Microsoft Sentinel
Log and alert platforms (SIEM) — Microsoft
What is this product?
A cloud SIEM that needs no on-premise hardware. You query it with KQL — the same language used across Microsoft's other security products, which makes learning it doubly useful.
About the company
Microsoft offers a full security stack inside Azure; Sentinel is its cloud-native SIEM and integrates directly with Defender and Entra ID.
What does an analyst do inside it?
- Opens the Incident and reviews the alerts grouped inside it.
- Writes a KQL query such as `Events | where Computer == "..."`.
- Uses `summarize count() by` to condense the results.
- Sets severity and assigns the incident, or closes it.
Its search language
These examples are written in the syntax the product itself accepts.
- Events | where Computer == "FIN-WS-014"
- Events | where EventResult == "failure" | summarize count() by AccountName
The field names it uses
- SourceType
- Computer
- AccountName
- SrcIpAddr
- DstIpAddr
- ActionName
- EventResult
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
The fastest-growing option, especially at Microsoft 365 shops. KQL now appears in most cloud SOC job postings.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.