4.3. Capabilities of Microsoft Sentinel
💡 First Principle: As an environment grows, security signals pour in from dozens of separate systems — firewalls, identity logs, endpoint alerts, cloud posture findings — and no human can manually correlate all of them fast enough, so Microsoft Sentinel exists as a cloud-native platform that collects all of that data centrally, correlates it into meaningful incidents, and can automatically trigger a response.
Why care: an attack rarely shows up as one single, obvious alert — it's usually a pattern spread across multiple systems (an unusual sign-in here, a suspicious process there) that only becomes obvious when correlated together. Sentinel exists specifically to do that correlation at a scale and speed no manual process can match.
Where you use it: Microsoft Sentinel now runs in the Microsoft Defender portal, either alongside Defender XDR or on its own, giving one security operations experience across SIEM and XDR. New Sentinel workspaces are onboarded to the Defender portal automatically; older material that shows Sentinel only in the Azure portal describes the previous experience.
⚠️ Common Misconception: Thinking Sentinel is "just" a log search tool. The two subsections below unpack why it's both a SIEM and a SOAR platform in one.
