Microsoft Sentinel documentation

Microsoft Sentinel provides attack detection, threat visibility, proactive hunting, and threat response to help you stop threats before they cause harm.

Microsoft Sentinel Documentation
Overview
Plan
- Deployment planning guide
- Prerequisites
- Workspace architecture
- Prioritize data connectors
- Plan roles and permissions
- Plan interactive and long-term data retention
- Plan costs
- Availability and support
Deploy
Migrate to Microsoft Sentinel
- Plan and design your migration
- Migrate from ArcSight
- Migrate from Splunk
- Migrate from QRadar
- Ingest historical data
- Convert dashboards to workbooks
- Update SOC processes
Enable solutions and content
- Overview
- Deploy out-of-the-box content
- Delete out-of-the-box content
- Partner integrations best practices
- Solution catalog
- Manage custom content from repositories
- Protect business applications
  - Integrate SAP systems
    - SAP applications
      - Overview
      - Deploy the SAP integration
        
        Deployment overview
        
        Deployment prerequisites
        
        Install the solution for SAP applications
        
        Prepare your SAP environment
        
        Connect your SAP system
        
        Troubleshoot SAP data connector agent
        
        Extra deployment steps
        
        Collect SAP HANA audit logs
        
        Update the data connector agent
        
        Deploy from the command line
        
        Deploy with expert options
        
        SAP deployment reference advanced
        
        Required ABAP permissions
        
        Data connector agent kickstart script reference
        
        Data connector agent update script reference
        
        Data connector agent systemconfig.json file reference
        
        Data connector agent systemconfig.ini file reference legacy
      - Enable SAP detections and threat protection
      - Automatic attack disruption for SAP
      - Integrate SAP across multiple workspaces
      - Monitor SAP systems
        
        Monitor SAP system health and role
        
        Monitor SAP audit logs
        
        Monitor SAP audit controls
      - SAP solution content reference
        
        SAP security content reference
        
        Monitored SAP security parameters
        
        SAP solution function reference
        
        SAP solution log and table reference
      - Stop SAP data collection
    - SAP BTP
  - Integrate Microsoft business applications
- Integrate Microsoft Defender for IoT
  - Connect Defender for IoT data with Microsoft Sentinel
  - Investigate Defender for IoT incidents with Microsoft Sentinel
- Integrate Microsoft Defender XDR
- Integrate Microsoft Defender for Cloud
Collect data
Integrate threat intelligence
Detect threats and analyze data
- Monitor and visualize data
- Threat detection analytics rules
  - Overview
  - Scheduled analytics rules
    - Overview
    - Create a scheduled rule from a template
    - Create a scheduled rule from scratch
    - Enhance detections
  - Near-real-time NRT analytics rules
    - Overview
    - Create NRT analytics rules
  - Anomaly detection rules
    - Overview
    - Work with out-of-the-box anomaly rules
  - Multistage attacks Fusion
    - Overview
    - Configure multistage attack Fusion rules
  - Create incidents from Microsoft Security alerts
  - Export and import analytics rules
  - Manage template versions for analytics rules
  - Handle ingestion delay in analytics rules
  - Get fine-tuning recommendations
  - Troubleshoot analytics rules
- Tutorial - Detect threats using analytics rules
- MITRE ATT&CK coverage
- Data classification with entities
- Watchlists
- Deploy and monitor decoy honeytokens
- Handle false positives
Hunt for threats
- Overview
- Conduct end-to-end hunts
- Advanced hunting in the Defender portal
- Kusto Query Language
- Create custom query
- Bookmarks
- Livestream
- Notebooks
- Bring your own machine learning
Investigate incidents
- Azure portal
  - Overview
  - Investigate incidents
  - Tutorial - Investigate with UEBA
  - Relate alerts to incidents
  - Create incidents manually
  - Delete incidents
  - Remediate threats while investigating
  - Manage incident workflow with tasks
  - Collaborate in Microsoft Teams
- Defender portal
- Entities
  - Overview
  - Create custom entity activities
  - Entity pages in the Defender portal
    - User
    - Device
    - IP
- Security Copilot
  - Overview
  - Microsoft Copilot in Microsoft Defender
- Large datasets
Automate responses
SOC optimizations
Manage Microsoft Sentinel
- Manage costs and billing
- Connect Microsoft Sentinel to Microsoft Defender XDR
- Manage multiple workspaces
  - Workspace manager
  - Extend across multiple workspaces
- Microsoft Sentinel for MSSPs
- Manage workspace access
- Set up customer-managed keys
- Manage your SOC with incident metrics
- Monitor Microsoft Sentinel health
- Auditing Microsoft Sentinel with Azure Activity Logs
- Remove Microsoft Sentinel from your workspaces
Troubleshoot
- Troubleshoot AWS S3 connector issues
Reference
- Service limits
- Microsoft Sentinel REST-API
- OOTB content centralization changes
- Build and publish Microsoft Sentinel solutions
  - Publish solutions
  - Solution lifecycle post publish
- Management references
- Advanced Security Information Model ASIM
- Automation and response references
  - SOAR content catalog
  - Automation rules reference
- Data collection references
- Detection and analysis references
- Compare playbooks, workbooks, and notebooks
- Operations guide
Resources
- Sample workspace architecture
- Microsoft Sentinel blog
- Pricing
- Build your skills for Microsoft Sentinel
  - Microsoft Applied Skill - Configure SIEM security operations using Microsoft Sentinel
  - Microsoft Sentinel skill-up training
  - Learn modules for Microsoft Sentinel
  - [Learn modules for Kusto Query Language KQL](https://learn.microsoft.com/training/browse/?expanded=azure&terms=kusto query language)

Azure Docs Links

Microsoft Sentinel documentation