Introduction

Microsoft Sentinel stands as a robust, cloud-native platform offering a comprehensive suite of capabilities including Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR). At its core, Microsoft Sentinel enables security teams with unparalleled threat visibility, proactive hunting capabilities, and efficient threat response mechanisms.

SIEM, or Security Information and Event Management, serves as the backbone of Microsoft Sentinel, enabling the collection, aggregation, and analysis of security event data from various sources. This data is then processed through advanced analytics to identify potential threats and anomalies within an organization’s IT environment.

In parallel, SOAR, or Security Orchestration, Automation, and Response, automates and streamlines security operations, enabling teams to respond rapidly and effectively to security incidents. By automating repetitive tasks and orchestrating workflows, SOAR enhances the efficiency of incident response processes and reduces the burden on security personnel.

Microsoft Sentinel works according to the below cycle that starts with log management, continues to schema normalization, data validation, detection and investigation.

Setup Instructions

Login to Microsoft Sentinel by following the below steps:

• Find the credentials that you received with the Lab details under the Sentinel Portal Section.
• Visit Microsoft Sentinel and login using your credentials.