What is Microsoft Sentinel? Everything you need to know to get started with Microsoft’s cloud SIEM

It’s essential that modern security operations centres (SOCs) have visibility across their entire cloud and on-premises infrastructure.

But this can be a challenge.

Analysts are facing more cyber threats than ever, and attackers are increasingly using AI and automation to move at machine speed. Yet defenders still have to wade through vast amounts of data and alerts from diverse, often siloed sources across wide and complex digital estates..

It’s a process that can be labour intensive and prone to error or missed incidents. Not only impacting analyst’s ability to effectively investigate, but seriously slowing down detection, response, and remediation.

When rapid action is called for.

These are the issues and common challenges directly addressed by Microsoft Sentinel.

In this article, we explore how Sentinel manages the overwhelming flow of alerts, sifting through the noise to highlight genuine threats and reducing the risk of oversight or errors.

We also examine how Sentinel sits at the heart of Microsoft’s vision for a unified extended detection and response (XDR) solution, with Microsoft Security Copilot and AI agents built in. And we explain what Microsoft’s newest developments, Integrated Security Operations Center (ISOC) and Project Perception, mean for your SOC.

Microsoft Sentinel – What is it and what does it do?

Microsoft Sentinel is Microsoft’s cloud-native security information and event management (SIEM) AND security orchestration automated response (SOAR) solution all in one.

It brings together the latest in security innovation and advanced AI to provide near real-time intelligent security analytics for a bird’s-eye view over your entire enterprise’s IT estate.

With Sentinel you can consume security related data from almost any source – not just sources inside your Microsoft tenant. This removes the need to manage multiple pieces of complex and costly infrastructure components – whilst providing a cloud platform solution that can easily scale to your needs.

Sentinel connects to Microsoft and non-Microsoft sources through hundreds of connectors and solutions in the Content hub, including AWS, Google Cloud, Cisco, Palo Alto Networks and many others.

It also draws on Microsoft Threat Intelligence, which processes more than 165 trillion security alerts every day. Alongside user and entity behaviour analytics (UEBA), this helps Sentinel filter millions of signals into meaningful dashboard alerts – supporting hunting and investigation capabilities enabling you to expedite your response to potential attacks.

And with Microsoft Security Copilot and Security Copilot agents, analysts get AI support with summarising incidents, triaging alerts and guiding their response.

Sentinel also integrates with a wide range of systems – providing the option to automate your incident response activities, thereby allowing you to orchestrate your activities in an efficient and effective manner.

4 key security pillars

Put simply, Microsoft Sentinel enables you to:

How to enable Sentinel in your environment

Getting started with Sentinel is straightforward. You need:

• An active Azure subscription.
• A Log Analytics workspace.
• Appropriate permissions to deploy and manage Sentinel.

Sentinel is now available in the Microsoft Defender portal, although the Azure portal remains supported until 31 March 2027. New customers are generally onboarded to the Defender portal automatically, and moving across adds no separate cost. You don’t need Defender XDR or a Microsoft 365 E5 licence to use Sentinel.

A 31-day free trial covers up to 10 GB of Analytics-tier ingestion per day across a maximum of 20 workspaces. Usage above this allowance, along with some automation, machine-learning and data-lake capabilities, remains chargeable.

Sentinel provides connectors for Microsoft services and a broad range of third-party platforms. Where a ready-made connector isn’t available, data can be brought in using options such as Syslog, CEF or the Logs Ingestion API. This means Sentinel can work with your existing security estate rather than requiring wholesale replacement.

Once your data is connected, you can configure built-in analytics templates, create custom detection rules and use automated playbooks to support your response processes. The key is to tune these capabilities around your organisation’s risks so analysts receive meaningful alerts rather than unnecessary noise.

Microsoft Sentinel in action – A typical scenario…

In this example, an organisation’s Entra ID Connect instance has been compromised and their credentials have been exfiltrated. We will investigate this attack and highlight how Microsoft Sentinel could have been used to alert and mitigate this attack at different points of the cyber kill chain.

The cyber kill chain is a series of 8 steps that trace an attack from reconnaissance to data exploitation – enhancing our understanding of the timeline of a cyber-attack.

We will be focusing on the alerting and remediation response against reconnaissance, intrusion and exfiltration.

Why target Entra ID Connect?

For those unaware of Entra ID Connect, it’s a tool that allows organisations to connect their on-premises Active Directory with their Entra ID environment. The most common authentication configurations are via Password Hash Sync (PHS) or Pass Through Authentication (PTA).

Password Hash Sync operates by synchronising the hashed passwords that sits on Active Directory with Entra ID, allowing users to sign into cloud services using their on-premises credentials. Whereas Pass Through Authentication allows users to sign into cloud services using their on-premises credentials by forwarding authentication requests to an on-premises Active Directory server.

Both these configurations deal with the management of an organisation’s credentials, as such it is often a valuable target for attackers. Hence it is vital that the Entra ID Connect service, and the server it sits on is protected to prevent the compromise of credentials.

