https://securitynews.ms/products/microsoft-sentinel/Microsoft Sentinel news and documented product changes, each linked to Microsoft's own source.enFri, 30 Oct 2026 16:44:57 +0000https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-october-2026/ba-p/4568804https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-october-2026/ba-p/4568804Fri, 30 Oct 2026 16:44:57 +0000Microsoft Sentinel BlogWelcome back to What's new in Microsoft Sentinel. In October, cross-tenant delegated access reaches general availability so you can run security operations across tenants with least privilege, the Advanced Security Information Model (ASIM) EmailEvent schema gives you one consistent structure for email…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/growing-our-connector-ecosystem-with-500-microsoft-sentinel/ba-p/4567832https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/growing-our-connector-ecosystem-with-500-microsoft-sentinel/ba-p/4567832Wed, 28 Oct 2026 16:00:00 +0000Microsoft Sentinel BlogConnecting the modern security environment Having spent years working across Microsoft's cloud, AI, and customer-facing organizations. I have seen that technology delivers the greatest value when it works with the environments customers already operate. That's especially true in cybersecurity. Most organizations rely…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/manage-all-your-microsoft-sentinel-data-in-one-place-with/ba-p/4565940https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/manage-all-your-microsoft-sentinel-data-in-one-place-with/ba-p/4565940Tue, 20 Oct 2026 19:34:43 +0000Microsoft Sentinel BlogAs security teams bring in more data from more sources and use it across SIEM and XDR workflows, decisions about connector health, ingestion volume, and cost optimization get harder. Today, we’re announcing the public preview of Unified Data Management for Microsoft Sentinel…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/expanded-cross-tenant-delegated-access-in-microsoft-defender-is/ba-p/4565941https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/expanded-cross-tenant-delegated-access-in-microsoft-defender-is/ba-p/4565941Tue, 20 Oct 2026 17:24:44 +0000Microsoft Sentinel BlogSecurity operations rarely stop at a single tenant boundary. Managed security service providers (MSSPs) protect many customer environments, and central security teams often operate across a tenant estate spanning business units, regions, or subsidiaries. In both cases, teams need to delegate security…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/introducing-the-microsoft-sentinel-asim-emailevent-schema/ba-p/4562581https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/introducing-the-microsoft-sentinel-asim-emailevent-schema/ba-p/4562581Wed, 07 Oct 2026 20:21:05 +0000Microsoft Sentinel BlogEmail remains one of the most common entry points for security threats. Yet email products often describe the same activity with different table names, fields, and values. This makes it harder to build detections and investigations that work consistently across data sources…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#detect-use-of-vulnerable-sap-btp-custom-apps-previewhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#detect-use-of-vulnerable-sap-btp-custom-apps-previewThu, 01 Oct 2026 00:00:00 +0000Sentinel · Microsoft LearnThe SAP BTP solution adds an analytics rule that correlates SAP Application Vulnerability Report findings with BTP audit logs to detect use of custom apps with open high or critical vulnerabilities. The rule identifies interactive XSUAA logins that match a…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-september-2026/ba-p/4560902https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-september-2026/ba-p/4560902Wed, 30 Sep 2026 16:00:00 +0000Microsoft Sentinel BlogWelcome back to What's new in Microsoft Sentinel. In September, Case Management brings investigation and collaboration together in Microsoft Defender, with a shared workspace to track work through resolution. Defender unified RBAC custom roles for granular delegated admin privileges (GDAP) give you…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/public-preview-multi-account-support-for-microsoft-sentinel/ba-p/4544380https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/public-preview-multi-account-support-for-microsoft-sentinel/ba-p/4544380Mon, 14 Sep 2026 18:13:41 +0000Microsoft Sentinel