Microsoft Security Operations Analyst — knowledge map
The 36 core concepts of Microsoft Security Operations Analyst and how they connect. Click a node in the map above to explore related terms and prerequisites; the list below indexes every concept with its definition and links to its prerequisites and related concepts.
Concepts (36)
Microsoft Defender XDR
Unifies protection across endpoints/email/identity/SaaS, correlating signals across domains (Endpoint/Office 365/Identity/Cloud Apps).
Microsoft Sentinel
A cloud-native SIEM + SOAR that collects logs and detects, investigates, and auto-responds to threats.
Threat protection and threat intelligence
Capabilities for detecting, analyzing, and responding to attacks. Microsoft Defender XDR unifies signals across domains to deliver extended detection and response (XDR).
Prerequisites: Microsoft Defender XDR
Automation level (Defender for Endpoint)
A per-device-group setting in Defender for Endpoint that decides whether remediation actions found by automated investigation (file quarantine, process termination, etc.) are auto-approved and executed, or queued in the Action center awaiting human approval. Leaning fully automatic speeds response but raises the risk of a wrong remediation.
Related: Alert tuning
Microsoft Defender for Cloud
Scores security posture (Secure Score) and detects misconfigurations/threats to recommend fixes.
Prerequisites: Microsoft Defender XDR
Live response
An interactive incident-response capability in Microsoft Defender for Endpoint that opens a remote shell to a device to fetch files, stop processes, or run scripts on the spot. Live-response permissions can be separated via RBAC, and every action is logged for later audit.
Prerequisites: Microsoft Defender XDR
Automated investigation and response (AIR)
A Defender XDR feature that auto-runs an investigation triggered by an alert, identifies affected entities, and proposes/executes remediation (isolate, stop process). Auto vs await-approval is set by the automation level; pending actions are approved in the Action center.
Prerequisites: Automation level (Defender for Endpoint)、Microsoft Defender XDR
Custom detection rules (Defender XDR)
A Defender XDR rule that promotes an Advanced Hunting KQL query into scheduled repeated detection + response actions (isolate/disable). The query must return appropriate entity columns to generate alerts/incidents. A different platform from Sentinel analytics rules.
Prerequisites: Microsoft Defender XDR、Advanced hunting (KQL)、Microsoft Sentinel
Data lake tier (Sentinel)
A Sentinel data-retention tier for low-cost long-term storage of large data, used for later exploration. Distinct from the costly Analytics tier (frequent detection/investigation). Explored in batch via KQL jobs.
Prerequisites: Microsoft Sentinel
Related: KQL jobs (Data lake)
Advanced hunting (KQL)
Uses KQL in Defender XDR / Sentinel to proactively hunt threats across telemetry, turning queries into analytics rules for automated detection.
Prerequisites: Microsoft Defender XDR、Microsoft Sentinel
Alert tuning
In Microsoft Defender XDR, rules (formerly called suppression rules) that automatically resolve or suppress alerts matching known-benign activity or false-positive patterns under specified conditions. Reduces noise from org-specific legitimate behavior (e.g., approved tools) so analysts focus on real threats.
Prerequisites: Microsoft Defender XDR
Microsoft Entra ID
Cloud identity/access management (formerly Azure AD) providing MFA/SSO/Conditional Access; distinct from on-prem AD DS.
Hunting graph
"Hunting graph" is an official feature within Microsoft Defender advanced hunting. It visualizes entities (devices, users, IP addresses, etc.) and their relationships as nodes and edges, rendering threat scenarios as interactive graphs to make it easier to trace chains of attack. It's a visualization layer over KQL query results that helps analysts manually follow how a compromise spread.
Prerequisites: Microsoft Defender XDR、Advanced hunting (KQL)
KQL (Kusto Query Language)
A read-only query language for fast search/aggregation over log/time-series data; used with Eventhouse/KQL databases.
Log Analytics workspace
A data store that aggregates and retains logs/metrics from various resources. Queried with KQL (Kusto Query Language) for analysis, and underlies Microsoft Sentinel and Azure Monitor alerts. Access control and retention (default 30 days, extendable) are set per workspace.
Prerequisites: KQL (Kusto Query Language)、Microsoft Sentinel
Microsoft Teams
A collaboration hub for chat, meetings, calls, and teamwork; files are stored behind the scenes in SharePoint/OneDrive.
Prerequisites: OneDrive
Related: SharePoint
Azure Monitor Agent (AMA)
The standard log-collection agent (successor to MMA/Log Analytics agents); collection is defined declaratively by data collection rules (DCR). Windows security events via Windows Security Events via AMA, structured device logs via CEF via AMA, generic Syslog via Syslog via AMA.
