Overview: what Sentinel is, licensing and workspace design
Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.
Data connectors, the Defender XDR connector and ingestion design
How data gets into Microsoft Sentinel, connector by connector type, what the Defender XDR connector really brings and costs, how DCRs and transformations shape what lands in the workspace, and how to pick a tier per table.
Analytics rules, incidents, UEBA and threat intelligence
How Sentinel turns logs into alerts and incidents, the seven analytics rule types and the anatomy of a scheduled rule, the incident lifecycle, UEBA tables, threat intelligence feeds and the TI tables, watchlists in detections, MITRE coverage, and how all of it changes once the workspace is in the Defender portal.
KQL for Sentinel, hunting, workbooks and notebooks
The KQL operators a security engineer actually uses in Sentinel, the tables worth knowing, ASIM parsers, functions, the hunting blade, workbooks, notebooks, query cost and performance, search jobs and restore, with 15 ready-to-paste queries.
Automation rules, playbooks and SOAR
How Sentinel automation rules evaluate triggers, conditions and actions in order, how Logic Apps playbooks authenticate with a managed identity and which roles they need, common response patterns such as MDE isolate and Entra disable, the automation health log, the permissions model, cost, and what still works in the Defender portal.
SOC optimization, the unified Defender portal and MSSP operation
How SOC optimization finds unused tables and missing detections, what the Defender portal adds to Sentinel and what stays in Azure, the one-primary-workspace rule, running Sentinel for many tenants with Lighthouse, B2B and the multitenant portal, health and audit tables, content as code, and a 30-60-90 day plan for a mid-size SOC.