Microsoft Sentinel
SIEMSOARA cloud-based SIEM with built-in automation.
Who uses it?
SOC analysts and security engineers, especially in organisations using Microsoft cloud services.
Best for
Cloud-scale detection across Microsoft and other sources
Similar tools
Splunk, QRadar
What is it?
Microsoft Sentinel is a cloud-native SIEM that also supports automated response through playbooks.
What problem does it solve?
Organisations need one place to collect and analyse security data without running their own infrastructure.
How does it work?
Connectors bring in logs from Microsoft and third-party sources. Analytics rules, written with Kusto Query Language (KQL), generate alerts and incidents. Playbooks can run automated steps in response to incidents.
Simple example
SigninLogs
| where ResultType != "0"
| summarize failures = count() by IPAddress
| where failures > 10An illustrative KQL query that finds IP addresses with many failed sign-ins.
When would a SOC analyst use it?
When investigating an incident that spans identity, email and endpoint data in a single workspace.
How does it work?
- 1Connectors bring in logs from Microsoft and third-party sources.
- 2Analytics rules, written with Kusto Query Language (KQL), generate alerts and incidents.
- 3Playbooks can run automated steps in response to incidents.
Simple example
A rule raises an incident when a user signs in from an unusual location, and a playbook adds context to the incident.
SigninLogs
| where ResultType != "0"
| summarize failures = count() by IPAddress
| where failures > 10An illustrative KQL query that finds IP addresses with many failed sign-ins.
When would a SOC analyst use it?
When investigating an incident that spans identity, email and endpoint data in a single workspace.
Who uses it?
SOC analysts and security engineers, especially in organisations using Microsoft cloud services.
Pros
- No infrastructure to run
- Tight integration with Microsoft services
- Built-in automation
Cons
- Cost depends on data ingested
- Best value inside the Microsoft ecosystem
- KQL has a learning curve