BlogSecurity teams rarely have just one of anything. Most SOCs run separate production, staging, and development accounts. Large enterprises segment by region, business unit, or brand. And managed security service providers (MSSPs) watch over many customers at once. Traditionally, ISVs have used…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#use-sentinel-mcp-triage-collection-to-query-datahttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#use-sentinel-mcp-triage-collection-to-query-dataTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnUse the triage collection in the Microsoft Sentinel MCP server to discover and query data using MCP tools. Use the list advanced hunting tables tool to return a list of all available tables in the built-in data lake. Use the…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#use-microsoft-fabric-for-data-federationhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#use-microsoft-fabric-for-data-federationTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnWhen cost, governance, or compliance requirements prevent data movement, customers can query the data where it resides using data federation. Using Data federation, you can enrich investigations with context from data stored outside the data lake. You can use Microsoft…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#use-microsoft-fabric-for-custom-security-analyticshttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#use-microsoft-fabric-for-custom-security-analyticsTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnMicrosoft Fabric enables custom analytics across data lake tables and external data tables. You can use KQL , notebooks , scheduled jobs , and custom graphs within Microsoft Fabric to analyze and enrich data at scale and then store results…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#run-interactive-kql-queries-in-advanced-huntinghttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#run-interactive-kql-queries-in-advanced-huntingTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnInteractive Kusto Query Language (KQL) queries on the data lake are now available using Advanced Hunting under Investigation & Response in the Defender portal. Use the Advanced Hunting page to investigate data from both Microsoft Sentinel and Microsoft Defender XDR…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#mirror-the-data-lake-tier-to-microsoft-fabric-onelakehttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#mirror-the-data-lake-tier-to-microsoft-fabric-onelakeTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnUsing the Azure Monitor mirroring feature, you can select the Microsoft Sentinel workspace tables you want to expose in Microsoft Fabric. The mirroring feature doesn't create a copy of the data and incurs no additional charge. The data remains in…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#integrated-microsoft-sentinel-siem-and-data-lake-onboardinghttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#integrated-microsoft-sentinel-siem-and-data-lake-onboardingTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnThe data lake comes integrated with Microsoft Sentinel and continues as the low-cost ingestion and storage tier for long-term retention inside Sentinel. Going forward, you do not need to go through a separate data lake onboarding and billing setup. You…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#enable-the-data-lake-tier-using-table-managementhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#enable-the-data-lake-tier-using-table-managementTue, 01 Sep 2026 00:00:00 +0000Sentinel · Microsoft LearnOnce you've onboarded to Microsoft Sentinel in Defender portal, you can use the Table Management page to enable the data lake tier. Select a table, and then select Retention to view data-retention settings . From here, you can mirror data…https://techcommunity.microsoft.com/t5/microsoft-security-community/introducing-multi-account-support-for-connectors-in-microsoft/ba-p/4546440https://techcommunity.microsoft.com/t5/microsoft-security-community/introducing-multi-account-support-for-connectors-in-microsoft/ba-p/4546440Mon, 31 Aug 2026 16:46:37 +0000Microsoft Security Community BlogWe're excited to announce that Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion — enabling you to connect and monitor multiple accounts or tenants from a single, unified connector configuration. The Challenge with