Microsoft Sentinel, SIEM, SOAR, and Incident Response

radio_button_uncheckedshort_text 1. Introduction: from log centralization to context-driven response

Security management began with logs produced separately by servers, operating systems, firewalls, and applications. As organizations connected more networks and services, it became unfeasible to analyze each log manually. Event management platforms emerged, followed by SIEM solutions, capable of centralizing data, correlating signals, and supporting investigations. With the growth in alert volume, SOAR added automation and orchestration so that security teams could respond more quickly and consistently.

This evolution directly contributes to the continuity of digital services, the protection of personal data, and the reduction of the impact of attacks. Hospitals, schools, banks, companies, and public agencies rely on systems that produce millions of events. Transforming these records into investigable context allows for discovering threats earlier, prioritizing what really matters, and reducing the time between detection and containment.

Microsoft Sentinel materializes this approach in a cloud-native solution. It collects data from Microsoft and non-Microsoft sources, performs analysis, generates alerts, organizes incidents, enables proactive hunting, and automates responses. The real value appears when these components form a cycle: an investigation improves detection; detection triggers automation; automation frees the analyst to investigate more complex cases.

Guiding question

If a single failed login can be normal, at what point do hundreds of failures, an anonymous IP, and a privileged change come to represent an incident? The SIEM exists to gather scattered signals and provide context for this decision.

radio_button_uncheckedshort_text 2. SIEM, SOAR, XDR and the role of the SOC

2.1 Security Operations Center (SOC)

SOC is the organizational function responsible for monitoring, detecting, investigating, and responding to threats. It can be an internal team, an outsourced service, or a hybrid model. People, processes, and technology need to work together: tools without procedures generate inconsistency; processes without telemetry lead to late decisions; automation without supervision can amplify errors.

2.2 Essential definitions

Evidence trap

SIEM is not just log storage. SOAR is not just a script. XDR does not automatically replace the broad visibility of SIEM. Each concept solves a different part of security operations.

radio_button_uncheckedshort_text 3. What is Microsoft Sentinel

Microsoft Sentinel is Microsoft's native cloud SIEM and a security operations platform. Its purpose is to provide scalable collection, analysis, detection, investigation, hunting, visualization, and automated response in multi-cloud and multi-platform environments. Being a cloud service, it reduces the need to maintain the traditional infrastructure of an on-premises SIEM, but it still requires data architecture, governance, permissions, rules, and well-defined operational processes.

3.1 Functional components

3.2 Cloud-native does not mean automatic by default

Sentinel provides ready-made content, but the organization needs to choose sources, retention, coverage, permissions, detections, responsible parties, and response criteria. Collecting everything without a goal can increase cost and noise. Collecting too little can create blind spots. A mature deployment starts with use cases: which critical assets exist, which threats are relevant, which data support detection, and what action will be taken when the signal appears.

Platform update

The current experience converges on the Microsoft Defender portal, bringing together Sentinel, Defender XDR, and AI features. Microsoft announced that, after March 31, 2027, Sentinel will no longer be supported on the Azure portal. For the SC-900, mainly memorize the capabilities, not the exact position of the menus.

radio_button_uncheckedshort_text 4. Data connectors and ingestion

A SIEM depends on telemetry. Data connectors are integrations that guide or automate the entry of logs into Sentinel. They can connect Microsoft services, Azure resources, on-premises systems, other clouds, network appliances, security products, and SaaS applications. Some sources send data directly; others use agents, Syslog, Common Event Format (CEF), APIs, collection rules, or specific integrations.

4.1 What a connector can provide

• Deployment instructions, permissions, and prerequisites.
• Tables or destinations where the records will be stored.
• Parsers and normalization to make events from different sources more consistent.
• Analytics rules, hunting queries, workbooks, and other related content.
• Integrity, volume, and last data reception indicators.

4.2 Content hub and solutions

The Content Hub works as a solutions catalog. A solution can group several artifacts for a product or scenario, preventing the analyst from having to create everything from scratch. Installing a solution does not guarantee that the data is arriving or that all rules should be enabled without adjustment. The content needs to be configured, tested, and adapted to the environment.

