Recent Microsoft Sentinel innovations, including the Sentinel Data Lake and graph-powered investigation capabilities, enable security teams to explore long-term security telemetry and entity relationships in ways that were previously impractical with query-only workflows. These capabilities allow security teams to investigate attack paths, blast radius, and exposure using historical data and contextual relationships across identity, endpoint, and cloud signals.

This demo-focused session shows how Sentinel Data Lake and Sentinel graph capabilities can be combined with modern investigation tooling (including Sentinel MCP server tools and other AI-assisted capabilities) to support scalable, context-aware investigations.

Through demos, we’ll walk through several security scenarios that leverage graph-powered investigations, long-term data exploration, and AI-assisted workflows to perform blast radius and exposure analyses, using Microsoft security data as a unified investigation foundation.

The session focuses on practical workflows showing how modern security teams can investigate faster and hunt deeper at a data lake scale.