Microsoft Sentinel workspace design, data connectors, Azure Monitor Agent with data collection rules, Syslog and CEF, Windows security events

Microsoft Sentinel is Microsoft's cloud-native security information and event management (SIEM) and security orchestration, automation and response (SOAR) solution. It is enabled on top of a Log Analytics workspace, where all collected data is stored and queried with KQL. Sentinel is increasingly managed from the Microsoft Defender portal alongside Defender XDR, though the concepts are the same as in the Azure portal.