Microsoft Sentinel — Cloud-Native SIEM and SOAR
How Microsoft Sentinel runs as a SIEM and SOAR on a Log Analytics workspace: the move into the Microsoft Defender portal (Azure portal support ends March 31, 2027), the analytics tier and the data lake tier, commitment tiers, connectors through the Azure Monitor Agent and data collection rules, analytics rules (scheduled, NRT, Fusion), incidents, automation rules and Logic Apps playbooks, UEBA, content hub, and the drills interviewers ask about: a rule that never fires and an ingestion cost spike.
Sign up free to read the full topic
More Cloud topics
- Managed Service for Prometheus
- MemoryDB — Durable In-Memory Database
- Microsoft Defender for Cloud — CSPM and Workload Protection
- Microsoft Entra ID — Identity and Access
- Microsoft Fabric
- Microsoft Foundry — Models, Agents and Azure OpenAI
- Migrate to Virtual Machines and Migration Center
- Migration Hub — Migration Planning and Tracking
- MIGs — Compute Engine managed instance groups
- Multi-Cloud & Hybrid Architecture
- Neptune — Managed Graph Database
- Network Connectivity Center
Start free on Cariara · Coding problems · System design studio