Platform · Security

Microsoft Sentinel and Defender

Running inside Azure, Microsoft Sentinel collects security data from Microsoft 365, the Defender products, other clouds and third-party sources, while Defender XDR correlates attacks across endpoints, identities, email and cloud apps. SOC analysts investigate in both, querying with KQL, and the SC-200 exam certifies the work. Pricing follows ingested data, so connecting every log source without a plan quickly becomes expensive.

Maker's site: www.microsoft.com/security/business/siem-and-xdr/microsoft-sentinel-siem (opens in a new tab) (no commission).