Microsoft Sentinel
Sentinel is only as good as the tables you fill and the rules you tune. Coverage mapped to MITRE ATT&CK beats connector count.
Updated
How I use it
- Data source prioritisation against realistic attack paths
- Analytics rules and hunting queries in KQL
- ATT&CK coverage mapping to expose blind spots
- Playbook automation for containment and enrichment
Recurring problems I find
- Ingesting everything, tuning nothing — cost up, signal flat
- Alerts with no owner or runbook
Sentinel's data lake tier reached general availability in 2025, mirroring data underneath the analytics tier at a fraction of the cost. Management is also consolidating into the Defender portal.
Related
Incident response
IR lifecycle aligned to NIST SP 800-61r3 and CSF 2.0, cloud and identity playbooks, detection coverage and post-incident learning that changes controls.
Incident readiness
Incident response plan review, cloud and identity playbooks, tabletop exercises and detection coverage assessment.
Microsoft Defender for Cloud
Defender for Cloud for Azure-native CSPM, multicloud extension, container posture and AI workload security posture management.
Incident response checklist
Printable IR readiness checklist aligned to NIST SP 800-61r3: authority, playbooks, evidence access, communications and regulatory clocks.