Audit Log for Microsoft Sentinel Data Lake and Graph in Microsoft Purview Portal
Developer and API
Updated Microsoft Defender documentation in sentinel/datalake/auditing-lake-activities.md.
Product
Microsoft Sentinel
Track documentation and Message Center changes for Microsoft Sentinel.
Microsoft Learn documentation ↗Latest Microsoft Sentinel changes
Audit Track Tasks
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/audit-track-tasks.md.
Create Analytics Rules
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/create-analytics-rules.md.
Create and Manage Jupyter Notebook Jobs
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/notebook-jobs.md.
Create ASIM parsers using AI agent skills in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-create-parsers-ai-agent.md.
Create scheduled analytics rules from templates
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/create-analytics-rule-from-template.md.
Custom Graphs in Microsoft Sentinel Overview (Preview)
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/custom-graphs-overview.md.
Customer Managed Keys
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/customer-managed-keys.md.
Entity Behaviors Layer
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/entity-behaviors-layer.md.
Forward Syslog Monitor Agent
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/forward-syslog-monitor-agent.md.
Get Started with Custom Graphs in Microsoft Sentinel (Preview)
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/create-custom-graphs.md.
Identify Threats With Entity Behavior Analytics
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/identify-threats-with-entity-behavior-analytics.md.
KQL Jobs, Summary Rules, and Search Jobs
Hunting and detection
Updated Microsoft Defender documentation in sentinel/datalake/kql-jobs-summary-rules-search-jobs.md.
Manage custom content with repository connections
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/ci-cd-custom-content.md.
Monitor Analytics Rule Integrity
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/monitor-analytics-rule-integrity.md.
Normalization Ingest Time
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-ingest-time.md.
Onboard to Microsoft Sentinel Data Lake and Graph
Developer and API
Updated Microsoft Defender documentation in sentinel/datalake/sentinel-lake-onboarding.md.
Running Notebooks on the Microsoft Sentinel Data Lake
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/notebooks.md.
Sample KQL Queries for Microsoft Sentinel Data Lake
Hunting and detection
Updated Microsoft Defender documentation in sentinel/datalake/kql-sample-queries.md.
Sap Btp Solution Overview
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/sap/sap-btp-solution-overview.md.
Scheduled analytics rules in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/scheduled-rules-overview.md.
Sentinel Integration Guide
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/isv/sentinel-integration-guide.md.
Sentinel Mcp Data Exploration Tool
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/sentinel-mcp-data-exploration-tool.md.
Set Up Connectors for the Microsoft Sentinel Data Lake
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/sentinel-lake-connectors.md.
Set Up Federated Data Connectors in Microsoft Sentinel Data Lake
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/data-federation-setup.md.
Skill Up Resources
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/skill-up-resources.md.
Threat Detection
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/threat-detection.md.
Troubleshoot KQL Queries for the Data Lake
Hunting and detection
Updated Microsoft Defender documentation in sentinel/datalake/kql-troubleshoot.md.
Unified Connector Syslog Device
Developer and API
Updated Microsoft Defender documentation in sentinel/unified-connector-syslog-device.md.
Use Federated Data Sources in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/using-data-federation.md.
Customer Managed Keys
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/customer-managed-keys.md.
Enable Entity Behavior Analytics
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/enable-entity-behavior-analytics.md.
Add Advanced Conditions To Automation Rules
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/add-advanced-conditions-to-automation-rules.md.
Advanced Security Information Model (ASIM) helper functions
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-functions.md.
Advanced Security Information Model (ASIM) known issues
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-known-issues.md.
Advanced Security Information Model (ASIM) schemas
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-about-schemas.md.
Advanced Security Information Model (ASIM) security content
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-content.md.
Audit Microsoft Sentinel queries and activities
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/audit-sentinel-data.md.
Audit Track Tasks
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/audit-track-tasks.md.
Automate threat response in Microsoft Sentinel with automation rules
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/automate-incident-handling-with-automation-rules.md.
Automation in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/automation/automation.md.
Bring your own ML into Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/bring-your-own-ml.md.
Ci Cd Custom Content
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/ci-cd-custom-content.md.
