What Is Azure Sentinel?

Azure Sentinel is Microsoft’s cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform. Unlike traditional on-premises SIEM products, Azure Sentinel requires no infrastructure provisioning or complex installation — it runs entirely in the cloud and scales automatically to meet data volume demands.

What sets Azure Sentinel apart from conventional SIEM tools is its breadth of data ingestion and its AI-powered analytics engine. It is designed to monitor not only Azure-native resources, but also on-premises workloads, Office 365, AWS, and a wide range of third-party security products. This makes it a genuine hybrid-cloud security solution rather than a siloed, single-vendor tool.

The Four Core Stages of Azure Sentinel

Azure Sentinel organises its capabilities around four sequential stages, each addressing a distinct phase of the threat-management lifecycle:

• Collect — Ingests data at cloud scale from users, devices, applications, and infrastructure across multiple clouds and on-premises environments.
• Detect — Identifies threats in near-real time using built-in analytics rules, reducing mean time to detect (MTTD).
• Investigate — Applies machine learning and AI to surface correlated alerts and map attack timelines across all monitored assets.
• Respond — Automates responses to confirmed threats using Logic App-based Playbooks, eliminating slow manual remediation steps.

Supported Data Sources and Connectors

Once a Log Analytics workspace is connected to Azure Sentinel, you configure Data Connectors to forward logs and telemetry into the platform. At the time of the original preview, available connectors included:

• Azure Active Directory (sign-in logs, audit logs)
• Azure Active Directory Identity Protection (requires Azure AD Premium P1/P2)
• Office 365 (Exchange, SharePoint, Teams activity)
• Microsoft Cloud App Security
• Azure Information Protection
• AWS CloudTrail
• Third-party security appliances: Cisco ASA, Fortinet, Barracuda, F5
• Any syslog source supporting Common Event Format (CEF)

Each connector has its own configuration blade with step-by-step instructions. Some connectors, such as Azure AD Identity Protection, connect with a single click (provided licensing prerequisites are met), while others — particularly CEF-based connectors — require agent installation on a log-forwarding server.

Getting Started: Initial Setup

Setting up Azure Sentinel for the first time involves a small number of steps:

1. Navigate to Azure Sentinel in the Azure Portal — either via the Marketplace, All Services, or the search bar.
2. Click + Add and select an existing Log Analytics workspace, or create a new one in a supported region.
3. Click Add Azure Sentinel to attach the workspace.
4. Open the Data Connectors blade and enable the relevant connectors for your environment.

After connectors are configured, Azure Sentinel begins ingesting data. It can take several minutes before events and alerts start appearing in the dashboards. The longer the platform runs, the richer the historical context it builds for anomaly detection.

Note on regions (as of early 2019 preview): At the time of writing, Azure Sentinel workspaces were supported only in a limited set of regions: Australia Southeast, Canada Central, Central India, East US, East US 2 EUAP, Japan East, Southeast Asia, UK South, West Europe, and West US 2. This list has expanded significantly since general availability. Always check the official Microsoft documentation for the current list of supported regions.

The Azure Sentinel Dashboard

The main Azure Sentinel overview presents a centralised security posture at a glance:

• Events and Alerts counters — rolling totals for ingested events and triggered alerts.
• Events and Alerts over time graph — a time-series view useful for spotting sudden spikes in activity.
• World map — plots the geographic origin of suspicious events, helping analysts prioritise threats by source location.
• Threat Management and Configuration panel — left-hand navigation providing access to Analytics, Playbooks, Hunting, Cases, and Settings.

Writing Custom Alert Rules with Kusto Query Language (KQL)

Azure Sentinel surfaces Log Analytics directly through the Logs blade, allowing analysts to write and test queries using Kusto Query Language (KQL) against the connected Log Analytics workspace. This is particularly powerful for building custom detection logic tailored to your environment.

As a practical example, the following KQL query searches for Windows Security Event ID 4625 — a failed logon attempt — which is a common indicator of brute-force activity:

SecurityEvent
| where EventID == 4625
| summarize FailedLogons = count() by Account, Computer, bin(TimeGenerated, 1h)
| where FailedLogons > 10
| order by FailedLogons desc

Once you have a working query, you can promote it into a scheduled Analytics Rule by:

1. Navigating to Analytics and clicking + Add.
2. Entering a rule name, description, severity level, and status (enabled/disabled).
3. Pasting your KQL query into the Set Alert Query field — the Logic pane renders a preview graph of matching results.
4. Clicking View Query Results to validate the query directly in Log Analytics before saving.
5. Setting an alert threshold and a run frequency (e.g., every 5 minutes, every hour).
6. Clicking Save to activate the rule.

When the query matches results exceeding the defined threshold, Azure Sentinel raises an alert and, optionally, creates a Case for analyst triage.

Automating Responses with Playbooks

Azure Sentinel Playbooks are Azure Logic App workflows triggered by alerts. They enable security teams to automate repetitive response tasks, dramatically reducing mean time to respond (MTTR). Example automated actions include:

• Sending an email or Teams notification when a brute-force threshold is breached.
• Blocking inbound traffic from a known-malicious IP address via a firewall API call.
• Disabling or locking a compromised user account in Azure Active Directory.
• Isolating a virtual machine by removing it from a network security group.
• Shutting down a compromised VM to contain lateral movement.
• Opening a ticket in an ITSM platform such as ServiceNow or Jira.

Because Playbooks are standard Logic Apps, they benefit from the full Logic Apps connector ecosystem — hundreds of pre-built integrations with Microsoft and third-party services.

Azure Sentinel Fusion: AI-Powered Threat Correlation

Azure Sentinel Fusion is an advanced, machine-learning-driven correlation engine that links seemingly unrelated low-fidelity alerts across multiple data sources into high-confidence security incidents. It is designed to reduce alert fatigue by surfacing the small number of incidents that truly warrant analyst attention, rather than flooding dashboards with individual, unconnected alerts.

During the preview period, Fusion was not enabled by default and had to be activated via Azure Cloud Shell. As of general availability, Fusion is integrated into the platform’s analytics rules and enabled automatically for supported detection scenarios. Check the current Microsoft documentation for the latest configuration requirements.

Key Advantages Over Traditional On-Premises SIEM

Prerequisites Summary

• An active Azure subscription with Contributor permissions.
• A Log Analytics workspace created in a supported Azure region.
• Appropriate licensing for premium connectors (e.g., Azure AD Premium P1/P2 for Identity Protection).

Further Reading

For the most current feature set, pricing, and regional availability, refer to the official Microsoft Azure Sentinel (now Microsoft Sentinel) documentation. Note that Microsoft rebranded the product as Microsoft Sentinel in November 2021.