Microsoft Sentinel on Microsoft Azure
What is Microsoft Sentinel?
Microsoft Sentinel is Microsoft’s cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) system. The service collects security events from the entire IT landscape (cloud, on-premises, SaaS), correlates them with machine learning algorithms, detects threats, and automates incident response via playbooks.
At its core, Sentinel is based on Azure Monitor Log Analytics and uses Kusto Query Language (KQL) for queries, Analytics Rules for alerting, and Workbooks for visualization. Sentinel ingests logs via 400+ Data Connectors from Microsoft services (Microsoft Defender, Entra ID, Office 365), third-party solutions (firewalls, EDR, cloud platforms), and custom sources via Syslog, CEF, or REST API. The cloud-native architecture scales automatically and eliminates the need for on-premises SIEM infrastructure.
Sentinel’s machine learning models and User and Entity Behavior Analytics (UEBA) establish baselines for normal behavior and detect anomalies such as unusual logins, privilege escalation, or lateral movement. SOAR Playbooks (based on Azure Logic Apps) automate responses such as user lockout, email notifications, or ticket creation. Threat Hunting Notebooks (Jupyter) enable interactive investigations across large data volumes with Python and KQL.
Typical Use Cases
Multi-Cloud Security Monitoring
Enterprises use Sentinel as a central SIEM for Azure, AWS, and GCP. Data Connectors ingest CloudTrail logs from AWS, VPC Flow Logs, Google Cloud Audit Logs, and Azure Activity Logs into a single Sentinel Workspace. Analytics Rules correlate events across cloud boundaries and detect lateral movement between clouds. A global corporation monitors 50,000 cloud resources across 3 cloud providers from a single Sentinel instance.
Automated Incident Response with SOAR
Security teams create playbooks that automatically respond to incidents: On brute-force attack, the user is temporarily locked out, the security team is notified via Teams, and a ticket is created in the ITSM system. Playbooks integrate with 400+ connectors (ServiceNow, Slack, PagerDuty) and reduce Mean Time to Respond (MTTR) from hours to minutes. A financial company automates 80 percent of its Tier-1 responses.
Threat Hunting with KQL and UEBA
SOC analysts use KQL queries to proactively hunt for threats. UEBA creates risk scores for users and entities based on behavioral anomalies. An analyst queries “Show all users who logged in from more than 3 countries in the last 24 hours” and finds compromised accounts. Hunting queries are saved as Analytics Rules for continuous monitoring.
Compliance Reporting for GDPR and NIS2
Enterprises use Sentinel Workbooks for compliance dashboards: Who accessed sensitive data when, what changes were made to critical systems, were all failed login attempts logged. Retention policies hold logs for legally required periods (e.g., 6 months for NIS2). Audit reports are automatically generated and archived.
Integration with Microsoft Defender Suite
Sentinel aggregates alerts from Microsoft Defender for Cloud, Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident. Correlation Rules detect multi-stage attacks: Phishing email (Defender for Office) leads to malware download (Defender for Endpoint) and privilege escalation (Defender for Identity). One incident consolidates all alerts instead of isolated silos.
Best Practices for Microsoft Sentinel
Start with Microsoft Connectors
Enable the free Microsoft connectors (Entra ID, Azure Activity, Microsoft Defender) first before building third-party integrations. These are pre-installed, require no configuration, and immediately provide valuable context. Then enable critical on-premises systems (Domain Controllers via Windows Event Forwarding, firewalls via Syslog/CEF).
Use Analytics Rule Templates
Sentinel offers hundreds of predefined Analytics Rules for common attack patterns (Brute Force, Privilege Escalation, Malware). Enable relevant templates instead of writing everything from scratch. Adjust thresholds and filters to your environment. Disable noisy rules and continuously tune false positives.
Implement Data Retention Policies
Log Analytics retention defaults to 90 days, but you pay for longer retention. Define retention by log type: Security-critical logs (sign-ins, audit) for 12 months, less critical (performance) for 30 days. Use Archive for compliance retention (cheaper than hot retention but slower query performance).
Automate Frequent Responses with Playbooks
Identify repetitive incident response tasks and automate them. Typical playbooks: On phishing alert, block email and enable mailbox quarantine; on compromised user account, reset password and invalidate sessions; on malware detection, isolate host and collect forensic data. Start small and expand automation gradually.