Multi-Account…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-august-2026/ba-p/4551405https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-august-2026/ba-p/4551405Mon, 31 Aug 2026 16:00:00 +0000Microsoft Sentinel BlogWelcome back to What's new in Microsoft Sentinel. This August, Sentinel innovation kicks off with the AI-powered playbook generator, generally available to all Sentinel customers in the Microsoft Defender portal. Meanwhile, User and Entity Behavior Analytics (UEBA) anomalies enter public preview on…https://techcommunity.microsoft.com/t5/microsoft-security-community/one-soc-many-tenants-centralizing-microsoft-sentinel-with-azure/ba-p/4543629https://techcommunity.microsoft.com/t5/microsoft-security-community/one-soc-many-tenants-centralizing-microsoft-sentinel-with-azure/ba-p/4543629Mon, 31 Aug 2026 16:00:00 +0000Microsoft Security Community BlogMost large organizations don’t live in a single Microsoft Entra ID tenant. Acquisitions, regulatory separation, sovereignty mandates, and mission boundaries all multiply tenants over time. For a security operations team, that sprawl creates one hard question: how do you run a single…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/smarter-signals-broader-coverage-ueba-anomalies-on-top-of/ba-p/4544384https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/smarter-signals-broader-coverage-ueba-anomalies-on-top-of/ba-p/4544384Tue, 18 Aug 2026 18:39:45 +0000Microsoft Sentinel BlogCo-authors: Ron Shlomo and Ryan Smith Security teams don't struggle with a lack of security signals. The real challenge is understanding which activity matters, why it stands out, and where to focus first. Microsoft Sentinel's Behaviors layer already helps analysts transform raw…https://azure.microsoft.com/updates?id=568457https://azure.microsoft.com/updates?id=568457Wed, 12 Aug 2026 19:41:20 +0000Azure UpdatesOn September 14, 2026 we will retire the containerized data connector agent for the Microsoft Sentinel solution for SAP applications. After this date the agent will be permanently disabled and will stop sending SAP logs to Microsoft Sentinel.The SAP agenthttps://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/building-microsoft-sentinel-connectors-in-minutes-with-the/ba-p/4544378https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/building-microsoft-sentinel-connectors-in-minutes-with-the/ba-p/4544378Tue, 11 Aug 2026 16:00:00 +0000Microsoft Sentinel BlogOverview We previously announced the public preview of the Microsoft Sentinel connector builder agent via VS code extension, that helps developers build Microsoft Sentinel codeless connectors faster with low-code and AI-assisted prompts. This post walks through a hands-on lab using a mock…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ai-powered-playbook-generator-now-available-to-more-customers/ba-p/4544385https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/ai-powered-playbook-generator-now-available-to-more-customers/ba-p/4544385Fri, 07 Aug 2026 19:28:40 +0000Microsoft Sentinel BlogWe’re excited to announce we’re making it easier than ever to go from intent to action with the AI-powered playbook generator now available to more customers. What’s new All Microsoft Sentinel customers in Defender portal can now create AI-generated playbooks directly in…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/public-preview-nested-api-support-comes-to-microsoft-sentinel/ba-p/4537026https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/public-preview-nested-api-support-comes-to-microsoft-sentinel/ba-p/4537026Fri, 07 Aug 2026 17:15:55 +0000Microsoft Sentinel BlogMicrosoft Sentinel continues to evolve its capabilities to support an expanding ecosystem of partners and data integrations. Recent innovations include the Codeless Connector Framework (CCF) Push feature , the new Sentinel connector builder agent , and the CCF expansion to pull data…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/building-a-ccf-nested-api-pull-connector-a-technical-lab/ba-p/4537027https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/building-a-ccf-nested-api-pull-connector-a-technical-lab/ba-p/4537027Wed, 05 Aug 2026 16:00:00 +0000Microsoft Sentinel BlogThis post walks through building a Microsoft Sentinel Codeless Connector Framework (CCF) RestApiPoller connector that uses the nested API polling pattern. The nested pattern exists for a specific reason: many enterprise APIs do not return enriched