Reconnaissance

The first step of the cyber kill chain is reconnaissance. Recent research suggests that more than 88% of attack time is spent gaining initial access.

The most common form of reconnaissance is the use of port scanning to fingerprint servers and identify what OS is in use and potentially what services are running. With this information, attackers can exploit known vulnerabilities or use a password spray attack to attempt to gain a foothold in the system.

Using Microsoft Sentinel, we can create a custom alert rule that will react when it detects potential port scanning and trigger a playbook to remediate the threat.

To respond to this alert, we can create an automated playbook which is built using the Logic Apps framework available in Azure. Logic Apps uses a simple drag and drop interface to build a series of tasks to execute.

The advantage of Logic Apps is they can be used to build complex workflows that would normally take up valuable time of an organisation’s IT personnel – thus reducing the amount of time spent on trivial, repetitive tasks.

Intrusion

An ever-growing form of intrusion that many organisations face, is the password spray attack. This is a type of attack where an attacker will attempt to gain access into a system using default or commonly used credentials.

Attackers are also increasingly using lists of the most common passwords to gain access to systems. Research has found that 94% of leaked passwords are reused or duplicated. So, it’s no surprise that password spray attacks are so commonplace.

Attackers are unlikely to attempt to sign into an account manually from their own IP address, instead they’ll attempt to automate the task using botnets. Hence when an alert is raised for an unusual sign-in, we can look up the IP address of the sign-in alert and check whether it came from a known botnet, block the user from signing in and raise a ticket in Service Now to notify IT personnel of a potential account breach.

While most workflows can be created using the basic building blocks providing in Logic Apps, a more complex workflow is sometimes required. In this case we can’t easily create a Logic App to compare the IP address of the alert against a list of known botnets. However, Logic Apps allows us to integrate with Functions Apps, which are small blocks of custom code that can be run. As a result, we can create Logic App that can perform more complex tasks.

Exfiltration

Once an attacker has gained initial access in a network, they will be looking for ways to extract data from a system. In our fictitious example, the attacker has gained access to a local administrator account and is now looking to export all the user credentials stored in the Active Directory.

As the attacker has breached the server which hosts the Entra ID Connect service, they can compromise the built-in service account which Entra ID Connect uses to perform its synchronisation, an attack method commonly referred to as DCSync. It impersonates a Domain Controller and can request password data from the target Domain Controller.

Now, Microsoft Defender for Identity has out-of-the-box detection for DCSync attacks. And thanks to Defender XDR and Sentinel providing a singular view across the estate, SOC teams have the capability to detect and respond at rapid speed.

Furthermore, as Sentinel collates alerts from all sources (Microsoft and non-Microsoft alike) across the estate, teams are able to add contextual information that can help the investigation process.

Sentinel’s evolving role in Microsoft security

Sentinel’s core purpose hasn’t changed, but the way it fits into Microsoft’s security ecosystem has.

Rather than acting as a standalone SIEM, Sentinel now helps bring together:

• Security data from across identities, endpoints, cloud environments and third-party sources
• Threat detection and response capabilities from Microsoft Defender XDR
• AI-powered investigation and analysis through Microsoft Security Copilot
• Shared context across incidents, helping analysts understand and respond to threats quickly

Today, Sentinel sits within Microsoft’s broader security platform, working alongside Microsoft Defender XDR and Microsoft Security Copilot to create a more connected security operations experience, with shared incidents and context helping analysts investigate and respond with less switching between tools.

Microsoft’s Integrated Security Operations Center (ISOC) and Project Perception, its emerging multi-agent security system, indicate where Microsoft is taking this next. Together, they point towards security data, automation and specialised AI agents working more closely across the Microsoft security platform. Microsoft describes preview-stage ISOC as bringing SIEM, XDR, threat intelligence, automation and AI together in Defender, while Project Perception, also in preview, uses specialised agents across security workflows.

For Sentinel, this puts greater emphasis on one of its existing strengths: bringing security signals and context together across Microsoft and non-Microsoft environments. Connected data gives analysts, automation and emerging AI capabilities the context they need to investigate and respond effectively.

Why Microsoft Sentinel remains central to modern security operations

Modern SOCs need visibility across the entire estate. Microsoft Sentinel provides that foundation by bringing together Microsoft and non-Microsoft security data for monitoring, investigation and response.

Its broad integrations, adaptable analytics and automation give organisations the flexibility to shape threat detection around their risks while balancing data retention with cost.

As Microsoft’s security platform evolves, Sentinel is becoming part of a wider, more unified approach to security operations. The developments discussed above reinforce the importance of having security data, context and workflows connected effectively.

As Microsoft moves towards more unified and AI-assisted security operations, the technology will continue to change. But the practical requirement will not: analysts need reliable, connected data and context to detect, investigate and respond effectively.

That is the foundation Sentinel provides today, and one that will remain important as Microsoft’s approach to security operations continues to evolve.