product

Microsoft Sentinel

Microsoft Sentinel is a cloud-native SIEM and security operations platform for attack detection, threat visibility, proactive hunting, investigation, and response.

productsSentinelCurrent

Relationships

Log Analytics Workspace
CapabilitycapabilityWorkspace Manager
CapabilitycapabilityData Collection Rules at Scale
CapabilitycapabilityCross-Workspace KQL and ASIM Strategy
CapabilitycapabilitySentinel Data Lake Architecture
CapabilitycapabilityData Connectors
CapabilitycapabilityAnalytics Rules
CapabilitycapabilityIncidents
CapabilitycapabilityAutomation Rules
CapabilitycapabilityWorkbooks
CapabilitycapabilityWatchlists
CapabilitycapabilityContent Hub
CapabilitycapabilityThreat Intelligence
CapabilitycapabilityUser and Entity Behavior Analytics
CapabilitycapabilityData Retention and Tiers
CapabilitycapabilitySecurityAlert
Produced or queried tabletableSecurityIncident
Produced or queried tabletableThreatIntelIndicators
Produced or queried tabletableThreatIntelObjects
Produced or queried tabletableDeviceFileEvents
Produced or queried tabletableDeviceNetworkEvents
Produced or queried tabletableDeviceRegistryEvents
Produced or queried tabletableDeviceLogonEvents
Produced or queried tabletableDeviceImageLoadEvents
Produced or queried tabletableDeviceInfo
Produced or queried tabletableMicrosoft Sentinel REST API
Related APIapiAzure Monitor Logs Ingestion API
Related APIapiMicrosoft Sentinel Threat Intelligence Upload API
Related APIapi