Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article describes the features available in Microsoft Sentinel across different Azure environments. Features are listed as GA (generally available), public preview, or shown as not available.
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Analytics rules health | Public preview | ✅ | ❌ |
MITRE ATT&CK dashboard | Public preview | ✅ | ✅ |
NRT rules | GA | ✅ | ✅ |
Recommendations | Public preview | ✅ | ❌ |
Scheduled and Microsoft rules | GA | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Content hub and solutions | GA | ✅ | ✅ |
Repositories | Public preview | ✅ | ❌ |
Workbooks | GA | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Amazon Web Services | GA | ✅ | ❌ |
Amazon Web Services S3 | GA | ✅ | ❌ |
Microsoft Entra ID | GA | ✅ | ✅ 1 |
Microsoft Entra ID Protection | GA | ✅ | ❌ |
Azure Activity | GA | ✅ | ✅ |
Azure DDoS Protection | GA | ✅ | ❌ |
Azure Firewall | GA | ✅ | ✅ |
Azure Information Protection (Preview) | Deprecated | ❌ | ❌ |
Azure Key Vault | Public preview | ✅ | ✅ |
Azure Kubernetes Service (AKS) | Public preview | ✅ | ✅ |
Azure SQL Databases | GA | ✅ | ✅ |
Azure Web Application Firewall (WAF) | GA | ✅ | ✅ |
Cisco ASA | GA | ✅ | ✅ |
Codeless Connectors Platform | Public preview | ✅ | ❌ |
Common Event Format (CEF) | GA | ✅ | ✅ |
Common Event Format (CEF) via AMA | GA | ✅ | ✅ |
DNS | Public preview | ✅ | ✅ |
GCP Pub/Sub Audit Logs | Public preview | ✅ | ❌ |
Microsoft Defender XDR | GA | ✅ | ❌ |
Microsoft Purview Insider Risk Management (Preview) | Public preview | ✅ | ❌ |
Microsoft Defender for Cloud | GA | ✅ | ✅ |
Microsoft Defender for IoT | GA | ✅ | ❌ |
Microsoft Power BI (Preview) | Public preview | ✅ | ❌ |
Microsoft Project (Preview) | Public preview | ✅ | ❌ |
Microsoft Purview (Preview) | Public preview | ✅ | ❌ |
Microsoft Purview Information Protection | Public preview | ✅ | ❌ |
Office 365 | GA | ✅ | ✅ |
Syslog | GA | ✅ | ✅ |
Syslog via AMA | GA | ✅ | ✅ |
Windows DNS Events via AMA | GA | ✅ | ✅ |
Windows Firewall | GA | ✅ | ✅ |
Windows Forwarded Events | GA | ✅ | ✅ |
Windows Security Events via AMA | GA | ✅ | ✅ |
1 Supports only sign-in logs and audit logs.
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Bookmarks | GA | ✅ | ✅ |
Hunts | Public preview | ✅ | ❌ |
Livestream | GA | ✅ | ✅ |
Queries | GA | ✅ | ✅ |
Restore historical data | GA | ✅ | ✅ |
Search large datasets | GA | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Add entities to threat intelligence | Public preview | ✅ | ✅ |
Advanced and/or conditions | GA | ✅ | ✅ |
Automation rules | GA | ✅ | ✅ |
Automation rules health | Public preview | ✅ | ❌ |
Create incidents manually | GA | ✅ | ✅ |
Cross-tenant/Cross-workspace incidents view | GA | ✅ | ✅ |
Incident advanced search | GA | ✅ | ✅ |
Incident tasks | GA | ✅ | ✅ |
Microsoft 365 Defender incident integration | GA | ✅ | ❌ |
Microsoft Teams integrations | Public preview | ✅ | ❌ |
Playbook template gallery | Public preview | ✅ | ❌ |
Run playbooks on entities | GA | ✅ | ✅ |
Run playbooks on incidents | GA | ✅ | ✅ |
SOC incident audit metrics | GA | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Anomalous RDP login detection - built-in ML detection | Public preview | ✅ | ❌ |
Anomalous SSH login detection - built-in ML detection | Public preview | ✅ | ❌ |
Fusion - advanced multistage attack detections 1 | GA | ✅ | ✅ |
1 Partially GA: The ability to disable specific findings from vulnerability scans is in public preview.
Feature | Feature stage | Azure commercial | Azure China 21Vianet |
---|---|---|---|
Workspace manager | Public preview | ✅ | ❌ |
SIEM migration experience | GA | ✅ | ❌ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Advanced Security Information Model (ASIM) | Public preview | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Notebooks | GA | ✅ | ✅ |
Notebook integration with Azure Synapse | Public preview | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Threat protection for SAP | GA | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
GeoLocation and WhoIs data enrichment | Public preview | ✅ | ❌ |
Import TI from flat file | Public preview | ✅ | ✅ |
Threat Intelligence Platform data connector | Public preview | ✅ | ❌ |
Threat Intelligence Research page | GA | ✅ | ✅ |
Threat Intelligence - TAXII data connector | GA | ✅ | ✅ |
Microsoft Defender for Threat Intelligence connector | Public preview | ✅ | ❌ |
Microsoft Defender Threat intelligence matching analytics | Public preview | ✅ | ❌ |
Threat Intelligence workbook | GA | ✅ | ✅ |
URL detonation | Public preview | ✅ | ❌ |
Threat Intelligence Upload Indicators API | Public preview | ✅ | ❌ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Active Directory sync via MDI | Public preview | ✅ | ❌ |
Azure resource entity pages | Public preview | ✅ | ❌ |
Entity insights | GA | ✅ | ✅ |
Entity pages | GA | ✅ | ✅ |
Identity info table data ingestion | GA | ✅ | ✅ |
IoT device entity page | Public preview | ✅ | ❌ |
Peer/Blast radius enrichments | Public preview | ✅ | ❌ |
SOC-ML anomalies | GA | ✅ | ❌ |
UEBA anomalies | GA | ✅ | ❌ |
UEBA enrichments\insights | GA | ✅ | ✅ |
Feature | Feature stage | Azure commercial | Microsoft Azure operated by 21Vianet |
---|---|---|---|
Large watchlists from Azure Storage | Public preview | ✅ | ✅ |
Watchlists | GA | ✅ | ✅ |
Watchlist templates | Public preview | ✅ | ✅ |
In this article, you learned about available features in Microsoft Sentinel.