/azure-sentinel

name: azure-sentinel
description: Expert knowledge for Azure Sentinel development including troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. Use when configuring data connectors, ASIM/KQL rules, incidents/automation, threat intel feeds, or data lake APIs, and other Azure Sentinel related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Security (use azure-security), Azure Monitor (use azure-monitor), Azure External Attack Surface Management (use azure-external-attack-surface-management).
compatibility: Requires network access. Uses mcp_microsoftdocs:microsoft_docs_fetch or fetch_webpage to retrieve documentation.
metadata:
  generated_at: "2026-08-09"
  generator: "docs2skills/1.0.0"

Azure Sentinel Skill

This skill provides expert guidance for Azure Sentinel. Covers troubleshooting, best practices, decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

> **IMPORTANT for Agent**: Use the **Category Index** below to locate relevant sections. For categories with line ranges (e.g., `L35-L120`), use `read_file` with the specified lines. For categories with file links (e.g., `[security.md](security.md)`), use `read_file` on the linked reference file

> **IMPORTANT for Agent**: If `metadata.generated_at` is more than 3 months old, suggest the user pull the latest version from the repository. If `mcp_microsoftdocs` tools are not available, suggest the user install it: [Installation Guide](https://github.com/MicrosoftDocs/mcp/blob/main/README.md)

This skill requires **network access** to fetch documentation content:

• **Preferred**: Use `mcp_microsoftdocs:microsoft_docs_fetch` with query string `from=learn-agent-skill`. Returns Markdown.
• **Fallback**: Use `fetch_webpage` with query string `from=learn-agent-skill&accept=text/markdown`. Returns Markdown.

Category Index

| Category | Lines | Description | |----------|-------|-------------| | Troubleshooting | L37-L51 | Diagnosing and fixing ingestion, connector, KQL, notebook, automation, analytics rule, and solution issues in Microsoft Sentinel, plus monitoring rule/automation health. | | Best Practices | L52-L72 | Operational and configuration guidance for Sentinel: SOC best practices, automation/playbooks, data collection, tuning/false positives, incident tasks, watchlists, anomalies, and solution lifecycle. | | Decision Making | L73-L115 | Guidance for cost planning/optimization, data tiers/retention, connector and feature choices, and migration from legacy SIEMs and SOAR tools into Microsoft Sentinel and Defender. | | Architecture & Design Patterns | L116-L127 | Designing Microsoft Sentinel architectures: workspace/tenant layouts, SIEM coexistence, BCDR, solution components, and custom security graph/data lake patterns. | | Limits & Quotas | L128-L141 | Limits, quotas, pricing, and availability of Sentinel features (NRT rules, data lake, MCP), plus watchlist size/safety, search job timeouts, ASIM issues, and removal implications. | | Security | L142-L161 | Securing Sentinel: auth/RBAC, playbook access, CMK & data residency, MSSP IP protection, SAP security setup, AWS disruption, MCP tools, storage connector hardening, and auditing data lake/graph. | | Configuration | L162-L296 | Configuring Microsoft Sentinel: data connectors, ASIM schemas, analytics rules, incidents, automation, data lake, SAP/Cloud integrations, health/audit monitoring, and threat intelligence setup. | | Integrations & Coding Patterns | L297-L340 | Patterns and code for integrating Sentinel with Logic Apps, MCP/AI tools, TIP/STIX feeds, data lake/graph APIs, KQL/ASIM, Syslog, and building automated playbooks and custom connectors. | | Deployment | L341-L354 | Deploying and customizing Sentinel solutions: CI/CD for content, ARM-based analytics/automation rules, data lake setup, SAP monitoring migration, and publishing Copilot/SIEM solutions. |

Troubleshooting

| Topic | URL | |-------|-----| | Troubleshoot AWS S3 log ingestion connector in Sentinel | https://learn.microsoft.com/en-us/azure/sentinel/aws-s3-troubleshoot | | Troubleshoot Microsoft Sentinel Azure Storage Blob connector issues | https://learn.microsoft.com/en-us/azure/sentinel/azure-storage-blob-connector-troubleshoot | | Troubleshoot Syslog and CEF AMA connectors in Sentinel | https://learn.microsoft.com/en-us/azure/sentinel/cef-syslog-ama-troubleshooting | | Troubleshoot KQL queries and jobs in Sentinel | https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-troubleshoot | | Resolve common Jupyter notebook errors in Sentinel data lake | https://learn.microsoft.com/en-us/azure/sentinel/datalake/notebooks-troubleshooting | | Best practices and troubleshooting for Sentinel MCP tools | https://learn.microsoft.com/en-us/azure/sentinel/datalake/troubleshoot-sentinel-mcp | | Troubleshoot Microsoft Sentinel solution issues | https://learn.microsoft.com/en-us/azure/sentinel/isv/troubleshoot-sentinel-solutions | | Monitor and troubleshoot Sentinel automation health | https://learn.microsoft.com/en-us/azure/sentinel/monitor-automation-health | | Monitor and troubleshoot Sentinel scheduled analytics rule execution | https://learn.microsoft.com/en-us/azure/sentinel/monitor-optimize-analytics-rule-execution | | Troubleshoot Sentinel SAP agentless connector issues | https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-deploy-troubleshoot | | Troubleshoot Microsoft Sentinel analytics rule issues | https://learn.microsoft.com/en-us/azure/sentinel/troubleshoot-analytics-rules |

Best Practices

| Topic | URL | |-------|-----| | Audit and track Microsoft Sentinel incident tasks | https://learn.microsoft.com/en-us/azure/sentinel/audit-tr