Domain 3 of 4 · Chapter 3 of 4

Microsoft Sentinel

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security, Compliance, and Identity Fundamentals premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • SIEM and SOAR: detect versus respond
  • Microsoft Sentinel: one cloud-native SIEM and SOAR
  • Sentinel sits on top of Defender XDR
  • Exam pattern recognition

The two halves of Microsoft Sentinel: SIEM vs SOAR

DimensionSIEM (detect and analyze)SOAR (respond and automate)
Question it answersWhat is happening across my estate?How do I respond, quickly and consistently?
Core jobCollect, correlate, and surface threats (visibility)Orchestrate and automate the response (speed)
Main actionsIngest logs, run analytics rules, raise alerts and incidentsRun playbooks and automation rules to contain and remediate
Key Sentinel featuresData connectors, analytics rules, workbooks, hunting, UEBA, threat intelligencePlaybooks (Azure Logic Apps), automation rules
Which capability areasCollect, detect, investigateRespond
Zero Trust tieSeventh pillar: visibilitySeventh pillar: automation and orchestration
Exam cueCorrelate alerts from many sources into incidentsTrigger an automated workflow from an alert

Decision tree

Automatically respondto an incident?Scheduled detection thatraises incidents?Proactively searchbefore any alert?Flag anomalous user orentity behavior?Build a dashboard tovisualize the data?Playbookautomated response, Logic AppsAnalytics rulescheduled detection, incidentsHunting queryproactive, pre-alert searchUEBAbehavioral anomaly detectionWorkbookdashboards and visualsData connectorscollect the source firstYesYesYesYesYesNoNoNoNoNo
Cheat sheet

Cheat sheet

  • A SIEM collects and correlates signals to detect threats
  • A SOAR automates the response with playbooks and orchestration
  • Microsoft Sentinel is one cloud-native service that is both SIEM and SOAR
  • Sentinel is the estate-wide SIEM on top of Defender XDR, not XDR itself
  • Analytics rules turn correlated alerts into incidents
  • Sentinel playbooks are automated responses built on Azure Logic Apps
  • Workbooks are Sentinel's dashboards, not automation
  • Hunting queries search for threats before any alert fires
  • UEBA flags anomalies against behavioral baselines for users and entities
  • Threat intelligence matches your data against known-bad indicators
  • Sentinel data connectors ingest Microsoft and non-Microsoft sources alike
  • SIEM and SOAR are the seventh Zero Trust pillar in practice
  • Sentinel and Defender XDR share the Microsoft Defender portal
  • Correlating Defender for Cloud's alerts across the estate is Sentinel's job
  • Sentinel automation rules handle incidents natively without a playbook

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. Define the concepts of SIEM and SOAR (SC-900 training module)
  2. What is Microsoft Sentinel? (overview)
  3. Connect data sources to Microsoft Sentinel (data connectors)
  4. Detect threats with built-in analytics rules in Microsoft Sentinel
  5. Threat hunting in Microsoft Sentinel
  6. Automate threat response with playbooks in Microsoft Sentinel
  7. Microsoft Sentinel in the Microsoft Defender portal
  8. Visualize collected data with workbooks in Microsoft Sentinel
  9. Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel
  10. What is Microsoft Defender XDR?
  11. Microsoft unified security operations platform