Microsoft Sentinel

No entries match these filters. Clear filters

1. August 2026 Aug 1, 2026 · release notes

   Microsoft Sentinel August 2026 adds Fortinet/Check Point/Zscaler UEBA coverage and contextual anomaly insights.

   • Adds Fortinet FortiGate firewall event behaviors to the UEBA behaviors layer for identifying administrative activity such as rapid system reconfigurations and certificate changes
   • Adds Check Point, Fortinet FortiGate, and Zscaler firewall/VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection./web proxy events to UEBA anomaly detection via CommonSecurityLog
   • Adds identity-linked AWS GuardDuty findings support to UEBA anomaly detection from the AWSGuardDuty table
   • Adds contextual anomaly insights directly to UEBA behavior records for identifying first-seen activity and uncommon values
   • Updates SAP agentless solution to version 1.1.12 with audit log performance enhancements and the force-sal-filesystem parameter

   +2 more show less

   • Updates SAP BTP solution to version 3.1.1 with an analytic rule for unaudited custom apps and renames existing SAP BTP prefixed rules
   • Updates SAP LogServ solution to version 3.0.5 enabling ASIM-based content activation for RISE with SAP customers and switching HANA detections to Syslog

   7 details in Everything

2. What's new in Microsoft Sentinel seen Jul 13, 2026 · issue 014

   Sentinel adds data federation, AI playbook GA, custom detection-as-code, UEBA GCP anomalies, and graph-based MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. exploration.

   ⤢ ⤢ ⤢

   ▶ ⤢
   └──▷ TRY IT
   Deploy custom detection rules directly from your CI/CD pipeline as code, keeping rules version-controlled alongside other security artifacts.
   copy

   $ # After authoring your rule in BICEP, deploy it directly via CLI:
   az deployment group create \
     --resource-group <your-rg> \
     --template-file customDetectionRule.bicep \
     --parameters workspaceName=<sentinel-workspace>

   Access the new consolidated UEBA settings (including Okta V2 and GCP anomaly configuration) from the updated settings page.
   📍In the Microsoft Sentinel portal, go to Settings › Microsoft Sentinel settings › UEBA tab to configure data sources, enable GCP Audit Logs anomaly detections, and manage Okta V2 connector settings.
   • Adds custom detection rules as code support in Sentinel Repositories (Preview): manage and sync custom detection rules via GitHub or Azure DevOps using the Microsoft Security BICEP extension or BICEP CLI.
   • Enables linking behavior-based query results from the BehaviorInfo table to new or existing incidents in advanced hunting (Preview), enriching incident context with UEBA data and auto-populating alert metadata and entities.
   • Introduces a graph tool collection in the Microsoft Sentinel MCP server (Preview) for visual, graph-based exploration of relationships across identities, devices, threats, and signals to assess coverage, dependencies, and configuration gaps.
   • AI-powered SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbook generator is now generally available (GA), creating Python-based automation workflows through a conversational experience with Cline, an AI coding agent.
   • Adds a consolidated UEBA settings experience with a new UEBA tab in the Microsoft Sentinel settings page.

   +5 more show less

   • Extends UEBA Okta anomaly detections (Anomalous Activity and Anomalous MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. Failures) to support the OktaV2_CL table alongside the existing Okta_CL table.
   • Adds five new UEBA GCP Audit Logs anomaly detections covering unusual login behavior, privileged actions, resource deployments, secret/KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key access, and infrastructure usage patterns.
   • Breaking change: Account Name entity in analytics rule alerts will now always be the UPN prefix only (e.g., user instead of user@domain.com), with new UPN-related fields (UserPrincipalName, UPNSuffix) added to the SecurityAlert table — automation rules and Logic Apps that compare AccountName against full UPNs must be updated before July 1, 2026.
   • Introduces Microsoft Sentinel data federation (Preview) powered by Microsoft Fabric, enabling analysis of security data in place from Microsoft Fabric, Azure Data Lake Storage, and Azure Databricks without copying it, using KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly., notebooks, and custom graphs.
   • Adds native data filtering and splitting in the Microsoft Defender portal (Preview) to reduce noise before ingestion, control costs, and route data between analytics and data lake tiers.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Automation rules and Logic Apps playbooks that compare or filter on the AccountName property (or AccountName in Logic Apps) using the full UPN (e.g., user@domain.com) will break after July 1, 2026: Account Name will always be set to the UPN prefix only (e.g., user) when a full UPN is mapped to Account Name in analytics rule alerts, whereas previously it could be either the full UPN or the prefix.
3. July 2026 Jul 1, 2026 · release notes

   New preview capability to manage Sentinel custom detection rules as code via Repositories and BICEP

   • Adds support for managing custom detection rules as code in GitHub or Azure DevOps repositories using the Microsoft Security BICEP extension.
   • Enables syncing custom detection rules to Microsoft Sentinel using the Repositories feature.
   • Supports deploying custom detection rules directly using the BICEP CLI.

