I want to understand what Azure Sentinel is, and how does it work?
[Note: As we migrate from MSDN, this question has been posted by an Azure Cloud Engineer as a frequently asked question]
Azure Sentinel is a cloud-native security information and event manager (SIEM) platform that uses built-in AI to help analyze large volumes of data across an enterprise. Azure Sentinel aggregates data from all sources, including users, applications, servers, and devices running on-premises or in any cloud, letting you reason over millions of records in a few seconds. It includes built-in connectors for easy onboarding of popular security solutions. You can collect data from any source with support for open standard formats like CEF and Syslog.
5 people are following this question.