Focus area
Sentinel/KQL
SOC-ready detections, hunting queries, and workbooks.
Move past ‘enable logs’—collect the right signals, normalise data, and arm responders with KQL building blocks tied to runbook steps.
Featured runbook
SailPoint ISC to Sentinel: audit event pipeline
A self-hosted Azure pipeline that ships SailPoint Identity Security Cloud audit events into Microsoft Sentinel, and the design choices that keep it Tier 0.
Read now
Need context?
Jump into the guided path, or browse everything if you’re after something specific.
Explore other focus areas
Hop between landing zones, identity, networking, and more.