records from a single call. Instead…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#ueba-anomalies-on-behaviors-previewhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#ueba-anomalies-on-behaviors-previewSat, 01 Aug 2026 00:00:00 +0000Sentinel · Microsoft LearnMicrosoft Sentinel now adds contextual anomaly insights directly to UEBA behavior records. These insights help analysts identify first-seen activity, unusually high behavior volumes, uncommon values, and threat intelligence matches without manually correlating raw events. For more information, see Investigate anomalies…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#sap-solution-releaseshttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#sap-solution-releasesSat, 01 Aug 2026 00:00:00 +0000Sentinel · Microsoft LearnThe SAP agentless solution version 1.1.12 adds audit log performance enhancements and the force-sal-filesystem parameter. The SAP BTP solution version 3.1.1 adds an analytic rule for unaudited custom apps with login-only activity and renames analytic rules with the SAP BTP…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#new-data-sources-for-ueba-behaviors-and-anomaly-detection-previewhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#new-data-sources-for-ueba-behaviors-and-anomaly-detection-previewSat, 01 Aug 2026 00:00:00 +0000Sentinel · Microsoft LearnMicrosoft Sentinel UEBA expands coverage with new data sources for both the behaviors layer and anomaly detection. Fortinet FortiGate behaviors The UEBA behaviors layer now supports Fortinet FortiGate firewall events from the CommonSecurityLog table. More than 40 new behaviors identify…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-july-2026/ba-p/4542130https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-july-2026/ba-p/4542130Fri, 31 Jul 2026 16:00:00 +0000Microsoft Sentinel BlogWelcome back to What's new in Microsoft Sentinel. In July, Sentinel adds custom detections support in Sentinel repositories, so you can manage detections as code alongside your analytics rules, playbooks, parsers, and workbooks, authoring in GitHub and deploying through the CI/CD pipelines…https://techcommunity.microsoft.com/blog/microsoftsentinelblog/run-agentless-sap-connector-cost-efficiently/4464781https://techcommunity.microsoft.com/blog/microsoftsentinelblog/run-agentless-sap-connector-cost-efficiently/4464781Thu, 16 Jul 2026 12:54:31 +0000Microsoft Sentinel BlogThe SAP agentless connector uses SAP Integration Suite (Cloud Integration/CPI) to fetch SAP audit log data and forward it to Microsoft Sentinel. Because SAP...https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-asim-parser-creation-agentic-experience/ba-p/4532266https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-asim-parser-creation-agentic-experience/ba-p/4532266Wed, 15 Jul 2026 16:00:00 +0000Microsoft Sentinel BlogCreating high-quality ASIM parsers has always required deep knowledge about source data and ASIM schemas, careful KQL design, and repeated validation cycles. That process is meaningful to understand the whole Sentinel ecosystem, but it can be slow when you are starting from…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/building-toward-an-agentic-soc-a-portable-autonomous-malware/ba-p/4526872https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/building-toward-an-agentic-soc-a-portable-autonomous-malware/ba-p/4526872Mon, 13 Jul 2026 19:09:25 +0000Microsoft Sentinel BlogModern Security Operations Centers are not short on tools. They are short on continuity. Analysts jump from alert consoles to data exploration, from enrichment to investigation, and from evidence gathering to response—often across multiple interfaces and disconnected workflows. A single malware incident…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/behind-the-build-with-gigamon-enriching-microsoft-sentinel-with/ba-p/4530360https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/behind-the-build-with-gigamon-enriching-microsoft-sentinel-with/ba-p/4530360Wed, 01 Jul 2026 17:51:59 +0000Microsoft Sentinel BlogBehind the Build is an ongoing series spotlighting standout Microsoft partner collaborations. Each edition dives into the technical and strategic decisions that shape real-world integrations—highlighting engineering excellence, innovation, and the shared customer value created through partnership. Security