LAYER 1 — DATA SOURCES (What generates logs)
RAW LOG SOURCES
🖥️
Endpoints & VMs
Windows, Linux, Azure VMs, on-prem servers
COMPUTE
🌐
Network Devices
Firewalls, NSGs, VPN Gateways, routers
NETWORK
🔑
Azure AD / Entra ID
Sign-in logs, audit logs, risky users
IDENTITY
📧
Microsoft 365
Exchange, Teams, SharePoint, Defender
SaaS
🔌
3rd Party Apps
Palo Alto, Okta, AWS, GCP, custom apps
EXTERNAL
logs & events ingested via connectors
LAYER 2 — DATA CONNECTORS (The ingestion bridge)
DATA CONNECTORS
⚡
Microsoft Native Connectors
Azure AD, Defender, M365, Activity Logs — 1-click enable
BUILT-IN
📡
CEF / Syslog
Linux agent forwards Syslog/CEF from firewalls, appliances
AGENT-BASED
🔗
REST API / DCR
Data Collection Rules push custom log formats via HTTPS
CUSTOM
🛍️
Content Hub Connectors
AWS, GCP, Okta, Palo Alto, Cisco — from Sentinel marketplace
MARKETPLACE
LAYER 3 — LOG ANALYTICS WORKSPACE (The database engine)
LOG ANALYTICS WORKSPACE (LAW)
Core Storage Engine — All logs land here first
📋
Log Tables
SecurityEvent, SigninLogs, AzureActivity, CommonSecurityLog, Syslog...
TABLES
🔍
KQL Query Engine
Kusto Query Language — search, filter, aggregate, join log data
KQL
🗄️
Data Retention
Hot tier (interactive), Cold tier (archive) — cost-controlled retention
STORAGE
⚙️
Data Collection Rules (DCR)
Filter, transform, and route data before it hits the workspace. Reduce cost by dropping noise.
TRANSFORM
💰
Ingestion & Pricing
Pay-per-GB or Commitment Tiers. Basic Logs tier for high-volume, low-priority data.
BILLING
Sentinel sits on top of LAW and adds SIEM/SOAR capabilities
LAYER 4 — MICROSOFT SENTINEL (The SIEM + SOAR engine)
⚔️ MICROSOFT SENTINEL
SIEM · SOAR · THREAT INTELLIGENCE · AI/ML
📏
Analytics Rules
Scheduled KQL queries, Microsoft rules, ML-based anomaly detection, NRT (near real-time)
DETECTION
🚨
Incidents
Alerts grouped into incidents. Assigned to analysts. Tracks investigation status.
TRIAGE
🗺️
Investigation Graph
Visual map of entities, alerts, and relationships for an incident
INVESTIGATE
🎯
Threat Intelligence
IOC matching — IPs, domains, file hashes from MDTI and 3rd party TI feeds
TI MATCHING
🧩
Entity Behavior (UEBA)
Builds behavioral baselines for users, hosts, IPs. Scores anomalies automatically.
UEBA
🔭
Hunting
Pre-built and custom KQL hunting queries. Livestream. Bookmark findings.
HUNT
automated response & analyst workflow
LAYER 5 — SOAR & AUTOMATION (Respond automatically)
AUTOMATION & RESPONSE
🤖
Automation Rules
Auto-assign, auto-close, or trigger playbooks based on incident conditions
ORCHESTRATE
▶️
Playbooks (Logic Apps)
Azure Logic Apps workflows — block IP, disable user, send Teams alert, create ticket
PLAYBOOK
🔄
Logic App Connectors
ServiceNow, Jira, Slack, Teams, email — 400+ connectors available
INTEGRATE
🧠
Microsoft Copilot for Security
AI assistant — summarize incidents, explain KQL, suggest remediation steps
AI/ML
analyst workbench & reporting
LAYER 6 — ANALYST WORKBENCH (What analysts see and use daily)
ANALYST FRONT-END TOOLS
📊
Workbooks
Azure Monitor Workbooks — custom dashboards, charts, visual reports from KQL
DASHBOARDS
📬
Watchlists
Upload CSV lists (VIP users, trusted IPs, asset inventory) to enrich alerts
ENRICH
📓
Notebooks (Jupyter)
Python + KQL in Jupyter notebooks for advanced threat hunting and data science
ADVANCED
📦
Content Hub
Install solution packs: connectors + rules + workbooks + playbooks bundled together
SOLUTIONS
SUPPORTING AZURE SERVICES (Infrastructure Sentinel depends on)
AZURE PLATFORM DEPENDENCIES
🔐
Azure Key Vault
Store connector API keys, playbook secrets, and credentials securely
SECRETS
👤
Azure RBAC
Sentinel Reader, Responder, Contributor roles — control analyst permissions
ACCESS
💾
Azure Storage / ADX
Archive logs to Storage Account or Azure Data Explorer for long-term retention
ARCHIVE
📝
Azure Activity Log
Audit trail for all Sentinel config changes, rule edits, playbook runs
AUDIT
LAYER LEGEND
Sentinel Core / Analyst Tools
Azure Platform Dependencies
Hover over any card for more detail