Microsoft Sentinel Investigation Agent
Inside the architecture of an autonomous AI agent that investigates Microsoft Sentinel incidents end to end — how it plans, queries, validates, and reports.
-
-
Syslog Forwarding to Microsoft Sentinel: The Deep-Dive
What actually happens between a syslog daemon and the Syslog table in Log Analytics – DCR facility and severity filtering, the rsyslog and syslog-ng configs AMA installs, the localhost:28330 hop, TLS, forwarder sizing, and the commands to prove data is flowing.
-
Advanced KQL Techniques for Microsoft Sentinel
Six advanced KQL operators every Sentinel analyst should know beyond basic filtering and joins – mv-expand, parse, bag_unpack, arg_max, materialize, and time-series anomaly detection.
-
Microsoft Defender for Cloud vs Microsoft Sentinel: What’s the Difference
A clear comparison of Microsoft Defender for Cloud and Microsoft Sentinel — what each product does, where they overlap, and how they work together in a mature security architecture.
-
KQL for Beginners: Learn Kusto Query Language from Zero in Microsoft Sentinel
A beginner’s guide to KQL covering filtering, aggregation, joins, and string operations — with practical examples using real Sentinel tables.
-
Incident Response in Microsoft Sentinel: A Practical SOC Analyst’s Workflow
A structured, repeatable incident response workflow for Microsoft Sentinel — from triage and investigation through containment, documentation, and closure.
-
Microsoft Sentinel Watchlists: The Complete Guide to Dynamic Detection Lists
How to create and use Sentinel watchlists for dynamic allow-listing, IOC matching, and alert enrichment — with practical KQL examples and automation patterns.
-
ASIM Normalisation in Microsoft Sentinel: A Complete Practical Guide
How ASIM works in Microsoft Sentinel, the key schemas, how to use parsers in KQL queries, and how to write custom parsers for your own data sources.
-
UEBA in Microsoft Sentinel: How to Use User and Entity Behaviour Analytics Effectively
How UEBA works in Microsoft Sentinel, what data it requires, and how to integrate it into detection and investigation workflows for measurably better outcomes.
-
SOC Analyst Roadmap 2026: From Zero to Microsoft Sentinel Expert
A structured step-by-step career roadmap for becoming a proficient SOC analyst with deep Microsoft Sentinel expertise — built from real-world experience.
