1.3. XDR and SIEM: Two Halves of One Platform
💡 First Principle: No single sensor sees an entire attack, and no single data store can be both deeply native to every product and open to every source. Microsoft splits the job: an XDR (extended detection and response) delivers deep, product-native detection and automated response for the workloads Microsoft builds, and a SIEM (security information and event management) collects data from anywhere, retains it for as long as you need, and lets you build your own detections and automation. Modern SOCs run both, through one portal.
The exam constantly asks "which product does this?" and the XDR/SIEM split is the reasoning tool that answers it. If the signal comes natively from a Microsoft Defender product and needs immediate containment, think Defender XDR. If the data comes from a firewall, a Linux server, AWS, or a custom app, or must be kept for a year, or needs a custom correlation across sources, think Sentinel.
| Dimension | Microsoft Defender XDR | Microsoft Sentinel |
|---|---|---|
| Core role | Native detection, correlation, and automated response across Microsoft security products | Cloud-native SIEM and security data platform for any source, plus SOAR |
| Data sources | Endpoints, identities, email and collaboration, cloud apps (Defender products) | Hundreds of connectors: Microsoft, third-party, Syslog/CEF, cloud platforms, custom logs |
| Default retention | 30 days in advanced hunting | Configurable per table: analytics tier and data lake tier up to 12 years total |
| Detections | Built-in product detections plus custom detection rules | Analytics rules you configure (scheduled, NRT, threat intelligence, machine learning) |
| Automation | Automated investigation and response, automatic attack disruption | Automation rules and playbooks (Azure Logic Apps) |
| Query language | KQL in advanced hunting | KQL across workspace and data lake tables |
⚠️ Common Misconception: "Defender XDR and Sentinel compete, so a SOC chooses one." They are complementary, and the unified Defender portal operates them together with one incident queue and one hunting experience. A second trap: assuming XDR data lives as long as Sentinel data. Defender XDR's advanced hunting keeps 30 days; longer retention requires sending those tables into Sentinel and setting retention there.
