Analytics rules, incidents, UEBA and threat intelligence
How Sentinel turns logs into alerts and incidents, the seven analytics rule types and the anatomy of a scheduled rule, the incident lifecycle, UEBA tables, threat intelligence feeds and the TI tables, watchlists in detections, MITRE coverage, and how all of it changes once the workspace is in the Defender portal.