1
1
# ## YamlMime:Landing
2
2
3
3
title : Microsoft Sentinel documentation # < 60 chars
4
- summary : This article presents use cases to get started using Microsoft Sentinel. See and stop threats before they cause harm, with SIEM reinvented for a modern world. Microsoft Sentinel is your birds-eye view across the enterprise. # < 160 chars
4
+ summary : Microsoft Sentinel provides attack detection, threat visibility, proactive hunting, and threat response to help you stop threats before they cause harm. # < 160 chars
5
5
6
6
metadata :
7
7
title : Microsoft Sentinel documentation
8
- description : This article presents use cases and scenarios to get started using Microsoft Sentinel. See and stop threats before they cause harm, with SIEM reinvented for a modern world. Microsoft Sentinel is your birds-eye view across the enterprise .
8
+ description : Microsoft Sentinel provides attack detection, threat visibility, proactive hunting, and threat response to help you stop threats before they cause harm.
9
9
ms.service : microsoft-sentinel
10
10
ms.topic : landing-page
11
11
author : yelevin
12
12
ms.author : yelevin
13
- ms.date : 11/09/2021
13
+ ms.date : 02/15/2024
14
14
15
15
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new
16
16
@@ -24,17 +24,12 @@ landingContent:
24
24
links :
25
25
- text : What is Microsoft Sentinel?
26
26
url : overview.md
27
- - text : Useful resources
28
- url : resources .md
27
+ - text : Best practices
28
+ url : best-practices .md
29
29
- linkListType : whats-new
30
30
links :
31
31
- text : What's new in Microsoft Sentinel?
32
32
url : whats-new.md
33
- - linkListType : concept
34
- links :
35
- - text : Best practices
36
- url : best-practices.md
37
-
38
33
39
34
# Card (optional)
40
35
- title : Get started
@@ -43,195 +38,109 @@ landingContent:
43
38
links :
44
39
- text : Onboard Microsoft Sentinel
45
40
url : quickstart-onboard.md
46
- - linkListType : concept
41
+ - linkListType : deploy
47
42
links :
43
+ - text : Deployment guide
44
+ url : deploy-overview.md
48
45
- text : Prerequisites
49
46
url : prerequisites.md
50
- - linkListType : how-to-guide
51
- links :
52
- - text : Install Microsoft Sentinel solutions (Preview)
53
- url : sentinel-solutions-deploy.md
54
- - text : Visualize collected data
55
- url : get-visibility.md
56
- - text : Investigate incidents
57
- url : investigate-cases.md
58
- - text : Microsoft Defender XDR integration with Microsoft Sentinel
59
- url : microsoft-365-defender-sentinel-integration.md
60
- - linkListType : reference
61
- links :
62
- - text : Content hub catalog
47
+ - text : Plan costs
48
+ url : billing.md
49
+ - text : Find solutions
63
50
url : sentinel-solutions-catalog.md
64
- - linkListType : learn
51
+ - linkListType : how-to-guide
65
52
links :
66
- - text : Create KQL queries for Microsoft Sentinel
67
- url : /training/paths/sc-200-utilize-kql-for-azure-sentinel/
53
+ - text : Install solutions and content
54
+ url : sentinel-solutions-deploy.md
68
55
69
56
# Card
70
57
- title : Collect data
71
58
linkLists :
72
59
- linkListType : concept
73
60
links :
61
+ - text : Microsoft Sentinel data connectors
62
+ url : connect-data-sources.md
74
63
- text : Data collection best practices
75
64
url : best-practices-data.md
76
65
- text : Normalizing and parsing data
77
66
url : normalization.md
67
+ - linkListType : tutorial
68
+ links :
69
+ - text : Forward Syslog data to Log Analytics workspace
70
+ url : forward-syslog-monitor-agent.md
78
71
- linkListType : how-to-guide
79
72
links :
80
- - text : Connect data to Microsoft Sentinel
81
- url : connect-data-sources.md
82
- - text : Connect Microsoft Defender XDR
83
- url : connect-microsoft-365-defender.md
84
73
- text : Create a custom connector
85
74
url : create-custom-connector.md
86
75
- text : Monitor connector health
87
76
url : monitor-data-connector-health.md
88
- - text : Integrate Azure Data Explorer
89
- url : store-logs-in-azure-data-explorer.md
90
77
- linkListType : reference
91
- links :
92
- - text : Data connector reference
78
+ links :
79
+ - text : Find data connectors
93
80
url : data-connectors-reference.md
94
- - text : Data source schema reference
95
- url : data-source-schema-reference.md
96
- - text : CEF log field mapping
97
- url : cef-name-mapping.md
98
- - text : Network normalization schema
99
- url : ./normalization-schema-network.md
100
-
101
- # Card (optional)
102
- - title : Kusto Query Language in Microsoft Sentinel
103
- linkLists :
104
- - linkListType : concept
105
- links :
106
- - text : Kusto Query Language in Microsoft Sentinel
107
- url : kusto-overview.md
108
- - linkListType : tutorial
109
- links :
110
- - text : Kusto Query Language tutorial (Azure Monitor)
111
- url : /azure/data-explorer/kusto/query/tutorial?pivots=azuremonitor
112
- - linkListType : learn
113
- links :
114
- - text : Write your first query with Kusto Query Language
115
