azure-sentinel

name	azure-sentinel
description	Expert knowledge for Azure Sentinel development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring data connectors, ASIM/KQL rules, incidents/automation, threat intel feeds, or data lake APIs, and other Azure Sentinel related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Monitor (use azure-monitor), Azure External Attack Surface Management (use azure-external-attack-surface-management).
compatibility	Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata	{"generated_at":"2026-08-09","generator":"docs2skills/1.0.0"}

Azure Sentinel Skill

This skill provides expert guidance for Azure Sentinel. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L37-L51	Diagnosing and fixing ingestion, connector, KQL, notebook, automation, analytics rule, and solution issues in Microsoft Sentinel, plus monitoring rule/automation health.
Best Practices	L52-L72	Operational and configuration guidance for Sentinel: SOC best practices, automation/playbooks, data collection, tuning/false positives, incident tasks, watchlists, anomalies, and solution lifecycle.
Decision Making	L73-L115	Guidance for cost planning/optimization, data tiers/retention, connector and feature choices, and migration from legacy SIEMs and SOAR tools into Microsoft Sentinel and Defender.
Architecture & Design Patterns	L116-L127	Designing Microsoft Sentinel architectures: workspace/tenant layouts, SIEM coexistence, BCDR, solution components, and custom security graph/data lake patterns.
Limits & Quotas	L128-L141	Limits, quotas, pricing, and availability of Sentinel features (NRT rules, data lake, MCP), plus watchlist size/safety, search job timeouts, ASIM issues, and removal implications.
Security	L142-L161	Securing Sentinel: auth/RBAC, playbook access, CMK & data residency, MSSP IP protection, SAP security setup, AWS disruption, MCP tools, storage connector hardening, and auditing data lake/graph.
Configuration	L162-L296	Configuring Microsoft Sentinel: data connectors, ASIM schemas, analytics rules, incidents, automation, data lake, SAP/Cloud integrations, health/audit monitoring, and threat intelligence setup.
Integrations & Coding Patterns	L297-L340	Patterns and code for integrating Sentinel with Logic Apps, MCP/AI tools, TIP/STIX feeds, data lake/graph APIs, KQL/ASIM, Syslog, and building automated playbooks and custom connectors.
Deployment	L341-L354	Deploying and customizing Sentinel solutions: CI/CD for content, ARM-based analytics/automation rules, data lake setup, SAP monitoring migration, and publishing Copilot/SIEM solutions.

Troubleshooting

Topic	URL
Troubleshoot AWS S3 log ingestion connector in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/aws-s3-troubleshoot
Troubleshoot Microsoft Sentinel Azure Storage Blob connector issues	https://learn.microsoft.com/en-us/azure/sentinel/azure-storage-blob-connector-troubleshoot
Troubleshoot Syslog and CEF AMA connectors in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/cef-syslog-ama-troubleshooting
Troubleshoot KQL queries and jobs in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-troubleshoot
Resolve common Jupyter notebook errors in Sentinel data lake	https://learn.microsoft.com/en-us/azure/sentinel/datalake/notebooks-troubleshooting
Best practices and troubleshooting for Sentinel MCP tools	https://learn.microsoft.com/en-us/azure/sentinel/datalake/troubleshoot-sentinel-mcp
Troubleshoot Microsoft Sentinel solution issues	https://learn.microsoft.com/en-us/azure/sentinel/isv/troubleshoot-sentinel-solutions
Monitor and troubleshoot Sentinel automation health	https://learn.microsoft.com/en-us/azure/sentinel/monitor-automation-health
Monitor and troubleshoot Sentinel scheduled analytics rule execution	https://learn.microsoft.com/en-us/azure/sentinel/monitor-optimize-analytics-rule-execution
Troubleshoot Sentinel SAP agentless connector issues	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-deploy-troubleshoot
Troubleshoot Microsoft Sentinel analytics rule issues	https://learn.microsoft.com/en-us/azure/sentinel/troubleshoot-analytics-rules

Best Practices

Topic	URL
Audit and track Microsoft Sentinel incident tasks	https://learn.microsoft.com/en-us/azure/sentinel/audit-track-tasks
Design Microsoft Sentinel automation rules for SOAR	https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules
Apply recommended Microsoft Sentinel playbook templates and use cases	https://learn.microsoft.com/en-us/azure/sentinel/automation/playbook-recommendations
Apply best practices for Microsoft Sentinel workspaces	https://learn.microsoft.com/en-us/azure/sentinel/best-practices
Apply Sentinel-specific best practices for data collection	https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data
Bring custom machine learning models into Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml
Apply detection tuning recommendations in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/detection-tuning
Resolve false positives in Sentinel analytics rules	https://learn.microsoft.com/en-us/azure/sentinel/false-positives
Handle ingestion delay in Sentinel scheduled rules	https://learn.microsoft.com/en-us/azure/sentinel/ingestion-delay
Apply quality guidelines to Sentinel platform solutions	https://learn.microsoft.com/en-us/azure/sentinel/isv/platform-solution-quality-guidance
Apply quality guidelines to Sentinel SIEM solutions	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-siem-solution-quality-guidance

