Sep 30, 2026 · 47 min · 10 segments
We've talked about Microsoft Sentinel a few years ago, and realized it's time to brush up our understanding of the new and interesting capabilities it has to offer. In this episode, we talked about…
Jussi RoineHost
Tobias ZimmergrenHost
meaning you send it logs, it runs analytics rules, it creates incidents and alerts.
You get a monthly bill, which is maybe a little bit bigger than last month because you have more logs.
So we figured let's revisit the topic because there's probably been – plenty of advancements with Sentinel, and perhaps our own understanding is a little bit outdated as well.
And over the past year, Sentinel has been rebuilt into more of a layered platform.
So the CM capability is still there, but it's perhaps just one component layer out of several capabilities now.
And I would perhaps envision that this episode is for the SOC lead, the CISO, whoever plans on deploying Sentinel or gets the invoice on Sentinel and needs to understand more what can we do with Sentinel and do we need something else or is Sentinel alone enough? So we'll talk about sort of the latest developments and where Sentinel is headed.
No, I like Sentinel and it's kind of moving, right? And we'll touch on that in this episode as well.
We've mentioned a couple of times in this episode or in this show, in different episodes, that Sentinel is kind of moving from the default Azure portal experience to its own area in Defender, in the new Defender portal.
For me, perhaps often I look at Sentinel through the eyes of whoever pays the bill and whoever kind of has to prove things to an auditor, because that's my role as well today.
So perhaps I'm less the analyst right now, but still much of that, you know, hunting and figuring out what happened, where and where's the signals going and how, you know, how's data moving, whatever.
And the recurring kind of conversations we have, it's always the same trade-off.
meaning you send it logs, it runs analytics rules, it creates incidents and alerts.
You get a monthly bill, which is maybe a little bit bigger than last month because you have more logs.
So we figured let's revisit the topic because there's probably been – plenty of advancements with Sentinel, and perhaps our own understanding is a little bit outdated as well.
And over the past year, Sentinel has been rebuilt into more of a layered platform.
So the CM capability is still there, but it's perhaps just one component layer out of several capabilities now.
And I would perhaps envision that this episode is for the SOC lead, the CISO, whoever plans on deploying Sentinel or gets the invoice on Sentinel and needs to understand more what can we do with Sentinel and do we need something else or is Sentinel alone enough? So we'll talk about sort of the latest developments and where Sentinel is headed.
No, I like Sentinel and it's kind of moving, right? And we'll touch on that in this episode as well.
We've mentioned a couple of times in this episode or in this show, in different episodes, that Sentinel is kind of moving from the default Azure portal experience to its own area in Defender, in the new Defender portal.
For me, perhaps often I look at Sentinel through the eyes of whoever pays the bill and whoever kind of has to prove things to an auditor, because that's my role as well today.
So perhaps I'm less the analyst right now, but still much of that, you know, hunting and figuring out what happened, where and where's the signals going and how, you know, how's data moving, whatever.
And the recurring kind of conversations we have, it's always the same trade-off.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