Collaborate In Microsoft Teams
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/collaborate-in-microsoft-teams.md.
Collect data from Cisco Secure Firewall devices with ASA or FTD connectors
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/cisco-ftd-firewall.md.
Compare Analytics Rules Custom Detections
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/compare-analytics-rules-custom-detections.md.
Configure Data Transformation
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/configure-data-transformation.md.
Configure multistage attack detection (Fusion) rules in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/configure-fusion-rules.md.
Configure table settings in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/manage-table-tiers-retention.md.
Configure the Security Events or Windows Security Events connector for anomalous RDP login detection
Developer and API
Updated Microsoft Defender documentation in sentinel/configure-connector-login-detection.md.
Connect Aws Configure Environment
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/connect-aws-configure-environment.md.
Connect Azure Active Directory
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/connect-azure-active-directory.md.
Connect Microsoft Sentinel to Amazon Web Services to ingest AWS WAF logs
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/connect-aws-s3-waf.md.
Convert dashboards to Azure Workbooks in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-convert-dashboards.md.
Create a Power BI report from Microsoft Sentinel data
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/powerbi.md.
Create and use Microsoft Sentinel automation rules to manage response
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/create-manage-use-automation-rules.md.
Create ASIM parsers using an AI agent in Microsoft Sentinel
Cloud and workloads
Added Microsoft Defender documentation in sentinel/normalization-create-parsers-ai-agent.md.
Create basic automation rules with Simple Flows in the Microsoft Defender portal (preview)
Cloud and workloads
Added Microsoft Defender documentation in sentinel/automation/create-basic-automation-rules-simple-flows.md.
Create Custom Connector
Developer and API
Updated Microsoft Defender documentation in sentinel/create-custom-connector.md.
Create custom hunting queries in Microsoft Sentinel
Hunting and detection
Updated Microsoft Defender documentation in sentinel/hunts-custom-queries.md.
Create deep links to Microsoft Sentinel graph queries
Developer and API
Added Microsoft Defender documentation in sentinel/datalake/create-deep-links-graph-queries.md.
Create incident tasks in Microsoft Sentinel using automation rules
Incidents and response
Updated Microsoft Defender documentation in sentinel/create-tasks-automation-rule.md.
Create Incidents From Alerts
Identity protection
Updated Microsoft Defender documentation in sentinel/create-incidents-from-alerts.md.
Customer intent: As a Microsoft Defender Portal administrator or subscription owner, I want to configure log table tiers and data retention settings…
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/manage-data-overview.md.
Customer intent: As a security engineer or data scientist, I want to explore and analyze security data in the Microsoft Sentinel data lake using Jupy…
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/notebook-jobs.md.
Customer intent: As a security engineer or data scientist, I want to explore and analyze security data in the Microsoft Sentinel data lake using Jupy…
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/datalake/notebooks-overview.md.
Customer intent: As an administrator I want to onboard to the Microsoft Sentinel data lake from my Defender portal so that I can benefit from the sto…
Architecture and deployment
Updated Microsoft Defender documentation in sentinel/datalake/sentinel-lake-onboard-defender.md.
Customize repository deployments
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/ci-cd-custom-deploy.md.
Delete incidents in Microsoft Sentinel in the Azure portal
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/delete-incident.md.
Delete installed Microsoft Sentinel out-of-the-box content and solutions
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/sentinel-solutions-delete.md.
Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel (Community supported)
Architecture and deployment
Updated Microsoft Defender documentation in sentinel/monitor-key-vault-honeytokens.md.
Deploy content as code from your repository
Architecture and deployment
Updated Microsoft Defender documentation in sentinel/ci-cd.md.
Develop Microsoft Sentinel Advanced Security Information Model (ASIM) parsers
Cloud and workloads
Added Microsoft Defender documentation in sentinel/normalization-develop-parsers.md.
Discover and manage Microsoft Sentinel out-of-the-box content
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/sentinel-solutions-deploy.md.
Edit watchlists - Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/watchlists-manage.md.
Enable Attack Disruption Actions on AWS with Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/aws-disruption.md.
