microsoft-sentinel

Microsoft Sentinel hunting queries require proper table-domain selection across SigninLogs, AuditLogs, and AzureActivity, combined with KQL optimization. You must enforce TimeGenerated discipline and handle ResultType codes correctly to ensure accurate telemetry correlation and detection.

Creating analytic rules in Microsoft Sentinel involves following best practices for NRT versus scheduled rule constraints, applying watchlists, and utilizing ASIM caveats. You should map detections to MITRE frameworks while maintaining proper schema usage across identity and cloud workload tables.

Microsoft Sentinel supports UEBA and identity enrichment through BehaviorAnalytics and IdentityInfo tables. You can integrate these enrichments into your hunting queries and analytic rules to enhance detection context and improve the accuracy of user behavior anomalies.

Correlating threat intelligence with Sentinel telemetry uses materialise, arg_max, and coalesce functions within KQL. These TI patterns allow you to join watchlists and threat indicators with logs like CommonSecurityLog for effective hunting and detection.

ASIM caveats and TimeGenerated discipline limit Sentinel rules by requiring strict time filtering and standardized schema parsing. Scheduled and NRT rules face different execution constraints, making proper ResultType handling and row_window_session sessionisation necessary for accurate detections.