Microsoft Sentinel: SIEM Meets SOAR
How Microsoft Sentinel collects security data from everywhere, detects threats with analytics and ML, investigates incidents, and automates responses with playbooks.
What are SIEM and SOAR?
Think of SIEM as a security camera room, and SOAR as the automated alarm system.
SIEM (Security Information and Event Management) is the room full of monitors. Every camera in the building — doors, car park, lobby, server room — feeds into this room. An analyst watches the screens, spots suspicious behaviour, and connects the dots: “That person entered the side door at 2am, walked past three cameras avoiding eye contact, and stopped at the server room. That’s not normal.”
SOAR (Security Orchestration, Automation, and Response) is the automated alarm system. When the cameras detect someone in a restricted area after hours, SOAR automatically locks the doors, alerts security, turns on floodlights, and starts recording in high resolution — without waiting for a human to press a button.
Microsoft Sentinel is both the camera room AND the alarm system — a cloud-native SIEM + SOAR in one platform.
The four pillars of Microsoft Sentinel
Sentinel’s capabilities map to four stages: Collect, Detect, Investigate, Respond.
1. Collect — data connectors
Sentinel ingests security data from across your environment through data connectors:
| Connector type | Examples |
|---|---|
| Microsoft services | Microsoft 365, Entra ID, Defender XDR, Defender for Cloud, Azure Activity |
| Azure services | Azure Firewall, NSG flow logs, Azure Key Vault, Azure DDoS Protection |
| Third-party products | Palo Alto, Cisco, AWS CloudTrail, Okta, ServiceNow |
| Custom sources | Common Event Format (CEF), Syslog, REST API |
The more data connectors you enable, the broader Sentinel’s visibility. Alex connects SecureBank’s M365 tenant, Azure subscriptions, and the on-prem firewall — giving Sentinel a 360-degree view of the environment.
2. Detect — analytics rules and ML
Once data flows in, Sentinel applies analytics rules to detect threats:
- Scheduled rules — KQL (Kusto Query Language) queries that run on a schedule, looking for specific patterns (“Alert if more than 5 failed logins from the same IP in 10 minutes”)
- Microsoft security rules — automatically create Sentinel incidents from alerts generated by other Microsoft products (Defender for Endpoint, Defender for Cloud)
- Machine learning (ML) rules — built-in anomaly detection that learns normal behaviour and flags deviations
- Fusion rules — Sentinel’s advanced multi-stage attack detection engine that correlates low-priority signals from different sources into high-confidence incidents
3. Investigate — incidents and entity mapping
When analytics rules trigger, Sentinel creates incidents — grouped collections of related alerts. Investigation tools include:
- Investigation graph — visual map showing relationships between entities (users, IPs, devices, files) involved in an incident
- Entity pages — detailed profiles for users, hosts, and IP addresses showing all related activity
- Bookmarks — save interesting findings during a hunting session for later investigation
4. Respond — automation with playbooks
Playbooks are automated workflows built on Azure Logic Apps that execute when triggered by a Sentinel alert or incident. Examples:
| Trigger | Automated response |
|---|---|
| Suspicious sign-in detected | Block the user account, send Teams notification to SOC |
| Malware alert from Defender for Endpoint | Isolate the device from the network, create ServiceNow ticket |
| New IP flagged as malicious | Add IP to Azure Firewall block list, enrich alert with threat intelligence |
Scenario: Alex investigates a multi-stage attack on SecureBank
Sentinel’s Fusion engine correlates three signals that individually seem low-risk:
- Entra ID: Impossible travel — James’s account logs in from Auckland and then London 20 minutes later
- Defender for Endpoint: The London login came from a device not registered to SecureBank
- M365: The London session downloaded 200 customer files from SharePoint in 5 minutes
Individually, each signal has a reasonable explanation. Together, Fusion recognises a classic pattern: credential theft followed by data exfiltration.
Sentinel creates a high-severity incident. Alex opens the investigation graph and sees the full attack chain visually: compromised credentials —> unknown device —> mass file download.
A playbook automatically triggers: James’s account is disabled, the SOC receives a Teams alert, and a ServiceNow ticket is created. The entire response happens within 90 seconds of detection.
Workbooks and threat hunting
Beyond automated detection, Sentinel provides tools for proactive security:
- Workbooks — interactive dashboards that visualise security data (for example, a dashboard showing all sign-in failures over the past 30 days by location and user)
- Hunting queries — pre-built and custom KQL queries that security analysts run proactively to search for threats that analytics rules might have missed. This is “threat hunting” — looking for trouble before it finds you.
Sentinel and Defender XDR — how they work together
| Feature | Microsoft Sentinel (SIEM/SOAR) | Defender XDR |
|---|---|---|
| Data sources | Everything — Microsoft, third-party, on-prem, custom | Microsoft Defender products only (tightly integrated) |
| Visibility | Broad — entire environment | Deep — within the Microsoft security ecosystem |
| Detection approach | Custom analytics rules, ML, Fusion, hunting queries | Pre-built detections optimised for Microsoft signals |
| Automation | Playbooks via Logic Apps | Built-in automated investigation and response (AIR) |
| Best for | Wide visibility across all sources | Deep cross-product correlation within Microsoft |
They are complementary. Sentinel provides the broad SIEM/SOAR layer across all data sources, while Defender XDR provides deep, integrated detection and response within the Microsoft product suite. Microsoft Sentinel is now available directly in the Microsoft Defender portal (security.microsoft.com), creating a unified security operations platform where Sentinel and Defender XDR incidents appear together.
Exam tip: SIEM vs XDR question patterns
The exam loves asking about the difference between Sentinel and Defender XDR:
- If the question mentions collecting data from third-party sources or custom log sources — the answer is Sentinel (SIEM).
- If the question mentions automatic correlation across Microsoft Defender products — the answer is Defender XDR.
- If the question asks where both come together — the answer is the unified Microsoft Defender portal.
Remember: SIEM = broad data collection and analytics. XDR = deep product-level integration. They work together, not as replacements.
🎬 Video walkthrough
🎬 Video coming soon
Microsoft Sentinel — SIEM + SOAR Explained (SC-900)
Microsoft Sentinel — SIEM + SOAR Explained (SC-900)
~9 minFlashcards
Knowledge check
SecureBank's SOC team wants to automatically block a user account when Sentinel detects an impossible travel alert followed by suspicious file downloads. Which Sentinel capability should Alex configure?
Director Reyes wants to know: 'Why do we need Sentinel if we already have Defender for Cloud?' What is the key difference?
James, the SOC lead, wants to proactively search for signs of lateral movement in SecureBank's network that automated analytics rules might have missed. Which Sentinel feature should he use?