Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM and SOAR built on Log Analytics. It collects security signals from across the estate — Azure, other clouds, on-premises, SaaS, network devices — into one workspace, hunts for threats with KQL, and automates response with playbooks. It is the place a security team investigates and responds, as opposed to where individual services raise their own alerts.

Its power and its cost both come from data. Sentinel bills primarily on the volume of data ingested and retained, so what you connect and how you tier it drives the bill as much as the value. A Sentinel that ingests everything indiscriminately is expensive; one that ingests the right signals and tiers the rest is effective and affordable.

Data Connectors and Log Analytics

Sentinel sits on a Log Analytics workspace, and data connectors stream in logs from Microsoft services, other clouds, firewalls, identity providers, and custom sources. The workspace is the shared store that Sentinel queries — and the same store Azure Monitor uses — so the choice of what to connect is the foundation of everything Sentinel can detect. Sentinel is now generally available in the Microsoft Defender portal as part of Microsoft's unified security operations, alongside Defender XDR; the workspace remains the data store, while the standalone Azure-portal experience is being phased out.

Hunting and Analytics Rules

Analytics rules run scheduled KQL queries that raise incidents when they match — built-in rules for known attack patterns, plus custom rules you write. Proactive hunting queries let analysts search for threats that have not triggered a rule. KQL is the lingua franca: the same query language as Azure Monitor and Resource Graph, so skills transfer across the platform.

SOAR Playbooks

Playbooks are automated response workflows built on Logic Apps, triggered by incidents — isolate a host, disable a user, open a ticket, post to a channel. Automating the routine first response shortens the time from detection to containment and frees analysts for the judgment calls. This is the SOAR (orchestration and automated response) half of Sentinel.

Cost and Data Tiers

Because billing follows ingestion and retention, controlling data is controlling cost. Commitment tiers discount predictable volume; auxiliary and basic logs ingest high-volume, low-value data cheaply for search without full analytics; and not every log belongs in Sentinel at all. The first Sentinel design question is always which data earns its ingestion cost.