- url : /training/modules/write-first-query-kusto-query-language/
116
- - text : More KQL learning and skilling resources
117
- url : kusto-resources.md
118
- - linkListType : reference
119
- links :
120
- - text : KQL quick reference guide
121
- url : /azure/data-explorer/kql-quick-reference
81
+
122
82
123
83
# Card (optional)
124
- - title : Threat intelligence
84
+ - title : Detect threats
125
85
linkLists :
126
86
- linkListType : concept
127
87
links :
128
- - text : Understand threat intelligence in Microsoft Sentinel
88
+ - text : Understand threat intelligence
129
89
url : understand-threat-intelligence.md
130
- - text : Threat intelligence integrations
131
- url : threat-intelligence-integration.md
132
- - linkListType : how-to-guide
133
- links :
134
- - text : Connect threat intelligence platforms to Microsoft Sentinel
135
- url : connect-threat-intelligence-tip.md
136
- - text : Connect Microsoft Sentinel to STIX/TAXII feeds
137
- url : connect-threat-intelligence-taxii.md
138
- - text : Work with threat indicators
139
- url : work-with-threat-indicators.md
140
-
141
- # Card (optional)
142
- - title : Threat detection
143
- linkLists :
144
- - linkListType : concept
145
- links :
90
+ - text : MITRE ATT&CK® framework
91
+ url : mitre-coverage.md
146
92
- text : User and entity behavior analytics (UEBA)
147
93
url : identify-threats-with-entity-behavior-analytics.md
148
94
- text : Customizable anomalies
149
95
url : soc-ml-anomalies.md
96
+ - linkListType : tutorial
97
+ links :
98
+ - text : Detect threats by using analytics rules
99
+ url : tutorial-log4j-detection.md
150
100
- linkListType : how-to-guide
151
101
links :
152
- - text : Use built-in analytics to detect threats
102
+ - text : Detect threats by using built-in analytics
153
103
url : detect-threats-built-in.md
154
104
- text : Create custom detection rules
155
105
url : detect-threats-custom.md
156
- - linkListType : reference
157
- links :
158
- - text : Entities reference
159
- url : entities-reference.md
160
- - text : UEBA enrichments
161
- url : ueba-reference.md
162
106
163
107
# Card (optional)
164
- - title : Threat hunting
108
+ - title : Investigate
165
109
linkLists :
166
110
- linkListType : concept
167
111
links :
168
- - text : Hunt for threats
112
+ - text : Incident investigation and case management
113
+ url : incident-investigation.md
114
+ - text : Threat hunting
169
115
url : hunting.md
170
- - linkListType : how-to-guide
171
- links :
172
- - text : Hunt with Jupyter notebooks
173
- url : notebooks.md
174
- - text : Hunt with bookmarks
175
- url : bookmarks.md
176
- - text : Hunt with livestream
177
- url : livestream.md
178
-
179
- # Card (optional)
180
- - title : Investigate
181
- linkLists :
116
+ - text : Kusto Query Language in Microsoft Sentinel
117
+ url : kusto-overview.md
182
118
- linkListType : tutorial
183
119
links :
184
120
- text : Investigate with UEBA
185
121
url : investigate-with-ueba.md
186
122
- linkListType : how-to-guide
187
123
links :
188
124
- text : Investigate incidents
189
- url : investigate-cases.md
125
+ url : investigate-incidents.md
126
+ - text : Manage incident workflow with tasks
127
+ url : work-with-tasks.md
190
128
- text : Monitor your data
191
129
url : monitor-your-data.md
192
- - linkListType : reference
193
- links :
194
- - text : Commonly used Microsoft Sentinel workbooks
195
- url : top-workbooks.md
196
-
130
+ - text : Conduct end-to-end threat hunting
131
+ url : hunts.md
197
132
198
133
# Card (optional)
199
134
- title : Respond
200
135
linkLists :
201
- - linkListType : tutorial
202
- links :
203
- - text : Respond automatically to threats
204
- url : tutorial-respond-threats-playbook.md
205
- - text : Use Jupyter Notebooks to hunt for security threats
206
- url : notebooks.md
207
136
- linkListType : concept
208
137
links :
209
138
- text : Automation rules
210
139
url : automate-incident-handling-with-automation-rules.md
211
140
- text : Playbooks
212
141
url : automate-responses-with-playbooks.md
213
- - linkListType : reference
142
+ - linkListType : tutorial
214
143
links :
215
- - text : SOAR content catalog
216
- url : sentinel-soar-content.md
217
-
218
-
219
-
144
+ - text : Respond automatically to threats
145
+ url : tutorial-respond-threats-playbook.md
220
146
221
- # Card
222
- - title : Manage Microsoft Sentinel
223
- linkLists :
224
- - linkListType : concept
225
- links :
226
- - text : Workspace architecture best practices
227
- url : best-practices-workspace-architecture.md
228
- - linkListType : how-to-guide
229
- links :
230
- - text : Design your workspace architecture
231
- url : design-your-workspace-architecture.md
232
- - text : Manage multiple tenants
233
- url : multiple-tenants-service-providers.md
234
- - text : Work with incidents in multiple workspaces
235
- url : multiple-workspace-view.md
236
- - text : Manage your intellectual property
237
- url : mssp-protect-intellectual-property.md
0 commit comments