Microsoft Sentinel review

Microsoft Sentinel is used both as siem and soar solution in our customer environment . We are also sending logs from Microsoft Sentinel to prisma. We are running kql queries on Microsoft Sentinel to do threat hunting

network devices firewall devices waf devices

Microsoft Sentinel’s AI, machine learning, and analytics helped in threat hunting and removing false positives. It helped in having automated runbooks for predefined incidents

They are used for threat hunting and can document investigation. we have specific incident page and overall can create graph and investigate