Cost Optimization Through Log Filtering
Not all logs are equally valuable. Filter verbose, low-value logs before ingestion (Transformation Rules in Data Collection Rules). Example: Ingest only failed authentications, not all successful logins. Use Basic Logs for less critical log types (80% cost savings but limited query capabilities).
Threat Hunting with Hunting Queries
Use the community hunting queries from the Sentinel GitHub repo. Conduct regular hunting sessions (weekly or on new threat intelligence). Convert successful hunting queries to Scheduled Analytics Rules for continuous monitoring. Use Notebooks for complex multi-step investigations with Python.
Frequently Asked Questions about Microsoft Sentinel
What is the difference between SIEM and SOAR?
SIEM (Security Information and Event Management) collects, correlates, and analyzes security events from various sources to detect threats. SOAR (Security Orchestration, Automation and Response) automates incident response processes via playbooks. Sentinel combines both functions: SIEM analytics detect incidents, SOAR playbooks automate responses. This reduces manual work and Mean Time to Respond.
How does the pricing model work?
Sentinel charges by ingested data (Pay-as-you-go: approximately 2.50 EUR/GB or Commitment Tiers for discounts with predictable volume) plus Log Analytics Retention (first 90 days included, then approximately 0.12 EUR/GB/month). Automation (playbook executions) costs extra (Logic Apps Pricing). Typical costs: 50,000 security events/day = approximately 500 GB/month = 1,000-1,250 EUR/month. Use Commitment Tiers from 100 GB/day for up to 50% discount.
What is UEBA and how does it work?
User and Entity Behavior Analytics (UEBA) uses machine learning to create baselines for normal user and entity behavior. On deviations (e.g., user suddenly accesses unusual resources, login at unusual time, mass data download), a risk score is increased and alerts are generated. UEBA detects insider threats and compromised accounts without explicit rules.
Which Data Connectors are available?
Sentinel offers 400+ connectors: Microsoft services (Entra ID, Defender Suite, Office 365, Azure), cloud platforms (AWS CloudTrail, GCP Audit Logs), firewalls (Palo Alto, Fortinet, Cisco), EDR/XDR (CrowdStrike, SentinelOne), Identity (Okta, Ping), Ticketing (ServiceNow, Jira), and generic protocols (Syslog, CEF, REST API). Community connectors continuously expand the list.
Can I use Sentinel for non-Microsoft environments?
Yes, Sentinel is cloud-agnostic. Via Syslog/CEF connectors, you ingest logs from on-premises systems, AWS via CloudTrail connector, GCP via Pub/Sub connector. Sentinel supports third-party EDR, firewalls, and cloud services. Many enterprises use Sentinel as a central SIEM for hybrid and multi-cloud environments. The best integration is naturally with Microsoft services.
What is KQL and do I need to learn it?
Kusto Query Language (KQL) is Microsoft’s query language for Log Analytics. KQL is essential for Threat Hunting, custom Analytics Rules, and dashboards. The syntax is similar to SQL but optimized for log data and time series. Microsoft offers extensive tutorials and a KQL Playground. For basic use (predefined rules, workbooks), KQL is optional; for advanced analysts, it is required.
How does Sentinel integrate with Microsoft Defender?
Sentinel is the central XDR (Extended Detection and Response) for all Microsoft Defender products. Defender for Cloud, Defender for Endpoint, Defender for Office 365, and Defender for Identity send alerts to Sentinel. Sentinel correlates alerts across products into incidents, adds context, and enables unified response playbooks. Unified Security Operations combines Sentinel’s SIEM with Defender’s XDR capabilities.
Is Microsoft Sentinel GDPR compliant?
Yes, Sentinel can be operated GDPR-compliantly when you choose European Azure regions (e.g., Germany West Central, West Europe). Logs do not leave the chosen region. Microsoft provides data processing agreements per Art. 28 GDPR. Note that security logs contain personal data (IP addresses, usernames) and must be protected accordingly (RBAC, Encryption at Rest).
How does Sentinel compare to traditional SIEMs in cost?
Traditional on-premises SIEMs (Splunk, QRadar) have high upfront costs (hardware, licenses) and scale poorly. Sentinel has no upfront costs and scales elastically (pay for what you use). For small environments (under 50 GB/day), Sentinel is often cheaper. For very large environments (over 500 GB/day), Commitment Tiers or hybrid architectures (log filtering) may be necessary to control costs.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you in implementing Microsoft Sentinel. We help with connector configuration, analytics rule tuning, playbook development, and SOC process optimization.
Contact us for a non-binding consultation on Microsoft Sentinel and cloud security monitoring.
