Microsoft Sentinel explained for exams
Microsoft Sentinel is Microsoft’s cloud-native SIEM (it collects security data, detects threats and groups alerts into incidents) with SOAR abilities (automation rules and playbooks respond to them). The decision rule: if a question says collect and correlate logs from many sources, detect with queries, investigate incidents and automate the response, the answer is Sentinel; if it says protect one workload and give recommendations on its configuration, the answer is a Defender product. Sentinel stores its data in a Log Analytics workspace and you query it with KQL.
The pipeline, one stage at a time
Think of Sentinel as five stages. Each stage has its own exam vocabulary.
1. Collect. Data connectors bring logs in. Microsoft sources such as Microsoft Entra ID and Azure Activity have out-of-the-box connectors, and Sentinel also accepts Common Event Format (CEF), Syslog and REST API sources. Content hub solutions package connectors, rules and workbooks together. A data collection rule can filter or transform data before it is stored, which is how you reduce cost. Normalization with ASIM translates different sources into one common schema at query or ingestion time.
2. Detect. Analytics rules run queries over the data and raise alerts. Microsoft lists four rule types (scheduled, NRT, anomaly and Microsoft security) plus specialized templates that each create a single rule, such as threat intelligence and Fusion:
| Rule type | What it does | Exam hook |
|---|---|---|
| Scheduled | A KQL query runs at an interval over a lookback period and alerts past a threshold | The most common; use for joins and longer lookbacks |
| Near-real-time (NRT) | A limited form of scheduled rule that runs once a minute | “Detect within about a minute” |
| Anomaly | Machine learning builds a baseline and records deviations in the Anomalies table; it does not raise alerts on its own | Context for hunting and detections |
| Microsoft security | Creates incidents from alerts of other Microsoft security products | Not available when Defender XDR incident integration or the Defender portal is used, because Defender XDR creates those incidents |
| Threat intelligence | Matches CEF, Syslog and Windows DNS events against Microsoft threat indicators | One non-customizable rule |
| Fusion | Correlates many low-fidelity alerts into multistage attack incidents | Enabled by default; also unavailable under Defender XDR incident creation |
Microsoft’s detection page also states that custom detections are now the recommended way to create new rules across Sentinel and Defender XDR, so expect questions to mention both. Rule templates from the content hub are the starting point; you can customize most of them.
3. Group. Alerts are aggregated and correlated into incidents, the case files an analyst assigns and investigates. Entities such as users, hosts and IPs link the evidence, and a graph shows how they connect.
4. Investigate. Use incidents, hunting queries (proactive searches before any alert fires), watchlists (your own lists, for example high-value assets or departed staff, joined to events) and workbooks for visual reports. Notebooks extend this with Jupyter. See the KQL cheat sheet for the language behind every one of these.
5. Respond. An automation rule acts inside Sentinel without code: assign an owner, change severity or status, add a tag, close a noisy incident, or start a playbook. A playbook is an Azure Logic Apps workflow that calls other systems, for instance opening a ServiceNow ticket or blocking a user. Rule of thumb for questions: simple triage inside Sentinel is an automation rule; talking to another system is a playbook, usually started by an automation rule.
Where you use it: portal change to know
Microsoft states that after March 31, 2027 Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. It is already generally available there, including for customers without Defender XDR or an E5 licence. New customers onboarding their first workspace from July 2025 are automatically onboarded to the Defender portal when they hold sufficient permissions. Exam outlines and question wording can lag behind such changes, so learn what a feature does and where either portal exposes it. For the wider picture of SIEM, SOAR and XDR, read SIEM vs SOAR vs XDR, and for how Sentinel sits beside the Defender products, Defender XDR vs Defender for Cloud.
A worked example: impossible travel to ticket
A bank connects the Microsoft Entra ID sign-in logs and its firewall’s CEF feed. The goal: when a user signs in from two distant countries within an hour, raise an incident, mark it high severity, assign it to the identity team and open a ticket.
- Connect both sources through the content hub solutions. A data collection rule drops firewall noise the team will never query.
- Enable a scheduled analytics rule template for the sign-in pattern, mapping the user and IP as entities. Set the schedule and lookback so it covers the one-hour window. If the team wants a one-minute response and the query is simple, an NRT rule fits instead.
- The rule raises an alert, which becomes an incident.
- An automation rule triggers on new incidents from that rule: set severity High, assign the identity team, then run a playbook.
- The playbook, built in Logic Apps, creates the ticket in the bank’s service desk system.
No step required the analyst to be awake, yet a person still investigates the incident. Automation removes routine handling; it is not a replacement for investigation. The overall flow matches the incident response lifecycle.
Which exams test this
| Exam | How it appears | Where it is covered here |
|---|---|---|
| SC-200 | Core in all three domains. Manage a security operations environment (40–45%): roles, retention, workbooks, data connectors, analytics rules, automation rules and playbooks; Respond to security incidents (35–40%): investigate Sentinel incidents; Perform threat hunting (20–25%): hunting queries, Data lake KQL jobs and notebooks | Manage a security operations environment, Respond to incidents, Perform threat hunting |
| SC-500 | Manage and monitor security posture (20–25%): create workspaces, assign roles, use content hub solutions, collect Syslog, CEF and Windows Security events, create custom tables, set up automation rules and playbooks, and manage retention | Security posture |
| SC-900 | Capabilities of Microsoft security solutions (35–40%): define SIEM and SOAR and describe Sentinel’s threat detection and mitigation, at concept level | Security solutions |
SC-200 and SC-900 rows follow the English outlines that take effect on October 21, 2026, which Microsoft describes as minor changes.
How exam questions are built around it
Questions describe an operational need and ask for the smallest Sentinel feature that meets it. The deciding words are usually timing and effort. “Within a minute” points to an NRT rule; “no code” or “assign and close automatically” to an automation rule; “call a third-party system” to a playbook; “data from a Linux appliance” to Syslog or CEF through the Azure Monitor Agent; “reduce ingestion cost” to a data collection rule or a cheaper tier. Common traps: choosing a playbook for a task an automation rule handles, picking an anomaly rule when the question needs an alert (anomaly rules do not raise their own), and confusing the Microsoft security rule with a scheduled one. For logging foundations, see Azure Monitor and Log Analytics.
Question 1. Every time Sentinel raises a low-severity incident from a specific noisy rule, the team wants it closed with a comment and no one notified. No external system is involved. What should you create?
- A. A playbook built in Azure Logic Apps
- B. An automation rule that closes matching incidents
- C. A watchlist containing the rule name
- D. A hunting query saved as a bookmark
Show answer
Answer: B
An automation rule runs inside Sentinel without code and can change status, add a comment or close incidents when conditions match. A playbook is an Azure Logic Apps workflow and is more than needed when no external system is called. A watchlist stores reference data and does not act on incidents. A hunting query searches data and does not respond to incidents.
Question 2. You need an analytics rule that evaluates a simple query about a critical account approximately every minute, to alert as quickly as possible. Which rule type should you create?
- A. An anomaly rule
- B. A Microsoft security rule
- C. A near-real-time (NRT) rule
- D. A threat intelligence rule
Show answer
Answer: C
Near-real-time rules are a limited subset of scheduled rules that run once every minute, designed for the freshest detections on simple queries. A threat intelligence rule only matches events against Microsoft threat indicators and cannot run your own query. An anomaly rule records deviations in the Anomalies table instead of raising alerts. A Microsoft security rule only turns alerts from other Microsoft products into incidents.