Defender Sentinel

Microsoft Sentinel and Defender XDR — Security Operations

This skill provides comprehensive knowledge for operating Microsoft Sentinel SIEM/SOAR and the Microsoft Defender XDR unified incident queue. It covers incident lifecycle management, KQL analytics and threat hunting, detection rule authoring, SOAR automation via Logic Apps, and cross-signal advanced hunting across the full Defender XDR signal set.

Integration Context Contract

• Canonical contract: docs/integration-context.md

* Use sovereign cloud values from the canonical contract when applicable.

Fail fast before any API call when required context is missing. Redact tenant/subscription/workspace identifiers in outputs.

Architecture Overview

Microsoft Sentinel (SIEM/SOAR)
  └─ Log Analytics Workspace
       ├─ Data Connectors (MDE, MDI, MDO, MDCA, Azure Activity, M365 Defender)
       ├─ Analytics Rules  ──► Incidents ──► Playbooks (Logic Apps)
       ├─ Watchlists
       ├─ Hunting Queries
       └─ Workbooks

Microsoft Defender XDR (Unified Portal)
  ├─ Microsoft Defender for Endpoint (MDE)
  ├─ Microsoft Defender for Identity (MDI)
  ├─ Microsoft Defender for Office 365 (MDO)
  ├─ Microsoft Defender for Cloud Apps (MDCA)
  └─ Unified Incidents Queue ──► Advanced Hunting (KQL)

Sentinel REST API

Base URLs

Sentinel ARM control plane:
  https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/

Log Analytics query (data plane):
  https://api.loganalytics.io/v1/workspaces/{workspaceId}/query

Key Sentinel Resource Types

Incident Management

List open incidents (severity filter):

GET https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{ws}/providers/Microsoft.SecurityInsights/incidents?api-version=2023-02-01&$filter=properties/status eq 'New' and properties/severity eq 'High'&$orderby=properties/createdTimeUtc desc&$top=50
Authorization: Bearer {token}

Update incident status and assign:

PATCH https://management.azure.com/.../incidents/{incidentId}?api-version=2023-02-01
Content-Type: application/json

{
  "properties": {
    "status": "Active",
    "severity": "High",
    "assignee": {
      "objectId": "{analyst-object-id}",
      "email": "analyst@contoso.com",
      "name": "Analyst Name"
    },
    "classification": null,
    "classificationComment": null
  }
}

Close an incident:

PATCH .../incidents/{incidentId}
{
  "properties": {
    "status": "Closed",
    "classification": "TruePositive",
    "classificationReason": "SuspiciousActivity",
    "classificationComment": "Confirmed malicious. Endpoint isolated."
  }
}

Add comment:

POST .../incidents/{incidentId}/comments
{
  "properties": {
    "message": "Analyst note: investigated lateral movement from device WIN-XYZ. Confirmed breach. Isolating host."
  }
}

Incident Severity and Status Values

KQL Analytics and Hunting

Analytics Rule Types

Scheduled Rule Schema

{
  "kind": "Scheduled",
  "properties": {
    "displayName": "Suspicious PowerShell encoded command",
    "description": "Detects base64-encoded PowerShell commands which may indicate obfuscation.",
    "severity": "Medium",
    "enabled": true,
    "query": "SecurityEvent\n| where EventID == 4688\n| where CommandLine contains \"-EncodedCommand\"\n| extend DecodedCmd = base64_decode_tostring(extract(@\"-[Ee]n[Cc].*?\\s+(\\S+)\", 1, CommandLine))\n| project TimeGenerated, Computer, Account, CommandLine, DecodedCmd",
    "queryFrequency": "PT5M",
    "queryPeriod": "PT1H",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 0,
    "suppressionDuration": "PT1H",
    "suppressionEnabled": false,
    "tactics": ["Execution", "DefenseEvasion"],
    "techniques": ["T1059.001", "T1027"],
    "entityMappings": [
      {
        "entityType": "Account",
        "fieldMappings": [{ "identifier": "Name", "columnName": "Account" }]
      },
      {
        "entityType": "Host",
        "fieldMappings": [{ "identifier": "HostName", "columnName": "Computer" }]
      }
    ],
    "incidentConfiguration": {
      "createIncident": true,
      "groupingConfiguration": {
        "enabled": true,
        "reopenClosedIncident": false,
        "lookbackDuration": "PT5H",
        "matchingMethod": "Selected",
        "groupByEntities": ["Account"]
      }
    }
  }
}