teams…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#custom-detection-rules-support-in-microsoft-sentinel-repositories-previewhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#custom-detection-rules-support-in-microsoft-sentinel-repositories-previewWed, 01 Jul 2026 00:00:00 +0000Sentinel · Microsoft LearnYou can now manage custom detection rules as code in your GitHub or Azure DevOps repository using the Microsoft Security BICEP extension. Sync custom detection rules to Microsoft Sentinel using the Repositories feature, or deploy them directly using BICEP CLI…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-june-2026/ba-p/4531902https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-in-microsoft-sentinel-june-2026/ba-p/4531902Tue, 30 Jun 2026 16:43:18 +0000Microsoft Sentinel BlogWelcome back to What's new in Microsoft Sentinel. In June, Sentinel SIEM’s Advanced Security Information Model (ASIM) broadens its normalization, so one analytic rule can reach more sources with less per-source work and, additionally, two new ASIM schemas can now bring asset…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/the-ai-first-soc-copilot-ueba-threat-intelligence-and-soc/ba-p/4528609https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/the-ai-first-soc-copilot-ueba-threat-intelligence-and-soc/ba-p/4528609Tue, 30 Jun 2026 16:00:00 +0000Microsoft Sentinel BlogCo-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl The portal change was the easy part. The real upside is the operating model it unlocks—generative AI in every workflow, behavioral analytics across hybrid and multi-cloud, native threat intelligence, and SOC…https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/your-readiness-playbook-adoption-helper-costs-apis-and-the/ba-p/4528608https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/your-readiness-playbook-adoption-helper-costs-apis-and-the/ba-p/4528608Mon, 29 Jun 2026 16:00:00 +0000Microsoft Sentinel BlogCo-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl The transition is not a project—it is a sequence of small, ordered decisions. Here is the readiness tool that scores your environment in minutes, the cost story you can take to…https://techcommunity.microsoft.com/blog/microsoft-security-blog/understand-your-sentinel-tables-at-a-glance-monitor-with-table-insights/4530738https://techcommunity.microsoft.com/blog/microsoft-security-blog/understand-your-sentinel-tables-at-a-glance-monitor-with-table-insights/4530738Fri, 26 Jun 2026 18:56:08 +0000Microsoft Tech CommunityWhat it is Table insights is a new panel on the Sentinel Tables page that gives you 30-day ingestion volume per tier, day-over-week fluctuations, the top 5...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/the-governance-shift-rbac-urbac-data-lake-and-mssp/4528607https://techcommunity.microsoft.com/blog/microsoftsentinelblog/the-governance-shift-rbac-urbac-data-lake-and-mssp/4528607Thu, 25 Jun 2026 20:07:27 +0000Microsoft Sentinel BlogCo-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Governance is the silent dependency every transition trips on. Read about how roles,...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/a-guide-to-innovating-threat-hunting-with-microsoft-sentinel-custom-graph/4530287https://techcommunity.microsoft.com/blog/microsoftsentinelblog/a-guide-to-innovating-threat-hunting-with-microsoft-sentinel-custom-graph/4530287Wed, 24 Jun 2026 18:06:41 +0000Microsoft Sentinel BlogMicrosoft Sentinel platform offers a growing list of tools and features, with graph being a cornerstone capability. Sentinel graph is a relationship-first...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/detection-and-automation-reimagined/4527933https://techcommunity.microsoft.com/blog/microsoftsentinelblog/detection-and-automation-reimagined/4527933Thu, 18 Jun 2026 18:31:03 +0000Microsoft Sentinel BlogCo-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl How analytics rules, playbooks, workbooks, and hunting evolve in Defender—and why the...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/introducing-new-additions-to-microsoft-sentinel-normalization-and-asim/4524584https://techcommunity.microsoft.com/blog/microsoftsentinelblog/introducing-new-additions-to-microsoft-sentinel-normalization-and-asim/4524584Tue, 16 Jun 2026 22:32:33 +0000Microsoft Tech CommunityTL;DR: New ASIM parsers for Azure Firewall, Key Vault, AWS CloudTrail (EC2, S3, IAM), and 10+ third-party products. Two new schemas — Asset Entities and AI...