Search the field manual.
A local, structured reference for Microsoft security products, licenses, capabilities, tables, schemas, APIs, and the relationships between them.
Build MDE From Scratch
Capability and table relationships for Defender for Endpoint.
ShortcutFind a Table
Browse Defender for Endpoint hunting tables.
ShortcutFind a Field
Map schema fields to tables, licenses, and APIs.
ShortcutCompare Schemas
Compare shared and unique fields across tables.
ShortcutFind an API Permission
Map app-registration permission resources to security APIs.
ShortcutDeploy Sentinel From Scratch
Walk through the decision-driven greenfield Sentinel build guide.
ShortcutUse Security APIs
Follow task-based workflows for Sentinel, KQL, IOC ingestion, and MDE actions.
ShortcutPlan IaC
Terraform workflows and non-Terraform gaps for Sentinel and Defender XDR.
ShortcutEstimate Sentinel Cost
Compare commitment, retention, table plan, and Microsoft 365 E5 credit levers.
ShortcutCompare MDE Licenses
Compare Defender for Endpoint P1 and P2.
ShortcutCompare MDO Licenses
Compare Defender for Office 365 P1 and P2.