https://cybertoolchain.io/tools/microsoft-sentinel New releases and features in Microsoft Sentinel, tracked by The Cyber Toolchain. en Mon, 13 Jul 2026 10:06:50 GMT https://learn.microsoft.com/en-us/azure/sentinel/whats-new https://learn.microsoft.com/en-us/azure/sentinel/whats-new Mon, 13 Jul 2026 10:06:50 GMT Sentinel adds data federation, AI playbook GA, custom detection-as-code, UEBA GCP anomalies, and graph-based MCP exploration. • Adds custom detection rules as code support in Sentinel Repositories (Preview): manage and sync custom detection rules via GitHub or Azure DevOps using the Microsoft Security BICEP extension or BICEP CLI. • Enables linking behavior-based query results from the BehaviorInfo table to new or existing incidents in advanced hunting (Preview), enriching incident context with UEBA data and auto-populating alert metadata and entities. • Introduces a graph tool collection in the Microsoft Sentinel MCP server (Preview) for visual, graph-based exploration of relationships across identities, devices, threats, and signals to assess coverage, dependencies, and configuration gaps. • AI-powered SOAR playbook generator is now generally available (GA), creating Python-based automation workflows through a conversational experience with Cline, an AI coding agent. • Adds a consolidated UEBA settings experience with a new UEBA tab in the Microsoft Sentinel settings page. • Extends UEBA Okta anomaly detections (Anomalous Activity and Anomalous MFA Failures) to support the OktaV2_CL table alongside the existing Okta_CL table. • Adds five new UEBA GCP Audit Logs anomaly detections covering unusual login behavior, privileged actions, resource deployments, secret/KMS key access, and infrastructure usage patterns. • Breaking change: Account Name entity in analytics rule alerts will now always be the UPN prefix only (e.g., 'user' instead of 'user@domain.com'), with new UPN-related fields (UserPrincipalName, UPNSuffix) added to the SecurityAlert table — automation rules and Logic Apps that compare AccountName against full UPNs must be updated before July 1, 2026. • Introduces Microsoft Sentinel data federation (Preview) powered by Microsoft Fabric, enabling analysis of security data in place from Microsoft Fabric, Azure Data Lake Storage, and Azure Databricks without copying it, using KQL, notebooks, and custom graphs. • Adds native data filtering and splitting in the Microsoft Defender portal (Preview) to reduce noise before ingestion, control costs, and route data between analytics and data lake tiers. Breaking changes: • Automation rules and Logic Apps playbooks that compare or filter on the `AccountName` property (or `AccountName` in Logic Apps) using the full UPN (e.g., `user@domain.com`) will break after July 1, 2026: `Account Name` will always be set to the UPN prefix only (e.g., `user`) when a full UPN is mapped to Account Name in analytics rule alerts, whereas previously it could be either the full UPN or the prefix. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sentinel https://learn.microsoft.com/en-us/azure/sentinel/whats-new#november-2025 https://learn.microsoft.com/en-us/azure/sentinel/whats-new#november-2025 Sat, 01 Nov 2025 00:00:00 GMT Microsoft Sentinel November 2025 updates: UEBA in Defender portal, SAP agentless connector GA, standardized account entity naming • Adds `UEBA Anomalies` automatic tagging and a "Top UEBA anomalies" section (top 3 past 30 days) to user side panels and entity pages for prioritized behavioral investigations. • Exposes an agentless SAP data connector that is now generally available, replacing the deprecated containerized SAP data connector. • Changes account entity naming logic in alerts and incidents to prioritize `Account.UPNprefix`, then `Account.Name`, then `Account.DisplayName`. Breaking changes: • The containerized SAP data connector agent will be permanently disabled on September 14, 2026 and stop delivering SAP logs; existing analytics rules, workbooks, hunting queries, and playbooks depending on those logs will stop returning results for affected systems. • Standardized account entity naming logic now prioritizes `Account.UPNprefix` over `Account.Name` and `Account.DisplayName`, potentially changing behavior for analytic rules, automation rules, playbooks, and hunting queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sentinel https://learn.microsoft.com/en-us/azure/sentinel/whats-new# https://learn.microsoft.com/en-us/azure/sentinel/whats-new# Mon, 01 Sep 2025 00:00:00 GMT Microsoft Sentinel Sept 2026 updates include integrated data lake onboarding, Fabric mirroring, and UEBA new data sources. • Integrated Microsoft Sentinel SIEM and data lake onboarding removes the need for a separate data lake setup by using Defender portal Table management to enable the lake tier. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-sentinel