Manage a security operations environment

When preparing to handle a burst of failed sign-ins on a server, plan for four jobs: something must collect the sign-in events into a table, the platform must store and govern that table (keep it where analytics rules can read it, as long as needed, let the right people act on it, report on it, and weigh its cost), an analytics rule must detect the pattern and raise an alert, and automate settings can decide what happens without an analyst. This domain sets up all four, Collect, Store and govern, Detect, and Automate, across two products. Microsoft Defender XDR (extended detection and response) correlates signals from the Microsoft security products you license and deploy, such as Defender for Endpoint on devices and Defender for Office 365 on email, while Microsoft Sentinel is a cloud SIEM (security information and event management) service whose workspace holds data you connect to it with data connectors. Automate is the one job that acts at both ends of the path: on the device, where Defender for Endpoint blocks a risky behavior before any alert exists, and after detection, where built-in response and your own workflows act on alerts and incidents. The classic trap is assuming that configuring one job performs the next: installing a Content hub solution (a package that can bundle a data connector, analytics rule templates, and workbooks) does not connect a source, ingested threat indicators raise no alert until an analytics rule matches them, and hiding the alert for a blocked file with an alert tuning rule does not let that file run.

Read each subtopic as a job, not a step in signal order. The automation subtopic covers Automate: Defender for Endpoint device settings such as attack surface reduction (ASR) rules and indicators (your own allow, warn, or block entries that devices enforce, not the threat indicators Sentinel stores), alert tuning rules that hide or resolve alerts already raised, email notification rules, automated investigation and remediation (AIR), automatic attack disruption, and Sentinel automation rules and playbooks. Since September 1, 2026, Defender for Endpoint AIR no longer runs as a separate investigation experience or supports manual triggering; its detection and response capabilities run automatically in Defender for Endpoint's default antivirus protection stack. Defender for Endpoint custom data collection, which sends extra device events to Sentinel, is Collect work this subtopic also covers. The Sentinel platform subtopic covers Store and govern: Sentinel roles, table tiers and retention, workbooks for reporting, and SOC (security operations center) optimization recommendations that weigh each table's cost against its value. The ingestion subtopic covers Collect: data connectors and the collection paths (the Azure Monitor Agent, which follows data collection rules; diagnostic settings; threat intelligence ingestion; and the Logs Ingestion API), each landing a source in a table. The detections subtopic covers Detect: Defender XDR custom detections and Sentinel analytics rules, such as scheduled and near-real-time (NRT) rules, that turn stored data into alerts, plus anomaly rules and MITRE ATT&CK coverage analysis. The word rule alone never names the job: ASR, alert tuning, email notification, and automation rules Automate, data collection rules Collect, and analytics rules Detect.

Two questions separate the options: who writes the logic, a provider such as Microsoft or you, and how much access the answer grants. The stronger answer usually reuses ready-made content with the narrowest access. An automation rule can tag, assign, or close incidents without a playbook; a Content hub solution's connector writes to the table the solution's rule templates and workbooks already query, though another organization may author it; a rule template or threat intelligence matching saves writing a KQL (Kusto Query Language) query from scratch; and an analyst who only manages incidents gets Microsoft Sentinel Responder, not Contributor, because Contributor also creates and edits content. Write your own logic only when the provided option cannot meet the requirement.