Operating principle

Without relevant and intact data, the best analytics rule detects nothing. Before adjusting alerts, confirm coverage, latency, schema, volume, retention, and source quality.

radio_button_uncheckedshort_text 5. Data organization, Log Analytics and KQL

5.1 Tables, columns, and records

Security data is organized into tables. Each row represents a record, and the columns store attributes such as time, user, IP address, device, action, and result. Common examples include login records, Azure activity, security events, and alerts. The correct table depends on the connector and the type of data ingested.

5.2 Kusto Query Language (KQL)

KQL is the query language used to search and transform data in Sentinel and in other services based on Azure Data Explorer and Azure Monitor. It is declarative: the analyst describes which data they want to filter, summarize, combine, and project. In SC-900, the most important thing is to recognize that KQL supports queries, hunting, and many analytics rules; it is not necessary to master advanced syntax.

SigninLogs | where TimeGenerated > ago(1h) | where ResultType != 0 | summarize Failures=count() by UserPrincipalName, IPAddress | where Failures >= 10 | order by Failures desc The query above looks for unsuccessful entries in the last hour, groups the attempts by user and IP, keeps groups with at least ten failures, and orders the results. It does not prove an attack: it could represent an old password, a misconfigured application, or password spray. The investigation context decides.

radio_button_uncheckedshort_text 6. Analytics rules and threat detection

Analytics rules transform data into security signals. They define what to look for, how often to evaluate, which period to consult, how to map entities, and when to create alerts and incidents. A useful detection needs to balance sensitivity and accuracy: overly broad rules generate alert fatigue; overly restrictive rules let threats pass.

6.1 Types and approaches of detection

6.2 Elements of a rule

• Query or source that defines the detection logic.
• Execution frequency and observation window.
• Threshold that determines when the result becomes an alert.
• Severity, tactics, and MITRE ATT&CK techniques.
• Mapping of entities, such as account, host, IP, URL, file, and process.
• Grouping of alerts and creation of incidents.
• Suppression and adjustments to reduce duplication or noise.

Detection quality

A rule needs to be testable and actionable. Before enabling it widely, validate whether the data exists, whether legitimate behavior has been considered, and whether the SOC knows what to investigate and respond to.

radio_button_uncheckedshort_text 7. Events, alerts, incidents, entities, and evidence

7.1 Why correlate?

An intruder can generate signals at different times and in different products: phishing email, anomalous login, process creation, file access, and network communication. Correlating these signals reduces fragmentation and helps to reconstruct the attack chain. However, correlation does not mean certainty; the analyst still needs to validate the timeline, the legitimacy of the actions, and the affected scope.

Evidence trap

Alerts are signals; incidents are cases organized for investigation. An incident can contain one or several alerts and can end up classified as a false positive, expected activity, or true incident.

radio_button_uncheckedshort_text 8. Investigation and incident response

Investigation turns a set of signals into operational understanding. The analyst seeks to answer: what happened, when it started, which entities were involved, what the initial vector was, what actions were taken, which assets were affected, and what containment is needed. Sentinel provides incidents, timeline, relationships between entities, queries, comments, tasks, and action history to organize this work.

8.1 Simplified response cycle

1. Triage: check severity, context, duplication, asset criticality, and signal credibility. 2. Investigation: reconstruct the timeline, consult additional data, and assess entities and evidence. 3. Containment: limit the damage, for example by isolating a device, blocking an indicator, or disabling a credential. 4. Eradication: remove persistence, malware, malicious rules, vulnerabilities, or configurations used in the attack. 5. Recovery: restore operations with enhanced monitoring and validation of a secure state. 6. Learning: record cause, impact, decisions, and improvements in rules, playbooks, and preventive controls.

8.2 Important metrics

radio_button_uncheckedshort_text 9. Threat hunting and proactive investigation

Threat hunting is the proactive search for threats that have not yet produced a reliable alert. Instead of waiting for a rule to trigger, the analyst starts from a hypothesis based on intelligence, changes in the environment, unusual behavior, or adversary technique. The result can confirm legitimate activity, reveal an incident, or lead to a new automated detection.

9.1 Hunting query, hunt and bookmark

Hunting should not be confused with random research. A clear hypothesis defines the expected behavior, the necessary data, the validation criteria, and the subsequent action. Without this discipline, queries can produce many results without generating knowledge or operational improvement.

radio_button_uncheckedshort_text 10. Workbooks, visualizations, and monitoring

Workbooks are interactive experiences for data visualization and analysis. They can combine queries, charts, tables, metrics, filters, and explanatory texts to track operational posture, incident trends, identity activity, data source coverage, or detection performance. Solutions installed from the Content hub often include ready-made workbooks for specific sources.

