Hunting for threats in Microsoft Sentinel
Hunting for threats in Microsoft Sentinel lets you hunt more holistically across your organization because you can hunt across much more than just the M365 security stack. You can add things such as Syslog, common event format (CEF), REST APIs, and a host of external third-party data sources. For a full list of the available data connectors, go to https://docs.microsoft.com/en-us/azure/sentinel/data-connectors-reference.
Being able to pipe in all of the data from your systems and security appliances makes it much easier to parse it into something meaningful, in one central place.
The following screenshot shows the Microsoft Sentinel Hunting dashboard. This should give you some sense of everything that's going on, such as the tabs for Queries, Livestream, and Bookmarks, which we'll touch on later in this chapter. The main section of this page lists all of your queries, both custom and built-in ones written by Microsoft security...
