How Sentinel turns logs into alerts and incidents, the seven analytics rule types and the anatomy of a scheduled rule, the incident lifecycle, UEBA tables, threat intelligence feeds and the TI tables, watchlists in detections, MITRE coverage, and how all of it changes once the workspace is in the Defender portal.
How the Defender XDR incident queue works and how to run it, incident versus alert, severity, status, classification and determination values, tags and assignment, the attack story graph, evidence and response, alert tuning rules, automated investigation verdicts, the Action center, email notifications, the Graph incidents API and the Sentinel handoff.
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.