How Sentinel turns logs into alerts and incidents, the seven analytics rule types and the anatomy of a scheduled rule, the incident lifecycle, UEBA tables, threat intelligence feeds and the TI tables, watchlists in detections, MITRE coverage, and how all of it changes once the workspace is in the Defender portal.
How Sentinel automation rules evaluate triggers, conditions and actions in order, how Logic Apps playbooks authenticate with a managed identity and which roles they need, common response patterns such as MDE isolate and Entra disable, the automation health log, the permissions model, cost, and what still works in the Defender portal.
How data gets into Microsoft Sentinel, connector by connector type, what the Defender XDR connector really brings and costs, how DCRs and transformations shape what lands in the workspace, and how to pick a tier per table.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
How the Defender XDR incident queue works and how to run it, incident versus alert, severity, status, classification and determination values, tags and assignment, the attack story graph, evidence and response, alert tuning rules, automated investigation verdicts, the Action center, email notifications, the Graph incidents API and the Sentinel handoff.
The KQL operators a security engineer actually uses in Sentinel, the tables worth knowing, ASIM parsers, functions, the hunting blade, workbooks, notebooks, query cost and performance, search jobs and restore, with 15 ready-to-paste queries.
Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.
The eight Defender for Cloud Apps policy types, what the built-in anomaly detections flag and how to scope them, file policies with Purview labels, per-app governance actions, the activity log, the alert lifecycle in Defender XDR, Sentinel paths, the Activities and Alerts API, and a troubleshooting table for the whole product.
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.
How SOC optimization finds unused tables and missing detections, what the Defender portal adds to Sentinel and what stays in Azure, the one-primary-workspace rule, running Sentinel for many tenants with Lighthouse, B2B and the multitenant portal, health and audit tables, content as code, and a 30-60-90 day plan for a mid-size SOC.
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.