Microsoft Sentinel
Cloud-native SIEM and SOAR running on Azure with per-GB analytics pricing.
Technical Architecture & Overview
Microsoft Sentinel is a cloud SIEM built on Azure Log Analytics, with analytics rules, automation playbooks through Logic Apps, and ATT&CK-mapped detections. It sits close to Defender and Entra telemetry, and KQL gives analysts query depth across all ingested data. Pricing follows ingestion and retention, with commitment tiers for volume. After March 31, 2027, Sentinel is available only in the Microsoft Defender portal, not the Azure portal.
Targeted Technical Use Cases
Microsoft-centric estates that want SIEM and SOAR without managing infrastructure.
Evaluation & Trade-offs
Core Strengths
- +Built-in connectors for Microsoft sources such as Microsoft Entra ID and Defender XDR.
- +KQL is the same query language used in Azure Monitor and Azure Data Explorer.
- +No infrastructure to operate.
Trade-Offs & Limitations
- -Costs are sensitive to ingestion discipline.
- -Data is stored in Azure Monitor Log Analytics workspaces, which ties deployments to Azure.
Defensive Security Application
Cloud SIEM correlation and automated response across Microsoft and third-party sources.
Frequently Asked Questions
What is Microsoft Sentinel?→
Microsoft Sentinel is a cloud SIEM built on Azure Log Analytics, with analytics rules, automation playbooks through Logic Apps, and ATT&CK-mapped detections. It sits close to Defender and Entra telemetry, and KQL gives analysts query depth across all ingested data. Pricing follows ingestion and retention, with commitment tiers for volume. After March 31, 2027, Sentinel is available only in the Microsoft Defender portal, not the Azure portal.
What is Microsoft Sentinel used for?→
Microsoft-centric estates that want SIEM and SOAR without managing infrastructure.
What are the strengths of Microsoft Sentinel?→
- +Built-in connectors for Microsoft sources such as Microsoft Entra ID and Defender XDR.
- +KQL is the same query language used in Azure Monitor and Azure Data Explorer.
- +No infrastructure to operate.
What are the limitations of Microsoft Sentinel?→
- +Costs are sensitive to ingestion discipline.
- +Data is stored in Azure Monitor Log Analytics workspaces, which ties deployments to Azure.
How is Microsoft Sentinel used defensively?→
Cloud SIEM correlation and automated response across Microsoft and third-party sources.