cso-sentinel-workspace

What problem does it solve? Setting up a working SIEM requires coordinating Azure workspaces, data connectors, ingestion verification, and cost controls, and learners often miss steps or get surprised by billing. This Skill walks a learner through enabling Microsoft Sentinel and getting real security logs flowing with cost guardrails in place. ## Core Features & Use Cases - Sentinel Onboarding: Create a Log Analytics workspace with PowerShell and enable Microsoft Sentinel on it with 90-day retention. - Data Connector Setup: Wire in the Microsoft Entra ID connector (sign-in and audit logs) and the Microsoft Defender XDR connector (alerts plus raw telemetry tables like DeviceProcessEvents). - Ingestion Verification and Cost Control: Validate data flow with KQL queries against SigninLogs, AuditLogs, SecurityAlert, and the Usage table, then set a daily ingestion cap with a 90% alert. - Use Case: A cybersecurity student enables Sentinel on a lab workspace, connects Entra ID sign-in logs, confirms rows appear in KQL queries, and sets a 1 GB daily cap so a misconfiguration cannot run up the bill. ## Quick Start Ask the mentor to walk you through enabling Microsoft Sentinel on a Log Analytics workspace and connecting Entra ID sign-in logs.