Zeema
New design
Catalogue / monitoring

Microsoft Sentinel

azureMonitoringazure-sentinel

Cloud-native SIEM and SOAR that correlates security data into incidents and automates response.

Provider
azure
Kind
Monitoring
Category
Operations
Official docs
https://learn.microsoft.com/en-us/azure/sentinel/overview
Properties · 5 set by this component
propertytypevaluesrequiredkind defaultthis component
alertGroupingboolean—nofalse▸ true
appendOnlyLogs · component propertyboolean—notrueinherited
automationPlaybooks · component propertyboolean—nofalseinherited
collectorModeenumpull | pushnopull▸ push
dataLakeTier · component propertyboolean—nofalseinherited
independentOfMonitoredboolean—nofalseinherited
logAnalyticsWorkspaceRequired · component propertyboolean—notrueinherited
managedboolean—nofalse▸ true
pricingModel · component propertyenumpay-as-you-go | commitment-tiernopay-as-you-goinherited
retentionDaysinteger—no—▸ 90
signalenummetrics | logs | traces | alerts | allnometrics▸ all
Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.
Use it in a design
nodes:
  - { id: "sentinel", component: "azure-sentinel" }
Other Monitoring products · 174
ActionTrailalibaba-actiontrailalibabacloudmonitoringApplication Real-Time Monitoring Servicealibaba-armsalibabacloudmonitoringCloudMonitoralibaba-cloud-monitoralibabacloudmonitoringDatabase Autonomy Servicealibaba-dasalibabacloudmonitoringSimple Log Servicealibaba-log-servicealibabacloudmonitoringSecurity Centeralibaba-security-centeralibabacloudmonitoringAmazon CloudWatch investigationsaws-aiopsawsmonitoringAWS Audit Manageraws-audit-managerawsmonitoringAWS CloudTrailaws-cloudtrailawsmonitoringAWS CloudTrail Lakeaws-cloudtrail-lakeawsmonitoringAmazon CloudWatch Application Insightsaws-cloudwatch-application-insightsawsmonitoringAmazon CloudWatch Application Signalsaws-cloudwatch-application-signalsawsmonitoringAmazon CloudWatch Internet Monitoraws-cloudwatch-internet-monitorawsmonitoringAmazon CloudWatch Logsaws-cloudwatch-logsawsmonitoringAmazon CloudWatch Network Flow Monitoraws-cloudwatch-network-flow-monitorawsmonitoringAmazon CloudWatch Network Monitoraws-cloudwatch-network-monitorawsmonitoringAmazon CloudWatch RUMaws-cloudwatch-rumawsmonitoringAmazon CloudWatch Syntheticsaws-cloudwatch-syntheticsawsmonitoringAmazon CodeGuru Profileraws-codeguru-profilerawsmonitoringAWS Compute Optimizeraws-compute-optimizerawsmonitoringAmazon Detectiveaws-detectiveawsmonitoringAmazon DevOps Guruaws-devops-guruawsmonitoringAmazon GuardDutyaws-guarddutyawsmonitoringAmazon Inspectoraws-inspectorawsmonitoringAWS IoT Device Defenderaws-iot-device-defenderawsmonitoringAmazon Macieaws-macieawsmonitoringAmazon Managed Grafanaaws-managed-grafanaawsmonitoringAmazon Managed Service for Prometheusaws-managed-prometheusawsmonitoringAWS Migration Hubaws-migration-hubawsmonitoringAWS Resilience Hubaws-resilience-hubawsmonitoringAWS Security Hub CSPMaws-security-hubawsmonitoringAWS Security Incident Responseaws-security-incident-responseawsmonitoringAWS Trusted Advisoraws-trusted-advisorawsmonitoringAWS X-Rayaws-xrayawsmonitoringAmazon CloudWatchcloudwatchawsmonitoringAzure Advisorazure-advisorazuremonitoringApplication Insightsazure-application-insightsazuremonitoringMicrosoft Defender External Attack Surface Managementazure-defender-easmazuremonitoringMicrosoft Defender for Cloudazure-defender-for-cloudazuremonitoringMicrosoft Defender for IoTazure-defender-for-iotazuremonitoring
and 134 more → Monitoring page
Source
# yaml-language-server: $schema=../../schema/component.schema.json
# Microsoft Sentinel: cloud-native SIEM and SOAR on a Log Analytics workspace. Analytics group
# alerts into incidents, and the log platform is append-only and tamper-proof ("What is Microsoft
# Sentinel SIEM?"). All data ingested is retained free for the first 90 days and pay-as-you-go is
# the default pricing model ("Plan costs and understand pricing and billing").
schemaVersion: "1"
type: "component"
id: "azure-sentinel"
kind: "monitoring"
provider: "azure"
docs: "https://learn.microsoft.com/en-us/azure/sentinel/overview"
defaults:
  managed: true
  signal: "all"
  collectorMode: "push"
  alertGrouping: true
  retentionDays: 90
properties:
  pricingModel:
    type: "enum"
    values: ["pay-as-you-go", "commitment-tier"]
    default: "pay-as-you-go"
  logAnalyticsWorkspaceRequired:
    type: "boolean"
    default: true
  appendOnlyLogs:
    type: "boolean"
    default: true
  automationPlaybooks:
    type: "boolean"
    default: false
  dataLakeTier:
    type: "boolean"
    default: false

The same page as markdown, for an agent: /catalogue/components/azure-sentinel.md