Decision Making

Topic	URL
Plan and execute Sentinel migration from MMA to AMA	https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate
Decide and migrate Sentinel alert-trigger playbooks	https://learn.microsoft.com/en-us/azure/sentinel/automation/migrate-playbooks-to-automation-rules
Decide when to use the Microsoft Sentinel data lake tier	https://learn.microsoft.com/en-us/azure/sentinel/basic-logs-use-cases
Plan and estimate Microsoft Sentinel billing costs	https://learn.microsoft.com/en-us/azure/sentinel/billing
Analyze and optimize Microsoft Sentinel costs	https://learn.microsoft.com/en-us/azure/sentinel/billing-monitor-costs
Choose and use Sentinel prepurchase cost plans	https://learn.microsoft.com/en-us/azure/sentinel/billing-pre-purchase-plan
Reduce and optimize Microsoft Sentinel costs	https://learn.microsoft.com/en-us/azure/sentinel/billing-reduce-costs
Choose correct Sentinel connector for Cisco firewalls	https://learn.microsoft.com/en-us/azure/sentinel/cisco-ftd-firewall
Choose between Sentinel analytics rules and Defender custom detections	https://learn.microsoft.com/en-us/azure/sentinel/compare-analytics-rules-custom-detections
Plan interactive vs long-term data retention in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/configure-data-retention-archive
Assess Sentinel connector support across clouds	https://learn.microsoft.com/en-us/azure/sentinel/data-type-cloud-support
Choose between KQL jobs, summary rules, and search jobs

Architecture & Design Patterns

Topic	URL
Design BCDR architecture for Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/business-continuity-disaster-recovery
Design custom security graphs with Sentinel data lake	https://learn.microsoft.com/en-us/azure/sentinel/datalake/custom-graphs-overview
Deploy Sentinel alongside an existing SIEM	https://learn.microsoft.com/en-us/azure/sentinel/deploy-side-by-side
Design Sentinel across multiple workspaces and tenants	https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
Design Sentinel SIEM solution components and patterns	https://learn.microsoft.com/en-us/azure/sentinel/isv/siem-components-to-include
Plan multi-workspace and multi-tenant Sentinel layouts	https://learn.microsoft.com/en-us/azure/sentinel/prepare-multiple-workspaces
Choose Microsoft Sentinel workspace designs by scenario	https://learn.microsoft.com/en-us/azure/sentinel/sample-workspace-designs
Configure multi-workspace and tenant architecture in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/use-multiple-workspaces

Limits & Quotas

Topic	URL
Configure and understand Sentinel NRT rule limits	https://learn.microsoft.com/en-us/azure/sentinel/create-nrt-rules
Microsoft Sentinel data lake service limits reference	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-service-limits
Microsoft Sentinel MCP pricing and usage limits	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-billing
Check Sentinel feature availability by Azure cloud	https://learn.microsoft.com/en-us/azure/sentinel/feature-availability
Understand ASIM known issues and limitations in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/normalization-known-issues
Understand implications of removing Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/offboard-implications
Use Sentinel search jobs beyond log query timeouts	https://learn.microsoft.com/en-us/azure/sentinel/search-jobs
Review Microsoft Sentinel service limits and quotas	https://learn.microsoft.com/en-us/azure/sentinel/sentinel-service-limits
Create and upload watchlists in Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/watchlists-create
Manage and update Sentinel watchlists safely	https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage

Security

Topic	URL
Configure Sentinel playbook authentication and permissions	https://learn.microsoft.com/en-us/azure/sentinel/automation/authenticate-playbooks-to-sentinel
Restrict access to Sentinel Standard playbooks	https://learn.microsoft.com/en-us/azure/sentinel/automation/define-playbook-access-restrictions
Enable automated attack disruption actions on AWS	https://learn.microsoft.com/en-us/azure/sentinel/aws-disruption
Configure customer-managed keys for Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/customer-managed-keys
Audit Sentinel data lake and graph activities in Purview	https://learn.microsoft.com/en-us/azure/sentinel/datalake/auditing-lake-activities
Meet prerequisites to onboard Sentinel data lake and graph	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-onboarding
Use Sentinel MCP tools in Azure AI Foundry	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-azure-ai-foundry
Connect Sentinel MCP tools in Copilot Studio	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-copilot-studio
Secure Sentinel Azure Storage blob connectors with NSP	https://learn.microsoft.com/en-us/azure/sentinel/enable-storage-network-security
Understand Sentinel geographic availability and data residency	https://learn.microsoft.com/en-us/azure/sentinel/geographical-availability-data-residency
Protect MSSP intellectual property in Microsoft Sentinel