   3 details in Everything

4. May 2026 May 1, 2026 · release notes

   Sentinel May 2026 adds AI playbook generation GA, Okta V2 UEBA support, and GCP audit log anomaly detections.

   └──▷ HOW TO FIND IT
   Generate a Python playbook via AI to automate incident response workflows
   📍Use the Playbook Generation feature in the Microsoft Sentinel UI with the Cline AI agent
   Access unified UEBA and Behaviors configuration centrally
   📍Navigate to Settings › UEBA tab in the Microsoft Sentinel console
   • Adds Playbook Generation using Cline AI for conversational Python workflow creation
   • Adds UEBA settings consolidation behind the UEBA tab in Sentinel Settings
   • Extends UEBA Okta anomalies to support the OktaV2_CL data table
   • Adds five new GCP Audit Logs anomaly detections for login, privileged actions, resources, secrets/KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves., and infrastructure patterns

   4 details in Everything

5. April 2026 Apr 1, 2026 · release notes

   Microsoft Sentinel April 2026 adds data federation, custom graphs, row-level scoping, AI connector builder, and entity analyzer GA.

   └──▷ HOW TO FIND IT
   Federate data from Azure Data Lake Storage into Sentinel to analyze it via KQLKQLKusto Query Language, Microsoft's read-only query language for Azure Data Explorer and Microsoft Sentinel, used by cyber tools to filter, aggregate, and correlate large volumes of log and telemetry data quickly. without duplication.
   📍Use the Microsoft Sentinel data federation feature in the portal to select Azure Data Lake Storage as a source.
   Build custom security graphs to visualize attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. across federated and native data.
   📍In the Microsoft Defender portal, navigate to Graphs experience, run a GQL query, and traverse nodes to view blast radius.
   Update automation rules to handle the new Account Name mapping behavior.
   📍Replace AccountName Equals user@domain.com with AccountName Contains user or UPNSuffix Equals domain.com in Logic Apps playbooks.
   • Adds Microsoft Sentinel data federation (Preview) to analyze security data in Microsoft Fabric, Azure Data Lake Storage, and Azure Databricks without copying it
   • Adds Transform data with filter and split features (Preview) to reduce noise before ingestion and route data between analytics and data lake tiers
   • Adds Visual Studio Code connector builder agent (Preview) to build custom connectors using an AI-powered low-code workflow
   • Adds ability to build custom security graphs (Preview) across Sentinel data lake and third-party data to uncover attack paths
   • Adds Graphs experience in the Microsoft Defender portal (Preview) to run GQL queries, view schema, visualize results, and traverse the graph

   +4 more show less

   • Bumps Entity analyzer to generally available status for explainable entity risk assessments of URLs and identities
   • Bumps AI-powered SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. migration tool to generally available status for migrating from Splunk and QRadar to Microsoft Sentinel
   • Adds Cost estimation tool (Preview) with three-year projections to model data growth and predict spend
   • Adds row-level access configuration via Microsoft Sentinel scoping (Preview) using Unified RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to control access to specific data subsets

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The Account Name value for analytics rule alerts is now consistently the UPN prefix only; automation comparing against the full UPN must be updated to use Contains or Starts with operators or compare against the new UserPrincipalName, UPNSuffix, and UPN prefix fields
   • !Entity analyzer is no longer free starting April 1, 2026; Security Compute Units (SCUs) are now required for its usage
6. March 2026 Mar 1, 2026 · release notes

   Microsoft Sentinel content as code repositories GA; retire older API versions.

