Microsoft Sentinel documentation

This article presents use cases to get started using Microsoft Sentinel. See and stop threats before they cause harm, with SIEM reinvented for a modern world. Microsoft Sentinel is your birds-eye view across the enterprise.

About Microsoft Sentinel

Overview

• What is Microsoft Sentinel?
• Useful resources

What's new

• What's new in Microsoft Sentinel?

Concept

• Best practices

Get started

Quickstart

• Onboard Microsoft Sentinel

Concept

• Prerequisites

How-To Guide

• Install Microsoft Sentinel solutions (Preview)
• Visualize collected data
• Investigate incidents
• Microsoft 365 Defender integration with Microsoft Sentinel

Reference

• Content hub catalog

Training

• Create KQL queries for Microsoft Sentinel

Collect data

Concept

• Data collection best practices
• Normalizing and parsing data

How-To Guide

• Connect data to Microsoft Sentinel
• Connect Microsoft 365 Defender
• Create a custom connector
• Monitor connector health
• Integrate Azure Data Explorer

Reference

• Data connector reference
• Data source schema reference
• CEF log field mapping
• Network normalization schema

Kusto Query Language in Microsoft Sentinel

Concept

• Kusto Query Language in Microsoft Sentinel

Tutorial

• Kusto Query Language tutorial (Azure Monitor)

Training

• Write your first query with Kusto Query Language
• More KQL learning and skilling resources

Reference

• KQL quick reference guide

Threat intelligence

Concept

• Understand threat intelligence in Microsoft Sentinel
• Threat intelligence integrations

How-To Guide

• Connect threat intelligence platforms to Microsoft Sentinel
• Connect Microsoft Sentinel to STIX/TAXII feeds
• Work with threat indicators

Threat detection

Concept

• User and entity behavior analytics (UEBA)
• Customizable anomalies

How-To Guide

• Use built-in analytics to detect threats
• Create custom detection rules

Reference

• Entities reference
• UEBA enrichments

Threat hunting

Concept

• Hunt for threats

How-To Guide

• Hunt with Jupyter notebooks
• Hunt with bookmarks
• Hunt with livestream

Investigate

Tutorial

• Investigate with UEBA

How-To Guide

• Investigate incidents
• Monitor your data

Reference

• Commonly used Microsoft Sentinel workbooks

Respond

Tutorial

• Respond automatically to threats
• Use Jupyter Notebooks to hunt for security threats

Concept

• Automation rules
• Playbooks

Reference

• SOAR content catalog

Manage Microsoft Sentinel

Concept

• Workspace architecture best practices

How-To Guide

• Design your workspace architecture
• Manage multiple tenants
• Work with incidents in multiple workspaces
• Manage your intellectual property