proactively search for threats not yet detected, based on hypotheses and queries. C) Create digital signatures. D) Configure virtual networks.

Answer with explanation

Correct answer: B. Hunting is proactive investigation of existing data and can result in an incident, a new rule, or an improved response.

5. What are the four interconnected security-operation areas emphasized by Microsoft Sentinel?

A) Collect, detect, investigate, and respond. B) Collect, encrypt, purchase, and archive. C) Design, compile, deploy, and debug. D) Identify, invoice, migrate, and retire.

Answer with explanation

Correct answer: A. Sentinel collects and normalizes telemetry, detects suspicious behavior, organizes investigation context, and supports response and containment.

6. Which capability provides a structured starting point with the incident report, related alerts, reputation, users, and devices?

A) Jupyter notebook B) Microsoft Sentinel incident investigation promptbook C) Workbook gallery D) Automation rule

Answer with explanation

Correct answer: B. The promptbook chains a sequence of Security Copilot prompts to assemble incident and entity context for the analyst.

7. Which modern SIEM/SOAR capability most directly reduces alert fatigue?

A) Generating more unprioritized alerts B) AI and machine learning that correlate incidents, assign severity, and reduce false positives C) Disabling low-priority sources D) Keeping every signal isolated

Answer with explanation

Correct answer: B. Correlation, contextual prioritization, anomaly detection, and false-positive reduction help analysts focus on the most meaningful cases.

8. What best describes Microsoft Security Copilot?

A) A replacement for analyst decisions B) A generative AI security solution that helps investigate threats, summarize incidents, and build KQL with natural language C) A data connector only D) An automatic ticketing system

Answer with explanation

Correct answer: B. Security Copilot assists investigation and response through generative AI while analysts remain responsible for validation and final decisions.

radio_button_uncheckedshort_text18. Glossary and references

Essential glossary

radio_button_uncheckedshort_textOfficial references consulted

• Microsoft Learn. Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals. Updated on June 26, 2026.
• Microsoft Learn. What is Microsoft Sentinel? / What is Microsoft Sentinel SIEM? Updated in May 2026.
• Microsoft Learn. Microsoft Sentinel data lake, Microsoft Sentinel graph, and Microsoft Sentinel support for Model Context Protocol. Updated in 2026.
• Microsoft Learn. Connect data sources to Microsoft Sentinel by using data connectors. Updated in 2026.
• Microsoft Learn. Threat hunting in Microsoft Sentinel. Updated on June 15, 2026.
• Microsoft Learn. Automation in Microsoft Sentinel; Azure Logic Apps for Microsoft Sentinel playbooks; Create and manage Microsoft Sentinel playbooks. Updated in 2026.
• Microsoft Learn. Microsoft Defender XDR integration with Microsoft Sentinel. Updated in 2026.
• Microsoft Learn. Security Copilot integration with Microsoft Sentinel, incident summarization, autonomous agents, and natural language to KQL. Updated in 2026. Editorial note: the content was written for conceptual study of the SC-900. Menu names, availability, licensing, and preview features may change; consult the official documentation before making deployment decisions.