   • content-as-code repositories are now generally available for managing Sentinel configuration via REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Retired older Microsoft Sentinel REST API versions (including 2021-03-01-preview through 2025-07-01-preview) effective June 1, 2026; requests using them will fail.
   • !Required migration to recommended API versions 2025-09-01, 2025-06-01, or 2025-07-01-preview for Source Control actions.
7. February 2026 Feb 1, 2026 · release notes

   Microsoft Sentinel UEBA behaviors layer GA, new UEBA workbook, and AI playbook generation preview

   └──▷ HOW TO FIND IT
   View high-level behavioral metrics and trends provided by the new UEBA workbook in the essentials solution.
   📍Navigate to your Microsoft Sentinel workspace, open the Workbooks section, and select the UEBA Behaviors workbook from the UEBA essentials solution gallery.
   Leverage the conversational AI agent Cline to create Python-based automation workflows without writing code manually.
   📍In the Microsoft Sentinel Playbooks editor, initiate the AI generation experience with Cline and describe your desired automation logic in natural language to generate a playbook.
   • UEBA behaviors layer reaches general availability
   • New UEBA behaviors workbook included in the UEBA essentials solution
   • AI-driven SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. playbook generator enters preview

   3 details in Everything

8. January 2026 Jan 1, 2026 · release notes

   Microsoft Sentinel Jan 2026 adds UEBA widget, behaviors layer, connector integration, and SAP BTP detections.

   └──▷ HOW TO FIND IT
   Use the new UEBA widget on the home page to get immediate visibility into anomalous user behavior without opening a full investigation.
   📍In the Defender portal home page, locate and click the UEBA widget.
   Enable UEBA for your AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. data connector directly from the connector setup screen to start seeing normalized behaviors.
   📍In Sentinel, go to Data connectors › AWS CloudTrail › Enable UEBA.
   • Adds a new UEBA widget to the Defender portal home page for anomalous user behavior visibility
   • Introduces a UEBA behaviors layer that aggregates raw logs into normalized behavioral insights with MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. context
   • Enables direct configuration of UEBA within existing data connector settings to reduce management overhead
   • Expands detection coverage for SAP BTP including SAP Integration Suite, SAP Cloud Identity Service, SAP Build Work Zone, and SAP BTP Audit Logging

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Microsoft Sentinel in the Azure portal will be retired on March 31, 2027, requiring migration to the Microsoft Defender portal for continued support
9. November 2025 Nov 1, 2025 · release notes

   Microsoft Sentinel November 2025 updates: UEBA in Defender portal, SAP agentless connector GA, standardized account entity naming

   └──▷ HOW TO FIND IT
   Explore the new UEBA anomaly context directly from the incident graph interface.
   📍In the incident graph, select Go Hunt › All user anomalies to view all anomalies for a specific user.
   • Adds UEBA Anomalies automatic tagging and a Top UEBA anomalies section (top 3 past 30 days) to user side panels and entity pages for prioritized behavioral investigations.
   • Exposes an agentless SAP data connector that is now generally available, replacing the deprecated containerized SAP data connector.
   • Changes account entity naming logic in alerts and incidents to prioritize Account.UPNprefix, then Account.Name, then Account.DisplayName.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The containerized SAP data connector agent will be permanently disabled on September 14, 2026 and stop delivering SAP logs; existing analytics rules, workbooks, hunting queries, and playbooks depending on those logs will stop returning results for affected systems.
   • !Standardized account entity naming logic now prioritizes Account.UPNprefix over Account.Name and Account.DisplayName, potentially changing behavior for analytic rules, automation rules, playbooks, and hunting queries.
10. What's new in Microsoft Sentinel Sep 1, 2025 · release notes

    Microsoft Sentinel Sept 2026 updates include integrated data lake onboarding, Fabric mirroring, and UEBA new data sources.

    └──▷ HOW TO FIND IT
    Enable data lake retention for existing Sentinel tables via the Defender portal.
    📍In the Defender portal, navigate to Table Management › select a table › Retention, then enable Mirror to Data Lake and configure retention settings.
    • Integrated Microsoft Sentinel SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and data lake onboarding removes the need for a separate data lake setup by using Defender portal Table management to enable the lake tier.

    1 detail in Everything

11. September 2025 Sep 1, 2025 · release notes

    Microsoft Sentinel Sep 2025 adds GA Data Lake, Preview Graph & MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, plus 6 new UEBA data sources.

