Microsoft Sentinel
By Microsoft
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution built on Azure, used to collect, detect, investigate, and respond to threats across…
Definition
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution built on Azure, used to collect, detect, investigate, and respond to threats across an organization.
Overview
Microsoft Sentinel is delivered as a fully cloud-native service on Azure, meaning organizations do not need to provision or manage the underlying infrastructure that traditional Security Information and Event Management (SIEM) platforms typically require. It ingests data from a wide range of sources — Microsoft 365, Azure services, on-premises systems, and third-party security tools — using built-in connectors, and stores it in a Log Analytics workspace queried with Kusto Query Language (KQL). Sentinel combines SIEM correlation and analytics with built-in Security Orchestration, Automation and Response (SOAR) capabilities, allowing security teams to build automated playbooks (powered by Azure Logic Apps) that respond to detected threats without manual intervention. Microsoft has also layered AI-assisted investigation features on top of Sentinel to help analysts triage incidents faster. Because of its deep native integration with the Microsoft ecosystem — Entra ID, Microsoft 365 Defender, and Azure resources — Sentinel is a common choice for organizations already standardized on Microsoft's cloud and productivity stack, competing with platforms like Splunk SIEM and Elastic Security.
Key Features
- Cloud-native SIEM requiring no infrastructure to provision or manage
- Built-in SOAR automation using Azure Logic Apps playbooks
- Kusto Query Language (KQL) for flexible log analytics
- Native connectors for Microsoft 365, Azure, and third-party tools
- Deep integration with Microsoft Entra ID and Microsoft 365 Defender
- AI-assisted incident investigation and triage
- Consumption-based pricing tied to data ingestion volume