Prerequisites: Data collection rules (DCR)
Sentinel analytics-rule types
Four types: scheduled (flexible periodic KQL, most detection), near-real-time (NRT, ~1 min), threat intelligence (match ingested IOCs against logs), and machine learning (Fusion correlates multistage attacks). Anomalies (deviation from normal) complement them.
Prerequisites: Threat protection and threat intelligence、Microsoft Sentinel
Attack story (incident graph)
A Defender XDR feature that visualizes the chain (intrusion→lateral movement→exfiltration) of complex multistage, multi-domain attacks, letting you grasp the whole picture entity-first—used with Security Copilot summaries.
Prerequisites: Microsoft Defender XDR、Incident management and investigation、Microsoft Security Copilot
Summary rules (Sentinel)
A Sentinel mechanism that pre-aggregates large raw logs into small summary tables, keeping frequent queries fast and low-cost. Distinct in role from analytics rules, which detect threats.
Prerequisites: Microsoft Sentinel
Threat analytics (Defender XDR)
Threat reports from Microsoft security research about ongoing campaigns and new techniques—showing affected assets, recommended actions, and related detection/hunting queries—used to check whether your org is affected and to hunt proactively.
Prerequisites: Microsoft Defender XDR
Data collection rules (DCR)
Rules in Microsoft Sentinel/Azure Monitor defining what is collected from which sources. Used to collect Windows Security events; many servers can be aggregated first via Windows Event Forwarding (WEF).
Prerequisites: Windows Event Forwarding (WEF)、Microsoft Sentinel
UEBA and threat intelligence
UEBA (user/entity behavior analytics) detects deviations from baseline, correlated with threat intelligence (IoCs, MITRE ATT&CK) to identify advanced attacks.
Prerequisites: Threat protection and threat intelligence
Diagnostic settings
Configuration that routes a resource's logs/metrics to a destination (Log Analytics workspace, storage account for long-term archive, or Event Hub for external SIEM integration). Resource logs are not aggregated by default unless diagnostic settings route them—unlike the activity log, which is recorded automatically per subscription. Data collection rules (DCRs) let you fine-tune what's collected and how it's transformed.
Prerequisites: Log Analytics workspace
Microsoft Entra ID Protection
Computes user/sign-in risk from leaked credentials, impossible travel, etc., integrating with Conditional Access.
Prerequisites: Microsoft Entra ID
Investigation package
A Defender for Endpoint feature that bulk-collects forensic data from a device (running processes, network connections, registry, autoruns, logs, etc.). Unlike the interactive shell of live response, it non-interactively gathers a fixed set of items in one pass for investigation.
Prerequisites: Live response
Microsoft Defender for Cloud Apps
A CASB (cloud access security broker) that discovers and controls cloud-app usage and shadow IT.
Prerequisites: Microsoft Defender for Cloud、Microsoft Defender XDR
OneDrive
Personal cloud file storage and sync—keep your own files and share as needed (SharePoint is for org sharing).
Prerequisites: SharePoint
Automatic attack disruption
A Defender XDR feature that, the instant it detects a high-confidence in-progress attack (ransomware, BEC), auto-executes containment (isolate compromised devices, disable compromised accounts). It does not wait for human approval, using XDR cross-domain signals for high confidence.
Prerequisites: Microsoft Defender XDR
KQL jobs (Data lake)
A mechanism to run large-scale KQL queries in batch (not interactively) over big data in the Data lake tier and store the results—used for broad, low-cost exploration on Data lake.
Related: Data lake tier (Sentinel)
Sentinel Graph
Analyzes relationships between entities (users/devices/IPs) as a graph across org-wide data aggregated in Sentinel, revealing cross-cutting connections hard to see in single-table KQL.
Prerequisites: Microsoft Sentinel
SOC optimization
A Microsoft Sentinel feature that analyzes "unused ingestion cost" and "detection coverage gaps vs threats" and recommends data/rule optimizations, continuously improving cost efficiency and detection coverage.
Prerequisites: Microsoft Sentinel
Windows Event Forwarding (WEF)
Forwards events from many Windows servers to a collector (WEC) for aggregation, then ingests into Sentinel via AMA—aggregating by scale instead of an agent on each server.
Prerequisites: Microsoft Sentinel
Incident management and investigation
Correlates related alerts into incidents, investigates via entities, timelines, and attack stories, and drives triage → containment → remediation.
Microsoft Security Copilot
Applies generative AI to security operations (SecOps). Configure a workspace (capacity = SCUs) and permissions/roles, connect data sources/products via plugins, and run SecOps tasks semi-autonomously with Microsoft/Security Store agents—governed with least privilege within the user’s existing permissions.