Best practices for Microsoft Sentinel

This collection of best practices provides guidance to use when deploying, managing, and using Microsoft Sentinel, including links to other articles for more information.


Before deploying Microsoft Sentinel, review and complete pre-deployment activities and prerequisites.

Best practice references

The Microsoft Sentinel documentation has best practice guidance scattered throughout our articles. In addition to the content provided in this article, see the following for more information:

For more information, also see our video: Architecting SecOps for Success: Best Practices for Deploying Microsoft Sentinel

Regular SOC activities to perform

Schedule the following Microsoft Sentinel activities regularly to ensure continued security best practices:

Daily tasks

Weekly tasks

  • Workbook updates. Verify whether any workbooks have updates that need to be installed. For more information, see Commonly used Microsoft Sentinel workbooks.

  • Microsoft Sentinel GitHub repository review. Review the Microsoft Sentinel GitHub repository to explore whether there are any new or updated resources of value for your environment, such as analytics rules, workbooks, hunting queries, or playbooks.

  • Microsoft Sentinel auditing. Review Microsoft Sentinel activity to see who has updated or deleted resources, such as analytics rules, bookmarks, and so on. For more information, see Audit Microsoft Sentinel queries and activities.

Monthly tasks

Integrate with Microsoft security services

Microsoft Sentinel is empowered by the components that send data to your workspace, and is made stronger through integrations with other Microsoft services. Any logs ingested into products such as Microsoft Defender for Cloud Apps, Microsoft Defender for Endpoint, and Microsoft Defender for Identity allow these services to create detections, and in turn provide those detections to Microsoft Sentinel. Logs can also be ingested directly into Microsoft Sentinel to provide a fuller picture for events and incidents.

For example, the following image shows how Microsoft Sentinel ingests data from other Microsoft services and multi-cloud and partner platforms to provide coverage for your environment:

Microsoft Sentinel integrating with other Microsoft and partner services

More than ingesting alerts and logs from other sources, Microsoft Sentinel also:

  • Uses the information it ingests with machine learning that allows for better event correlation, alert aggregation, anomaly detection, and more.
  • Builds and presents interactive visuals via workbooks, showing trends, related information, and key data used for both admin tasks and investigations.
  • Runs playbooks to act on alerts, gathering information, performing actions on items, and sending notifications to various platforms.
  • Integrates with partner platforms, such as ServiceNow and Jira, to provide essential services for SOC teams.
  • Ingests and fetches enrichment feeds from threat intelligence platforms to bring valuable data for investigating.

Manage and respond to incidents

The following image shows recommended steps in an incident management and response process.

Incident management process: Triage. Preparation. Remediation. Eradication. Post incident activities.

The following sections provide high-level descriptions for how to use Microsoft Sentinel features for incident management and response throughout the process. For more information, see Tutorial: Investigate incidents with Microsoft Sentinel.

Use the Incidents page and the Investigation graph

Start any triage process for new incidents on the Microsoft Sentinel Incidents page in Microsoft Sentinel and the Investigation graph.

Discover key entities, such as accounts, URLs, IP address, host names, activities, timeline, and more. Use this data to understand whether you have a false positive on hand, in which case you can close the incident directly.

Any generated incidents are displayed on the Incidents page, which serves as the central location for triage and early investigation. The Incidents page lists the title, severity, and related alerts, logs, and any entities of interest. Incidents also provide a quick jump into collected logs and any tools related to the incident.

The Incidents page works together with the Investigation graph, an interactive tool that allows users to explore and dive deep into an alert to show the full scope of an attack. Users can then construct a timeline of events and discover the extent of a threat chain.

If you discover that the incident is a true positive, take action directly from the Incidents page to investigate logs, entities, and explore the threat chain. After you've identified the threat and created a plan of action, use other tools in Microsoft Sentinel and other Microsoft security services to continue investigating.

Handle incidents with workbooks

In addition to visualizing and displaying information and trends, Microsoft Sentinel workbooks are valuable investigative tools.

For example, use the Investigation Insights workbook to investigate specific incidents together with any associated entities and alerts. This workbook enables you to dive deeper into entities by showing related logs, actions, and alerts.

Handle incidents with threat hunting

While investigating and searching for root causes, run built-in threat hunting queries and check results for any indicators of compromise.

During an investigation, or after having taken steps to remediate and eradicate the threat, use livestream to monitor, in real time, whether there are any lingering malicious events, or if malicious events are still continuing.

Handle incidents with entity behavior

Entity behavior in Microsoft Sentinel allows users to review and investigate actions and alerts for specific entities, such as investigating into accounts and host names. For more information, see:

Handle incidents with watchlists and threat intelligence

To maximize threat intelligence-based detections, make sure to use threat intelligence data connectors to ingest indicators of compromise:

Use indicators of compromise in analytics rules, when threat hunting, investigating logs, or generating more incidents.

Use a watchlist that combines data from ingested data and external sources, such as enrichment data. For example, create lists of IP address ranges used by your organization or recently terminated employees. Use watchlists with playbooks to gather enrichment data, such as adding malicious IP addresses to watchlists to use during detection, threat hunting, and investigations.

During an incident, use watchlists to contain investigation data, and then delete them when your investigation is done to ensure that sensitive data does not remain in view.

Next steps

To get started with Microsoft Sentinel, see: