What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 4 (Domain 4 "Manage and monitor posture": Defender for Cloud = CSPM(recommendations/Secure Score/attack paths/regulatory compliance)-CWP plans-multicloud(AWS/GCP)-Defender Vulnerability Management-EASM; Microsoft Sentinel = workspaces/roles/content hub/data connectors/Syslog-CEF/Windows events(DCR-WEF)/custom tables/automation rules-playbooks/data retention/Purview Audit in Defender XDR; Microsoft Security Copilot = workspaces/permissions-roles/plugins/Microsoft-Security Store agents)
4.2Event collection and automated response with Microsoft Sentinel
Learn Microsoft Sentinel, the cloud-native SIEM/SOAR: workspaces and roles, content hub, data connectors, Syslog/CEF and Windows Security events (data collection rules, WEF), custom log tables, automation rules and playbooks, data retention, and querying Purview Audit in Defender XDR.
The center of "monitoring" posture is Microsoft Sentinel. It provides SIEM (Security Information and Event Management—aggregate and correlate logs to detect threats) and SOAR (Security Orchestration, Automation, and Response—automate post-detection response) cloud-natively. Its foundation is a Log Analytics workspace, where logs from many sources are collected and analyzed with KQL.
4.2.1Workspaces, roles, content hub, and data connectors
Enable Sentinel on a Log Analytics workspace. Assign access with least privilege via Sentinel roles (Reader/Responder/Contributor, etc.). From the content hub, install per-product solutions (bundles of connectors + analytics rules + workbooks + playbooks). Ingest logs via data connectors that connect Azure resources, Microsoft 365, and various cloud/on-prem sources.
4.2.2Syslog/CEF, Windows Security events, and custom tables
Collect Syslog and CEF (Common Event Format) from Linux/network devices. From Windows, ingest Windows Security events using data collection rules (DCR), and for many servers you can aggregate first via Windows Event Forwarding (WEF). For logs that don’t fit standard tables, create custom log tables. The key is designing "which source, via which method, into which table."
4.2.3Automation rules, playbooks, and data retention
Automate response with SOAR. Automation rules handle incident triage (assignment, tags, severity changes, suppression), while playbooks (Azure Logic Apps–based) run the actual actions like "disable the account," "block the IP," or "open a ticket." Design data retention for the active analysis period and archive (long-term, low-cost). You can also query Microsoft Purview Audit from Defender XDR advanced hunting for cross-cutting investigation.
| Goal | Feature | Key point |
|---|---|---|
| Log foundation and access | Log Analytics workspace + Sentinel roles | Assign least privilege |
| Install solutions | Content hub | Connectors + rules + workbooks + playbooks |
| Linux/device logs | Syslog / CEF | Collect in standard formats |
| Windows events | Data collection rules (DCR) / WEF | Aggregate many servers via WEF |
| Incident triage | Automation rules | Assign/tag/severity/suppress |
| Run response actions | Playbooks (Logic Apps) | Disable/block/ticket, etc. |
Watch the mix-ups: (1) SIEM (collect/correlate/detect = Sentinel analytics) vs SOAR (automated post-detection response = automation rules/playbooks). (2) automation rules (incident triage/orchestration) vs playbooks (run real actions via Logic Apps). (3) data connectors (ingestion path), DCR (defines Windows event collection), and content hub (install solutions) are different roles.
Map requirement → feature: "auto-disable an account / block an IP on detection" = playbook; "auto-assign/triage incident severity" = automation rules; "collect Windows Security events" = data collection rules (WEF for many servers); "Linux/device logs" = Syslog/CEF; "install a product’s connector + rule bundle" = content hub.
4.2.4Section summary
- Sentinel = cloud-native SIEM/SOAR; foundation is a Log Analytics workspace; least-privilege via Sentinel roles
- Collection: data connectors, Syslog/CEF, Windows events (DCR/WEF), custom tables; install via content hub
- Response: automation rules (triage) + playbooks (real actions); retention = analysis period + archive; query Purview Audit in Defender XDR
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. On what foundation is Microsoft Sentinel enabled?
Q2. Which Sentinel feature automatically runs real response actions like disabling an account or blocking an IP after detection?
Q3. When collecting security events from many Windows servers, what defines what is collected?
Q4. Which correctly describes the SIEM and SOAR that Microsoft Sentinel provides?
Q5. Where do you install per-product solutions (connectors, analytics rules, workbooks, playbooks) into Sentinel?
Q6. Which Sentinel feature automates incident triage such as assignment, tagging, severity changes, and suppression?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.