# Microsoft Sentinel **Entity class:** Security information and event management / orchestration platform **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition **Microsoft Sentinel** is Microsoft's cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platform. It ingests telemetry from Microsoft and non-Microsoft systems, correlates activity into incidents, supports threat hunting, and runs response playbooks. ## Modern Defense and Cybersecurity Role Sentinel supplies the cross-domain operations layer above individual sensors. In a defense or intelligence environment, it helps a security operations center assemble endpoint, identity, cloud, network, and application events into a shared cyber picture. ## Chronological Proximity Introduced as Azure Sentinel in 2019, the platform preceded Microsoft's unified Defender security-operations experience and now operates alongside [[wiki/Microsoft Defender XDR|Defender XDR]] and [[wiki/Microsoft Security Copilot|Security Copilot]]. ## Relational Proximity [[wiki/Microsoft Defender for Endpoint|Defender for Endpoint]] and other controls generate security signals; Sentinel retains, correlates, hunts, and orchestrates across those signals. [[wiki/Microsoft Threat Intelligence Center|Microsoft Threat Intelligence]] supplies adversary context. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://learn.microsoft.com/en-us/azure/sentinel/overview)