KQL Hunting Query Patterns

Impossible travel detection:

let lookback = 7d;
let speed_threshold_kmh = 900; // max realistic flight speed
SigninLogs
| where TimeGenerated > ago(lookback)
| where ResultType == 0  // success
| project TimeGenerated, UserPrincipalName, IPAddress, Location, LocationDetails
| extend City = tostring(LocationDetails.city), Country = tostring(LocationDetails.countryOrRegion)
| extend Lat = todouble(LocationDetails.geoCoordinates.latitude), Lon = todouble(LocationDetails.geoCoordinates.longitude)
| sort by UserPrincipalName asc, TimeGenerated asc
| serialize
| extend PrevTime = prev(TimeGenerated), PrevLat = prev(Lat), PrevLon = prev(Lon), PrevUser = prev(UserPrincipalName)
| where UserPrincipalName == PrevUser
| extend TimeDeltaHours = datetime_diff('second', TimeGenerated, PrevTime) / 3600.0
| extend DistanceKm = geo_distance_2points(PrevLon, PrevLat, Lon, Lat) / 1000.0
| extend SpeedKmh = iff(TimeDeltaHours > 0, DistanceKm / TimeDeltaHours, real(0))
| where SpeedKmh > speed_threshold_kmh
| project TimeGenerated, UserPrincipalName, IPAddress, City, Country, PrevTime, DistanceKm, SpeedKmh

Privileged role assignment spike:

AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName == "Add member to role"
| extend Role = tostring(TargetResources[0].displayName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| extend Target = tostring(TargetResources[1].userPrincipalName)
| where Role in ("Global Administrator", "Privileged Role Administrator", "Security Administrator", "Exchange Administrator")
| summarize Count = count() by bin(TimeGenerated, 1h), Actor, Role
| where Count > 3
| order by Count desc

New device registered by high-risk user:

let risky_users = RiskyUsers
| where RiskLevel in ("high", "medium")
| project UserPrincipalName;
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName == "Register device"
| extend RegisteredBy = tostring(InitiatedBy.user.userPrincipalName)
| where RegisteredBy in (risky_users)
| project TimeGenerated, RegisteredBy, DeviceName = tostring(TargetResources[0].displayName)

Log Analytics Query API

Run KQL queries programmatically:

POST https://api.loganalytics.io/v1/workspaces/{workspaceId}/query
Authorization: Bearer {token}
Content-Type: application/json

{
  "query": "SecurityAlert | where TimeGenerated > ago(24h) | summarize count() by AlertName | order by count_ desc | limit 20",
  "timespan": "P1D"
}

Response structure:

{
  "tables": [{
    "name": "PrimaryResult",
    "columns": [
      {"name": "AlertName", "type": "string"},
      {"name": "count_", "type": "long"}
    ],
    "rows": [["Suspicious PowerShell", 42], ...]
  }]
}

Defender XDR API (Microsoft Graph Security)

Incidents

List incidents (Graph Security API):

GET https://graph.microsoft.com/v1.0/security/incidents?$filter=status eq 'active'&$orderby=createdDateTime desc&$top=25
Authorization: Bearer {token}

Get incident with alerts:

GET https://graph.microsoft.com/v1.0/security/incidents/{incidentId}?$expand=alerts

Update incident:

PATCH https://graph.microsoft.com/v1.0/security/incidents/{incidentId}
Content-Type: application/json

{
  "status": "inProgress",
  "assignedTo": "analyst@contoso.com",
  "determination": "malware",
  "classification": "truePositive"
}

Alert Investigation

Get alert with evidence:

GET https://graph.microsoft.com/v1.0/security/alerts_v2/{alertId}?$expand=evidence

Alert evidence types: deviceEvidence, userEvidence, fileEvidence, processEvidence, ipEvidence, urlEvidence, mailboxEvidence, mailClusterEvidence

Device action — Isolate:

POST https://api.securitycenter.microsoft.com/api/machines/{machineId}/isolate
Content-Type: application/json

{
  "Comment": "Isolating device due to active compromise — Sentinel incident INC-12345",
  "IsolationType": "Full"
}

Advanced Hunting (Graph)

POST https://graph.microsoft.com/v1.0/security/runHuntingQuery
Content-Type: application/json

{
  "query": "DeviceProcessEvents | where Timestamp > ago(1h) | where ProcessCommandLine contains 'mimikatz' | project Timestamp, DeviceName, AccountName, ProcessCommandLine | limit 100"
}

Advanced hunting tables available: DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceLogonEvents, DeviceRegistryEvents, IdentityLogonEvents, IdentityQueryEvents, EmailEvents, EmailAttachmentInfo, CloudAppEvents, AlertEvidence, AlertInfo

SOAR Playbooks (Logic Apps)

Playbook Trigger Pattern

Sentinel playbooks are Azure Logic Apps triggered by the Microsoft Sentinel incident trigger or alert trigger:

{
  "triggers": {
    "Microsoft_Sentinel_incident": {
      "type": "ApiConnectionWebhook",
      "inputs": {
        "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } },
        "body": { "callback_url": "@{listCallbackUrl()}" },
        "path": "/incident-creation"
      }
    }
  }
}

Common Playbook Actions

MITRE ATT&CK Coverage

When authoring detection rules, always annotate with MITRE tactics and techniques:

Output Convention

Every operation produces a structured markdown report:

1. Header: operation name, timestamp, workspace/tenant
2. Incident/alert summary: ID, severity, status, entity count
3. KQL results table: columns and rows from query
4. Actions taken: list of automated or manual actions
5. Recommendations: next investigation steps, rule tuning notes

Reference Files

Progressive Disclosure — Reference Files