Implement activity and event collection in Microsoft Sentinel - Part 3

After exploring Sentinel workspace configuration and the collection of security events from Microsoft services, Syslog, CEF, and Windows hosts, this session moves into two important areas of operating Microsoft Sentinel effectively: security automation and data lifecycle management.

Led by Musbau Olagunju, Senior Security Engineer, participants will learn how to automate incident-management activities with automation rules and Azure Logic Apps playbooks, as well as manage log storage, retention, and audit data in Microsoft Sentinel.

Modern SOC teams process large numbers of security alerts and incidents. Performing every triage, enrichment, notification, and response activity manually doesn't scale.

Microsoft Sentinel provides automation rules and playbooks that allow SOC teams to automate repetitive incident-management processes and orchestrate responses using Azure Logic Apps.

At the same time, organizations need an effective strategy for storing security telemetry. Retention requirements, compliance obligations, investigation periods, and ingestion costs all influence how Sentinel data should be managed. This session brings these two operational areas together.

By the end of this session, participants should be able to:

• Explain the difference between Sentinel automation rules and playbooks
• Create automation rules for incident-management activities
• Deploy and activate prebuilt playbooks from Content Hub
• Build custom playbooks using Azure Logic Apps
• Connect playbooks to Sentinel automation rules
• Design automated incident notification and response workflows
• Create custom log tables for additional security telemetry
• Configure appropriate log retention strategies
• Understand Analytics and Archive retention options
• Integrate Microsoft Purview Audit with Sentinel
• Query audit information for security investigations
• Design a more scalable approach to Sentinel data retention and SOC automation

These capabilities form part of Microsoft's broader Sentinel event-collection and response architecture, which progresses from workspace configuration and data collection through automated response, retention, and audit-log management.

Who should attend the session

This session is ideal for SOC Analysts, Security Engineers, Microsoft Sentinel Engineers, Cloud Security Engineers, Security Architects, SIEM Engineers, Incident Responders, Threat Hunters, Azure Administrators, DevSecOps Engineers, and cybersecurity professionals who want practical experience operating Microsoft Sentinel.

It is also particularly relevant for professionals preparing for SC-500, whose current study guide includes Sentinel automation rules and playbooks, data retention, custom log tables, and querying Microsoft Purview Audit in Defender XDR.

Collect the data. Automate the response. Retain what matters.

Learn | Connect | Grow | Secure