Microsoft Sentinel Handbook
Module 1: Introduction to Microsoft Sentinel
1.1. What is Microsoft Sentinel?
Microsoft Sentinel is a powerful, cloud-native Security Information and Event
Management (SIEM) and Security Orchestration, Automation, and Response
(SOAR) solution. It's designed to help organizations of all sizes effectively collect
security data, detect threats, investigate incidents, and respond to cyberattacks.
1.1.1. Overview and Core Purpose
At its core, Microsoft Sentinel acts as a central security hub for your entire digital
environment. Its main purpose is to provide a unified view of your security posture,
enabling your security team (like the Security Operations Analysts who take the
SC-200 exam) to:
● Gain Visibility: Collect security logs and alerts from all your systems, whether
they are in the cloud (Azure, Microsoft 365, other cloud providers) or
on-premises.
● Detect Threats: Use advanced analytics, artificial intelligence (AI), and threat
intelligence to identify real threats and reduce false alarms.
● Investigate Efficiently: Streamline the investigation process by correlating
related alerts into actionable incidents and providing tools to understand the
scope and impact of an attack.
● Automate Responses: Automate routine security tasks and responses to
common threats, speeding up reaction times and freeing up human analysts for
more complex work.
1.1.2. Key Benefits
● Cloud-Native: Built on Microsoft Azure, Sentinel offers the benefits of cloud
computing, such as high scalability, global availability, and reduced infrastructure
management overhead. You pay only for what you use.
● Scalability: It can easily scale to handle vast amounts of security data from
thousands of devices and applications without requiring you to manage
underlying hardware.
● AI-driven: Leverages Microsoft's extensive threat intelligence and machine
learning capabilities to detect sophisticated and previously unknown threats.
● Integrated: Seamlessly integrates with other Microsoft security solutions (like
Microsoft 365 Defender, Azure Active Directory, Microsoft Defender for Cloud) for
a comprehensive security ecosystem.
1.2. Sentinel's Role in Security Operations (SecOps)
In a Security Operations Center (SOC) or a security team, Sentinel serves as the
primary workbench for Security Operations Analysts. It transforms raw security data
into actionable insights, helping analysts move from simply monitoring logs to actively
hunting for threats and responding to incidents.
Your role as an SC-200 certified analyst will heavily involve using Sentinel for:
● Monitoring dashboards for security health.
● Triaging and investigating security incidents.
● Developing and tuning detection rules.
● Performing proactive threat hunting.
● Automating incident response workflows.
1.3. SIEM vs. SOAR: Understanding Sentinel's Dual Role
Microsoft Sentinel uniquely combines the capabilities of both SIEM and SOAR:
● SIEM (Security Information and Event Management): This is the "brain" that
collects, aggregates, and analyzes security data from across an organization's IT
infrastructure. Its main goal is to provide a centralized view of security events and
help detect threats. Sentinel excels at this by ingesting data from diverse sources
and applying analytics.
● SOAR (Security Orchestration, Automation, and Response): This is the
"muscle" that automates security tasks and orchestrates responses to security
incidents. It helps security teams work more efficiently by automating repetitive
actions (like blocking an IP address or sending a notification) and integrating with
other security tools. In Sentinel, these automation capabilities are primarily
powered by Playbooks (built on Azure Logic Apps).
By combining SIEM and SOAR, Sentinel provides a holistic platform for managing the
entire lifecycle of a security incident, from initial detection to final resolution.
1.4. Key Concepts & Terminology
To effectively use Microsoft Sentinel, it's important to understand its core components
and the terminology associated with them:
● Log Analytics Workspace: This is the foundational Azure resource where all your
security data is stored and analyzed by Sentinel. Think of it as the central
database and processing engine.
● Data Connectors: These are the mechanisms used to ingest (bring in) security
logs and events from various sources (e.g., Azure AD, Microsoft 365, firewalls,
servers) into your Log Analytics Workspace.
● Analytics Rules: These are the detection rules that Sentinel uses to identify
threats. They are Kusto Query Language (KQL) queries that run on your ingested
data to look for specific patterns, anomalies, or known attack signatures. When a
rule triggers, it generates an alert.
● Incidents: Sentinel automatically groups related alerts into an "incident." An
incident represents a potential security breach or significant security event that
requires investigation. This grouping helps reduce alert fatigue and provides a
clearer picture of a potential attack campaign.
● Playbooks: These are automated procedures (built using Azure Logic Apps) that
can be triggered by alerts or incidents in Sentinel. They perform predefined
actions, such as sending notifications, blocking malicious IPs, isolating
compromised devices, or creating tickets in external systems.
● Workbooks: These are interactive dashboards and reports that allow you to
visualize your security data, monitor your security posture, and gain insights into
trends and events. They are highly customizable using KQL.
● Hunting Queries: These are KQL queries used by security analysts to proactively
search for threats or suspicious activities in their data that might not have been
caught by existing analytics rules. This is a key part of proactive threat hunting.
● Entities: These are the key components identified within your security data and
incidents, such as user accounts, IP addresses, hostnames, and file hashes.
Sentinel helps you visualize and investigate relationships between these entities.