Enable Entity Behavior Analytics
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/enable-entity-behavior-analytics.md.
Enable Microsoft Sentinel SIEM and initial features and content
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/enable-sentinel-features-content.md.
Enable Storage Network Security
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/enable-storage-network-security.md.
Enroll Simplified Pricing Tier
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/enroll-simplified-pricing-tier.md.
Entity Behaviors Layer
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/entity-behaviors-layer.md.
Export historical data from Splunk
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-splunk-historical-data.md.
Find your Microsoft Sentinel data connector
Developer and API
Updated Microsoft Defender documentation in sentinel/data-connectors-reference.md.
Generate Playbook
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/automation/generate-playbook.md.
Get fine-tuning recommendations for your analytics rules in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/detection-tuning.md.
Get started with Jupyter notebooks and MSTICPy in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/notebook-get-started.md.
Graph Visualization
Developer and API
Updated Microsoft Defender documentation in sentinel/datalake/graph-visualization.md.
Handle false positives in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/false-positives.md.
Handle ingestion delay in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/ingestion-delay.md.
Hunting capabilities in Microsoft Sentinel
Hunting and detection
Updated Microsoft Defender documentation in sentinel/hunting.md.
Import and export Microsoft Sentinel analytics rules
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/import-export-analytics-rules.md.
Import and export Microsoft Sentinel automation rules
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/import-export-automation-rules.md.
Ingest Defender For Cloud Incidents
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/ingest-defender-for-cloud-incidents.md.
Ingest time normalization
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-ingest-time.md.
Investigate incidents with Microsoft Sentinel (legacy)
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/investigate-cases.md.
Investigate incidents with UEBA data
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/investigate-with-ueba.md.
Investigate Large Datasets
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/investigate-large-datasets.md.
Investigate Microsoft Sentinel incidents in depth in the Azure portal
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/investigate-incidents.md.
List of Microsoft Sentinel Advanced Security Information Model (ASIM) parsers
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-parsers-list.md.
Manage Advanced Security Information Model (ASIM) parsers
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-manage-parsers.md.
Manage hunting queries in Microsoft Sentinel using REST API
Hunting and detection
Updated Microsoft Defender documentation in sentinel/hunting-with-rest-api.md.
Manage multiple tenants in Microsoft Sentinel as a Managed Security Service Provider
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/multiple-tenants-service-providers.md.
Manage template versions for your scheduled analytics rules in Microsoft Sentinel
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/manage-analytics-rule-templates.md.
Manage your SOC better with incident metrics in Microsoft Sentinel
Incidents and response
Updated Microsoft Defender documentation in sentinel/manage-soc-with-incident-metrics.md.
Map data fields to Microsoft Sentinel entities
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/map-data-fields-to-entities.md.
Microsoft 365 Defender Sentinel Integration
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/microsoft-365-defender-sentinel-integration.md.
Microsoft Sentinel Advanced Security Information Model (ASIM) parsers overview
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/normalization-parsers-overview.md.
Microsoft Sentinel automation rules reference
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/automation-rule-reference.md.
Microsoft Sentinel content hub catalog
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/sentinel-solutions-catalog.md.
Microsoft Sentinel entity types reference
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/entities-reference.md.
Microsoft Sentinel in the Microsoft Defender portal
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/microsoft-sentinel-defender-portal.md.
Microsoft Sentinel migration: Export ArcSight data to target platform
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-arcsight-historical-data.md.
Microsoft Sentinel migration: Export QRadar data to target platform
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-qradar-historical-data.md.
Microsoft Sentinel migration: Ingest data into target platform
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-export-ingest.md.
Microsoft Sentinel migration: Select a data ingestion tool
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-ingestion-tool.md.
Microsoft Sentinel migration: Update SOC and analyst processes
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/migration-security-operations-center-processes.md.
Microsoft Sentinel network normalization schema (Legacy version - Public preview)
Developer and API
Updated Microsoft Defender documentation in sentinel/normalization-schema-v1.md.
Microsoft Sentinel SOAR content catalog
Cloud and workloads
Updated Microsoft Defender documentation in sentinel/sentinel-soar-content.md.