Configuration

Topic	URL
Add incident entities as threat indicators in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence
Use Sentinel ML anomaly types for detection	https://learn.microsoft.com/en-us/azure/sentinel/anomalies-reference
Create Data Collection Rules for Sentinel using API examples	https://learn.microsoft.com/en-us/azure/sentinel/api-dcr-reference
Configure and query Microsoft Sentinel audit logs	https://learn.microsoft.com/en-us/azure/sentinel/audit-sentinel-data
Use SentinelAudit tables for user activity auditing	https://learn.microsoft.com/en-us/azure/sentinel/audit-table-reference
Configure Microsoft Sentinel automation rule properties and conditions	https://learn.microsoft.com/en-us/azure/sentinel/automation-rule-reference
Configure Sentinel playbooks for automated threat response	https://learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-playbooks
Deploy Business Apps Sentinel solution for Power Platform	https://learn.microsoft.com/en-us/azure/sentinel/business-applications/deploy-power-platform-solution
Map CEF keys to Microsoft Sentinel CommonSecurityLog fields	https://learn.microsoft.com/en-us/azure/sentinel/cef-name-mapping
Understand Syslog and CEF AMA connectors for Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/cef-syslog-ama-overview
Configure Security Events connector for anomalous RDP detection	https://learn.microsoft.com/en-us/azure/sentinel/configure-connector-login-detection

Integrations & Coding Patterns

Topic	URL
Use automation integrations in Microsoft Sentinel playbooks	https://learn.microsoft.com/en-us/azure/sentinel/automation/integrations
Leverage Azure Logic Apps workflows for Sentinel playbooks	https://learn.microsoft.com/en-us/azure/sentinel/automation/logic-apps-playbooks
Use Microsoft Sentinel playbook triggers and actions via Logic Apps	https://learn.microsoft.com/en-us/azure/sentinel/automation/playbook-triggers-actions
Integrate Microsoft Sentinel incidents with Teams collaboration	https://learn.microsoft.com/en-us/azure/sentinel/collaborate-in-microsoft-teams
Stream logs to Sentinel using Logstash and DCR API	https://learn.microsoft.com/en-us/azure/sentinel/connect-logstash-data-connection-rules
Integrate STIX/TAXII threat feeds and exports with Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-taxii
Connect threat intelligence platforms to Sentinel (legacy connector)	https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-tip
Integrate TIP feeds with Sentinel via upload API	https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-upload-api
Create and manage custom graphs in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/datalake/create-custom-graphs
Author custom graphs with AI in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/datalake/create-graphs-with-ai
Query Sentinel graphs using GQL syntax and operators	https://learn.microsoft.com/en-us/azure/sentinel/datalake/gql-reference-for-sentinel-custom-graph

Deployment

Topic	URL
Set up CI/CD deployments of custom Sentinel content	https://learn.microsoft.com/en-us/azure/sentinel/ci-cd
Customize repository-based content deployments in Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-deploy
Deploy Sentinel data lake from Microsoft Defender portal	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-onboard-defender
Deploy Sentinel analytics rules via ARM templates	https://learn.microsoft.com/en-us/azure/sentinel/import-export-analytics-rules
Deploy Sentinel automation rules via ARM templates	https://learn.microsoft.com/en-us/azure/sentinel/import-export-automation-rules
Package and deploy Sentinel graph/notebook solutions	https://learn.microsoft.com/en-us/azure/sentinel/isv/package-publish-notebook-graph-solutions
Publish Microsoft Security Copilot agents to store	https://learn.microsoft.com/en-us/azure/sentinel/isv/publish-agent-to-security-store
Publish Sentinel SIEM solutions via Partner Center	https://learn.microsoft.com/en-us/azure/sentinel/isv/publish-sentinel-solutions
Deploy Sentinel solution for SAP BTP systems	https://learn.microsoft.com/en-us/azure/sentinel/sap/deploy-sap-btp-solution
Verify prerequisites to deploy Sentinel SAP solution	https://learn.microsoft.com/en-us/azure/sentinel/sap/prerequisites-for-deploying-sap-continuous-threat-monitoring
Migrate SAP monitoring from container agent to agentless	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-agent-migrate