This session focuses on real‑world incident investigation and proactive threat hunting using Microsoft Sentinel, with a deep dive into the Sentinel Graph and entity relationships. We will walk through how security teams can pivot from alerts to incidents, understand attacker behavior through graph‑based investigations, and move seamlessly between investigation and hunting scenarios.
Through live demos, you will see how Sentinel correlates signals across users, devices, identities, and resources, enabling faster root‑cause analysis and more effective threat hunting. We will cover practical investigation workflows, advanced hunting techniques, and how to leverage graph context to uncover hidden attack paths and related activity.
Attendees will leave with actionable guidance on how to operationalize Sentinel for day‑to‑day SOC investigations and improve detection confidence and response speed using graph‑driven insights.