10.1 Workbooks are not detection rules

10.2 Useful Visualization

• Define the audience and decision that the panel should support.
• Shows trends and context, not just isolated numbers.
• Allows filtering by period, severity, origin, entity, or environment.
• Avoid excessive charts and metrics without corresponding action.
• Documents queries, limits, and possible data gaps.

Example

A workbook can show authentication failures by country and user. It helps to observe trends, but it does not block access or necessarily create an incident. An analytics rule or identity policy performs that other function.

radio_button_uncheckedshort_text 11. SOAR: automation rules and playbooks

Sentinel implements SOAR capabilities mainly through automation rules and playbooks. Automation rules manage the flow of incident and alert handling in a central point. They can assign responsibility, change severity or status, add tags, create tasks, and execute playbooks in a defined order.

Playbooks are workflows built in Azure Logic Apps. They use triggers, conditions, connectors, and actions to interact with Sentinel and external systems. A playbook can be executed automatically by an automation rule or manually by an analyst on an incident, alert, or entity.

radio_button_uncheckedshort_text 12. Designing safe and reliable automations

Automation can reduce response time, but it also performs actions at scale. Therefore, it should be treated as production software: have an owner, version control, testing, monitoring, error handling, minimal permissions, and a rollback procedure. The decision to automate depends on the confidence in detection and the impact of the action.

12.1 Example: possible account compromise

7. An analytic rule identifies multiple failures followed by a successful login from anonymous infrastructure. 8. Sentinel creates an alert, maps the account and IP address, and groups the signal into an incident. 9. An automation rule adds the “Identity” tag, assigns the incident to the appropriate queue, and creates triage tasks. 10. A playbook queries IP reputation, identity risk data, and recent account activity. 11. If high-confidence criteria are met, the playbook revokes sessions and notifies the team; account disabling may require human approval. 12. The analyst validates impact, completes containment, and records the outcome to adjust the rule and playbook.

12.2 Levels of automation

radio_button_uncheckedshort_text 13. Integration with Microsoft Defender XDR

Microsoft Defender XDR gathers native signals from endpoints, identities, email, applications, and other Defender products. Integration with Sentinel allows combining this XDR depth with the breadth of SIEM, which receives Microsoft and non-Microsoft data. Incidents and events can be synchronized and investigated in the Microsoft Defender portal, reducing tool switching.

13.1 Benefits of unification

• More consolidated incident and investigation queue.
• Correlation between Defender ecosystem signals and external sources.
• Advanced hunting over integrated data.
• Better context of entities and attack chain.
• Automation and coordinated response.
• Access to built-in experiences of Security Copilot, when licensed and enabled.

Essential difference

Defender XDR offers deep detections and responses in protected domains. Sentinel expands collection, correlation, hunting, and SOAR to a broader ecosystem. The integration combines depth and breadth.

radio_button_uncheckedshort_text 14. Microsoft Security Copilot in the context of Sentinel

Security Copilot uses generative AI and security data to assist analysts. In the context of Sentinel and the Defender portal, it can summarize incidents, explain scripts and commands, suggest or generate queries, support reports, and guide investigation and response steps. The integration does not turn AI responses into automatic truth: results need to be checked against the organization's evidence, permissions, and procedures.

14.1 Examples of use

14.2 Care

• Answers may contain incorrect inferences or incomplete information.
• Access respects permissions, but the user must avoid exposing data beyond what is necessary.
• Generated queries need to be executed and interpreted by someone who understands the environment.
• Containment actions continue to require responsibility and human supervision.
• Clear prompts should indicate objective, context, source, and expected format.

Principle of responsibility

Security Copilot accelerates analysis; it does not transfer the responsibility of the decision. In high-impact incidents, the evidence and the approved process prevail over the fluency of the generated response.

radio_button_uncheckedshort_text 15. Integrated practical scenario: attack on a privileged account

Consider a company that connects to Sentinel records from Microsoft Entra ID, Defender XDR, firewall, Linux servers, and a financial application. An administrative account experiences multiple authentication failures, followed by a successful login from an unusual location. Minutes later, there is a privilege change and atypical access to the application.

