Microsoft Sentinel documentation
Microsoft Sentinel provides attack detection, threat visibility, proactive hunting, and threat response to help you stop threats before they cause harm.
- Microsoft Sentinel Documentation
- Overview
- Plan
- Deployment planning guide
- Prerequisites
- Workspace architecture
- Prioritize data connectors
- Plan roles and permissions
- Plan interactive and long-term data retention
- Plan costs
- Availability and support
- Deploy
- Enable Microsoft Sentinel and initial features and content
- Onboard to Microsoft Sentinel
- Connect Microsoft Sentinel to the Defender portal
- Configure content
- Set up multiple workspaces
- Enable User and Entity Behavior Analytics UEBA
- Configure interactive and long-term data retention
- Deploy side-by-side
- Migrate
- Transition your environment to the Defender portal
- Migrate to Microsoft Sentinel
- Plan and design your migration
- Migrate from ArcSight
- Migrate from Splunk
- Migrate from QRadar
- Ingest historical data
- Convert dashboards to workbooks
- Update SOC processes
- Manage solutions and content
- Overview
- Deploy out-of-the-box content
- Delete out-of-the-box content
- Manage solution deprecation lifecycle
- Solution catalog
- Manage content as code using repositories
- Protect business applications
- Integrate SAP systems
- SAP applications
- Overview
- Deploy the SAP integration
- Deployment overview
- Deployment prerequisites
- Install the solution for SAP applications
- Prepare your SAP environment
- Connect your SAP system
- Troubleshoot SAP data connector
- Extra deployment steps
- SAP deployment reference advanced
- Enable SAP detections and threat protection
- Integrate SAP across multiple workspaces
- Monitor SAP systems
- SAP solution content reference
- Stop SAP data collection
- SAP BTP
- SAP applications
- Integrate Microsoft business applications
- Integrate SAP systems
- Integrate Microsoft Defender for IoT
- Integrate Microsoft Defender XDR
- Integrate Microsoft Defender for Cloud
- Collect data
- Overview
- Best practices
- Tutorial - Forward syslog data to workspace
- Connect data sources
- Ingestion-time data transformation
- AMA migration for Microsoft Sentinel
- Ingest data to an auxiliary logs table
- Find data connector
- Connection instructions by type
- General instructions for Microsoft connectors
- Azure Functions API connection
- CEF/Syslog
- Custom log sources text files
- DNS via AMA
- Logstash plugin with Data Collection Rules
- Connection instructions for service
- Configure ingestion-time transformation
- Configure RDP login detection
- Create a custom connector
- Normalize data
- Aggregate data
- Integrate threat intelligence
- Overview
- Threat intelligence integrations
- Enable MDTI data connector
- Connect threat intelligence with upload API
- Connect threat intelligence platforms
- Connect to STIX/TAXII feeds
- Add threat intelligence in bulk by file
- Work with threat intelligence
- Add entity to threat indicators
- Use threat indicators in analytics rules
- Use matching analytics to detect threats
- Work with STIX objects and indicators
- Detect threats and analyze data
- Monitor and visualize data
- Threat detection analytics rules
- Overview
- Scheduled analytics rules
- Near-real-time NRT analytics rules
- Anomaly detection rules
- Multistage attacks Fusion
- Create incidents from Microsoft Security alerts
- Export and import analytics rules
- Manage template versions for analytics rules
- Handle ingestion delay in analytics rules
- Get fine-tuning recommendations
- Troubleshoot analytics rules
- Tutorial - Detect threats using analytics rules
- MITRE ATT&CK coverage
- Data classification with entities
- Watchlists
- Deploy and monitor decoy honeytokens
- Handle false positives
- Hunt for threats
- Overview
- Conduct end-to-end hunts
- Advanced hunting in the Defender portal
- Kusto Query Language
- Create custom query
- Bookmarks
- Livestream
- Notebooks
- Bring your own machine learning
- Investigate incidents
- Azure portal
- Defender portal
- Entities
- Overview
- Create custom entity activities
- Entity pages in the Defender portal
- Security Copilot
- Overview
- Summarize incidents in Azure portal
- Microsoft Copilot in Microsoft Defender
- Large datasets
- Automate responses
- Overview
- Respond to threats using automation
- Automatically enrich incident information
- Extract incident entities with non-native actions
- Automation rules
- Playbooks
- SOC optimizations
- Manage Microsoft Sentinel
- Manage costs and billing
- Manage multiple workspaces
- Microsoft Sentinel for MSSPs
- Manage workspace access
- Set up customer-managed keys
- Manage your SOC with incident metrics
- Monitor Microsoft Sentinel health
- Auditing Microsoft Sentinel with Azure Activity Logs
- Remove Microsoft Sentinel from your workspaces
- Build and publish Microsoft Sentinel solutions
- Overview
- Sentinel solution quality guidelines
- Partner integrations best practices
- Creating codeless data connectors CCF
- Creating analytics rules
- Creating hunting queries
- Creating workbooks
- Creating playbooks
- Creating ASIM parsers
- Publish solutions
- Solution lifecycle post publish
- Remove Microsoft Sentinel from your workspace
- Troubleshoot
- Reference
- Service limits
- Microsoft Sentinel REST-API
- OOTB content centralization changes
- Management references
- Advanced Security Information Model ASIM
- Automation and response references
- Data collection references
- Data source schema reference
- Security alert schema reference
- CEF log field mapping
- Windows security event sets
- DNS over AMA reference
- Data connector definitions API reference
- RestApiPoller data connectors API reference
- GCP data connectors API reference
- Sample API requests for creating Data Collection Rules DCRs
- Microsoft Purview Information Protection reference
- Microsoft 365 Defender connector data type support
- Detection and analysis references
- Top Microsoft Sentinel workbooks
- Entities reference
- UEBA reference
- Anomalies reference
- Multistage attack detection scenarios
- Watchlist template schemas
- Manage hunting queries with REST-API
- Enrich entities with geolocation data with REST-API
- Threat intelligence upload API reference
- Legacy upload indicator API reference
- Operations guide
- Resources
- Sample workspace architecture
- Microsoft Sentinel blog
- Pricing
- Build your skills for Microsoft Sentinel
- Microsoft Applied Skill - Configure SIEM security operations using Microsoft Sentinel
- Microsoft Sentinel skill-up training
- Learn modules for Microsoft Sentinel
- [Learn modules for Kusto Query Language KQL](https://learn.microsoft.com/training/browse/?expanded=azure&terms=kusto query language)