Microsoft Sentinel Analytics & Incidents

Location

Description

SIEM platform aggregating logs from all Microsoft and third-party sources with built-in analytics rules generating security incidents, entity mapping to users/hosts/IPs, investigation graphs, and automated response playbooks.

Forensic Value

Sentinel incidents aggregate related alerts from multiple detection sources into unified investigations with entity mapping. The investigation graph visually maps relationships between users, IPs, hosts, and alerts. Built-in analytics rules detect common attack patterns across log sources. Bookmarked hunting query results preserve evidence found during proactive threat hunting. Watchlists and threat intelligence indicators provide IOC matching across all ingested data sources.

Tools Required

Collection Commands

SecurityIncident | where TimeGenerated > ago(30d) | where Status != "Closed" | project TimeGenerated, Title, Severity, Status, Owner, ProviderName | sort by TimeGenerated desc

SecurityAlert | where TimeGenerated > ago(7d) | summarize AlertCount=count() by AlertName, ProviderName | sort by AlertCount desc | take 25

az sentinel incident list --workspace-name <workspace> --resource-group <rg-name> --query "[?properties.status!='Closed']" --output json > open_incidents.json

MITRE ATT&CK Techniques