# Microsoft Sentinel (SIEM)

> Chapter 98 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/azure-sentinel

**Official objective:** 2.5 — Azure Architecture Services

## Introduction

This chapter covers Microsoft Sentinel (SIEM). AZ-900 tests under 2.5.

## A Security Operations Center

A SOC monitors threats across an organization continuously. Azure Sentinel (SIEM) does this for cloud: collecting security data, detecting threats, and enabling response.

## Core explanation

Sentinel collects security data from across an environment, detects threats using ML, and enables investigation and response. It's Azure's security information and event management (SIEM) platform.

## Real-world context

An organization uses Sentinel to detect unusual sign-in patterns, enabling faster response to potential compromises.

## Exam focus

Objective 2.5 expects conceptual understanding of Sentinel as a SIEM for threat detection and response.

## Step by step

1. **Connect data sources** — Security data from various Azure services is connected to Sentinel.
2. **Enable detection rules** — Rules detect suspicious patterns and threats.
3. **Investigate alerts** — Teams investigate and respond to detected threats.

## Common misconceptions

- **Misconception:** Sentinel automatically prevents all threats. **Reality:** It detects and alerts; response is manual.

## Key takeaways

- Sentinel detects threats across an environment.
- Enables investigation and response.
- Azure's SIEM platform.

## FAQ

**What is Microsoft Sentinel?**

It's Azure's SIEM platform for detecting security threats and enabling investigation and response across cloud resources.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/azure-sentinel