Focus area

Sentinel

Deep dives covering Sentinel.

Guides, runbooks, and opinions focused on Sentinel.

Featured runbook

Sentinel cost control: tiers, commitment and filtering

A Sentinel cost control runbook: pick the right tier, set a commitment, filter at ingestion and monitor spend, with the Defender portal move in mind.

Need context?

Jump into the guided path, or browse everything if you’re after something specific.

Start Here Browse all runbooks

Explore other focus areas

Hop between landing zones, identity, networking, and more.

Landing Zones Identity Secure Networking Defender for Cloud Sentinel/KQL Networking

More in Sentinel

18 Oct 2026 12 min read

Sentinel Defender portal move: runbook and checks

Learn gives 31 March 2027 for the Sentinel Defender portal move. What changes for roles, automation and workspaces, and a runbook to onboard safely.

Sentinel Defender SIEM

17 Oct 2026 9 min read

Sentinel analytics rules to enable first

How to pick Sentinel analytics rules to enable first: content hub templates, data source checks, false-positive tuning and the Defender portal.

Sentinel SIEM Detection