    └──▷ HOW TO FIND IT
    Enable anomaly detection for new UEBA data sources via the Defender portal.
    📍Onboard Microsoft Sentinel to the Defender portal to activate six new UEBA data sources including AWS CloudTrail and Okta MFA events.
    • Microsoft Sentinel data lake is now generally available for long-term data retention and multi-modalmulti-modalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. analytics
    • Microsoft Sentinel graph (Preview) provides unified graph analytics for threat reasoning across users, devices, and activities
    • Microsoft Sentinel Model Context Protocol (MCP) server (Preview) offers a hosted interface for building intelligent agents using natural language
    • UEBA (Preview) adds anomaly detection for six new data sources: Microsoft authentication sources, Microsoft Defender XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. device logon events, Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. managed identity signin logs, Microsoft Entra ID service principal signin logs, third-party cloud/identity platforms (AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions., GCP audit logs, Okta MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone.)

    4 details in Everything

12. August 2025 Aug 1, 2025 · release notes

    Sentinel workbooks can now be created and edited directly within the Microsoft Defender portal.

    └──▷ HOW TO FIND IT
    Streamline workbook management by accessing it directly from the Defender portal without switching to Azure.
    📍In the Microsoft Defender portal, go to Microsoft Sentinel › Threat management › Workbooks and create or edit a workbook.
    • Adds direct creation and editing of Microsoft Sentinel workbooks in the Microsoft Defender portal under Microsoft Sentinel > Threat management > Workbooks

    1 detail in Everything

13. July 2025 Jul 1, 2025 · release notes

    Microsoft Sentinel adds a new data lake with tiering support, integrated RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists., and unlimited workspace onboarding in the Defender portal.

    └──▷ HOW TO FIND IT
    Manage retention periods for Sentinel and XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. tables directly from the new unified management interface.
    📍Navigate to Manage data tiers and retention in the Microsoft Defender portal
    Grant permissions to users for Sentinel data lake operations using the new unified role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists..
    📍Create custom roles via Microsoft Defender XDR Unified RBAC or assign existing roles in Entra ID
    • Introduces the Microsoft Sentinel data lake (preview) for cost-effective long-term storage and AI acceleration
    • Adds ability to select log data tiering between analytics and lake tiers via the Microsoft Defender portal
    • Enables management of table retention settings for Microsoft Sentinel and Defender XDR in the Microsoft Defender portal
    • Integrates Microsoft Sentinel data lake permissions with Microsoft Defender XDR unified RBAC alongside global Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. roles
    • Removes the limit on the number of workspaces that can be onboarded to the Defender portal

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Microsoft Sentinel in the Azure portal will be retired July 2026; customers will be automatically redirected to the Microsoft Defender portal
14. June 2025 Jun 1, 2025 · release notes

    Summary rule templates now in public preview for pre-built aggregation rules

15. May 2025 May 1, 2025 · release notes

    Microsoft Sentinel use cases GA in Defender portal; unified IdentityInfo table and AI tagging preview added.

    • All Microsoft Sentinel use cases (including multitenant, multi-workspace, and government/cloud support) are now generally available in the Microsoft Defender portal for unified security operations.
    • New version of the IdentityInfo table is available in the Advanced hunting section of the Defender portal to enrich investigations across Defender and Azure.
    • SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. optimization support (Preview) adds AI MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tagging recommendations for detections.
    • SOC optimization support (Preview) adds risk-based recommendations to address coverage gaps linked to business risks.

    4 details in Everything

16. April 2025 Apr 1, 2025 · release notes

    Sentinel April 2025: Security Copilot incident summaries in Azure portal, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format. tables, multi-workspace Defender integration, and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. column optimization.

    └──▷ USE IT
    Query the new STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. 2.1 threat intelligence tables for specific threat actors.
    kql copy

    ThreatIntelObjects
    | where ObjectType == 'threat-actor'
    | project Name, Description, Alias

    • Adds incident summaries generated by Security Copilot in the Azure portal (Preview) to help analysts triage developing incidents
    • Enables multi workspace and multitenant support for Microsoft Sentinel in the Defender portal (Preview), allowing connection to a primary workspace with multiple secondary workspaces
    • Introduces new threat intelligence tables ThreatIntelIndicators and ThreatIntelObjects for ingesting all STIX objects and indicators via the STIX 2.1 schema

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Microsoft Sentinel will stop ingesting data to the legacy ThreatIntelligenceIndicator table after July 31, 2025, requiring migration of custom queries and automation to use the new tables.