15.1 What could go wrong

• The auditing connector was not active, hiding the privilege change.
• The rule generated so many false positives that the alert was ignored.
• The playbook had excessive permissions or failed silently.
• Logs had insufficient retention to reconstruct the timeline.
• The incident was closed without recording classification and lessons learned.

Systemic vision

Sentinel alone does not compensate for an identity without MFA, a vulnerable device, or excessive permissions. It integrates signals and response, but risk reduction depends on preventive controls, detection, people, and processes.

radio_button_uncheckedshort_text 16. Conclusion and review for the SC-900

Microsoft Sentinel represents the evolution of SIEM into a cloud-native security operations platform. It collects and organizes data from various sources, uses analytics rules to produce alerts, correlates signals into incidents, offers investigation and hunting with KQL, provides visualizations through workbooks, and automates responses with automation rules and Azure Logic Apps playbooks.

In my assessment, the main value of Sentinel is not in a single feature, but in the ability to transform scattered telemetry into a repeatable operational process. A mature organization does not measure success by the number of logs or alerts, but by the coverage of relevant risks, the quality of detections, the speed of investigation, the consistency of response, and continuous learning.

Integration with Defender XDR expands the context between identities, endpoints, email, and applications; Security Copilot can accelerate synthesis and querying. Even so, technology does not eliminate the need for analysts, governance, reliable data, and human validation. The next natural step is to understand how Defender XDR correlates signals and incidents within its own protection ecosystem.

16.1 Quick review

radio_button_uncheckedshort_text 17. Review questions

1. Which Microsoft Sentinel feature is primarily used to connect log and alert sources?

A) Workbook B) Data connector C) Playbook D) Incident

Answer with explanation

Correct answer: B. Data connectors integrate sources into Sentinel and guide ingestion. Workbooks visualize data; playbooks automate responses; incidents organize investigation.

2. Which alternative correctly describes the relationship between alert and incident?

A) Every event is an incident. B) Incidents are used only to store dashboards. C) An alert is a signal of a possible threat, and an incident organizes one or more alerts and context for investigation. D) Alerts are created only by playbooks.

Answer with explanation

Correct answer: C. Alerts represent signals. Incidents group alerts, entities, evidence, and actions for triage, investigation, and response.

3. Which statement correctly differentiates an automation rule from a playbook?

A) Both are just KQL queries. B) The automation rule coordinates when and in what order actions occur; the playbook executes a workflow based on Azure Logic Apps. C) Playbooks only create charts. D) Automation rules are only used for ingestion.

Answer with explanation

Correct answer: B. The rule manages the treatment flow and can call a playbook, while the playbook implements integrations and response logic.

4. What is the main objective of threat hunting?

A) Replace all preventive controls. B) Proactively search for threats not yet detected, based on hypotheses and queries. C) Create digital signatures. D) Configure virtual networks.

Answer with explanation

Correct answer: B. Hunting is proactive investigation of existing data and can result in an incident, a new rule, or an improved response.

radio_button_uncheckedshort_text 18. Glossary and references

Essential glossary

CEF: Common Event Format. DCR: Data Collection Rule. IOC: indicator of compromise. KQL: Kusto Query Language. MITRE ATT&CK: knowledge base of adversary tactics and techniques. NRT: near-real-time. SOC: Security Operations Center. SIEM: Security Information and Event Management. SOAR: Security Orchestration, Automation and Response. XDR: Extended Detection and Response.

radio_button_uncheckedshort_text Official references consulted

• Microsoft Learn. Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals. Updated on June 26, 2026.
• Microsoft Learn. What is Microsoft Sentinel? / What is Microsoft Sentinel SIEM? Updated in May 2026.
• Microsoft Learn. Connect data sources to Microsoft Sentinel by using data connectors. Updated in 2026.
• Microsoft Learn. Threat hunting in Microsoft Sentinel. Updated on June 15, 2026.
• Microsoft Learn. Automation in Microsoft Sentinel; Azure Logic Apps for Microsoft Sentinel playbooks; Create and manage Microsoft Sentinel playbooks. Updated in 2026.
• Microsoft Learn. Microsoft Defender XDR integration with Microsoft Sentinel. Updated in 2026.
• Microsoft Learn. Security Copilot integration with Microsoft Sentinel. Updated in 2026. Editorial note: the content was written for conceptual study of the SC-900. Menu names, availability, licensing, and preview features may change; consult the official documentation before making deployment decisions.