How Sentinel turns logs into alerts and incidents, the seven analytics rule types and the anatomy of a scheduled rule, the incident lifecycle, UEBA tables, threat intelligence feeds and the TI tables, watchlists in detections, MITRE coverage, and how all of it changes once the workspace is in the Defender portal.
How data gets into Microsoft Sentinel, connector by connector type, what the Defender XDR connector really brings and costs, how DCRs and transformations shape what lands in the workspace, and how to pick a tier per table.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
How the Defender XDR incident queue works and how to run it, incident versus alert, severity, status, classification and determination values, tags and assignment, the attack story graph, evidence and response, alert tuning rules, automated investigation verdicts, the Action center, email notifications, the Graph incidents API and the Sentinel handoff.
Defender for Cloud Apps as Microsoft's CASB and SaaS security layer, its four data paths (Cloud Discovery, app connectors, Conditional Access App Control, app governance), the app catalogue and risk scores, how it lands in Defender XDR, what the licences and roles are, and first-time setup.
The eight Defender for Cloud Apps policy types, what the built-in anomaly detections flag and how to scope them, file policies with Purview labels, per-app governance actions, the activity log, the alert lifecycle in Defender XDR, Sentinel paths, the Activities and Alerts API, and a troubleshooting table for the whole product.
What Microsoft Secure Score measures and how points are awarded, how Security Exposure Management builds attack paths, critical assets and initiatives on top of MDE, MDVM, MDI, MDA, Entra and Defender for Cloud signals, how Threat analytics maps a tracked threat to your exposure, and how to turn the three into a prioritised work list for a client.
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.
How SOC optimization finds unused tables and missing detections, what the Defender portal adds to Sentinel and what stays in Azure, the one-primary-workspace rule, running Sentinel for many tenants with Lighthouse, B2B and the multitenant portal, health and audit tables, content as code, and a 30-60-90 day plan for a mid-size SOC.
Page-by-page walk of Settings in the Defender portal, which product owns each page, which toggles reach across products, how device groups drive automation and RBAC, and how to audit who changed what.
The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.