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/anatomy-of-the-change/4527934https://techcommunity.microsoft.com/blog/microsoftsentinelblog/anatomy-of-the-change/4527934Tue, 16 Jun 2026 17:45:52 +0000Microsoft Sentinel BlogCo-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Incidents, alerts, correlation, and data—what actually changes with the new platform,...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/announcing-public-preview-agent-identities-asset-connector-for-microsoft-sentine/4527960https://techcommunity.microsoft.com/blog/microsoftsentinelblog/announcing-public-preview-agent-identities-asset-connector-for-microsoft-sentine/4527960Tue, 16 Jun 2026 16:59:51 +0000Microsoft Tech CommunityAs organizations accelerate adoption of AI agents across Microsoft 365 and enterprise environments, security teams face a fundamental shift: Agents are...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/transform-your-security-operation-with-a-unified-experience-in-defender/4527932https://techcommunity.microsoft.com/blog/microsoftsentinelblog/transform-your-security-operation-with-a-unified-experience-in-defender/4527932Tue, 16 Jun 2026 15:17:52 +0000Microsoft Sentinel BlogCo-authored with Lizet Pena, Caroline Mutua, Alvin Kua and Marco Sudahl Security operations teams today are being asked to do more than ever: respond faster,...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/the-worm-in-the-supply-chain-how-defender-for-endpoint-and-sentinel-for-sap-btp-/4526246https://techcommunity.microsoft.com/blog/microsoftsentinelblog/the-worm-in-the-supply-chain-how-defender-for-endpoint-and-sentinel-for-sap-btp-/4526246Mon, 08 Jun 2026 10:52:16 +0000Microsoft Sentinel BlogOn 29 April 2026, malicious versions of multiple SAP ecosystem npm packages were briefly published, creating a supply-chain exposure for SAP Cloud...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/what%e2%80%99s-new-in-microsoft-sentinel-may-2026/4523419https://techcommunity.microsoft.com/blog/microsoftsentinelblog/what%e2%80%99s-new-in-microsoft-sentinel-may-2026/4523419Thu, 04 Jun 2026 10:07:32 +0000Microsoft Sentinel BlogWelcome to the May edition of What's new in Microsoft Sentinel. This month’s updates focus on unified role-based access control (RBAC), ecosystem breadth,...https://techcommunity.microsoft.com/blog/microsoft-security-blog/amazon-security-lake-integration-with-microsoft-sentinel-parquet-at-the-gates/4516635https://techcommunity.microsoft.com/blog/microsoft-security-blog/amazon-security-lake-integration-with-microsoft-sentinel-parquet-at-the-gates/4516635Wed, 03 Jun 2026 07:12:06 +0000Microsoft Security Community BlogThis blog has been jointly published by and . In this blog post, we explore how centralized AWS Security Lake data can be transformed and streamed into...https://techcommunity.microsoft.com/blog/microsoftsentinelblog/introducing-the-next-generation-of-soc-automation-sentinel-playbook-generator/4494438https://techcommunity.microsoft.com/blog/microsoftsentinelblog/introducing-the-next-generation-of-soc-automation-sentinel-playbook-generator/4494438Mon, 01 Jun 2026 15:25:21 +0000Microsoft Sentinel BlogSecurity teams today operate under constant pressure. They are expected to respond faster, automate more, and do so without sacrificing precision....https://learn.microsoft.com/en-us/azure/sentinel/whats-new#reason-over-microsoft-sentinel-graphs-with-graph-tool-previewhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#reason-over-microsoft-sentinel-graphs-with-graph-tool-previewMon, 01 Jun 2026 00:00:00 +0000Sentinel · Microsoft LearnThe graph tool collection in the Microsoft Sentinel Model Context Protocol (MCP) server provides visual graph-based exploration of relationships across identities, devices, threats, and signals to assess coverage, dependencies, and configuration gaps. For more information, see Explore Microsoft Sentinel graphs…https://learn.microsoft.com/en-us/azure/sentinel/whats-new#link-behavior-results-to-incidents-in-advanced-hunting-previewhttps://learn.microsoft.com/en-us/azure/sentinel/whats-new#link-behavior-results-to-incidents-in-advanced-hunting-previewMon, 01 Jun 2026 00:00:00 +0000Sentinel · Microsoft LearnYou can now link behavior-based query results from the BehaviorInfo table to new or existing incidents in advanced hunting. This feature lets you enrich incident context with behavior records from Microsoft Sentinel UEBA. The wizard automatically populates alert metadata and…