Cloud › Module 5 › Lesson 3
Sentinel Named
Sentinel named literacy covers SIEM workspace, data connectors, analytics rules, and incidents — detection vocabulary on YOUR $CLOUD_LAB.
Visual · t31_sentinel_named
Sentinel literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Azure's cloud SIEM — literacy names connectors and incidents so you triage on subscriptions you own, not export stranger workspace data.
Microsoft Sentinel ingests Azure Activity, Entra ID, Defender, firewalls, and third-party logs into a Log Analytics workspace. Analytics rules (scheduled query, fusion, ML) create incidents with entities and MITRE mapping. L2 triage: confirm scope, pivot entities, correlate with Entra sign-in logs — on owned subscription data only. Cyberlium maps Sentinel vocabulary on YOUR $CLOUD_LAB — connector list and fictional incident card on paper. Next: Azure Lab.
1. Sentinel components (named)
Workspace: Log Analytics home for Sentinel. Data connector: Entra ID, Azure Activity, Defender alerts. Analytics rule: KQL or built-in template firing incidents. Incident: case with severity, entities, owner, comments.
On $CLOUD_LAB, write Sentinel setup sketch — three connectors, one fictional analytics rule purpose, incident triage fields.
Command guide
Try these commands — Sentinel components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Microsoft Sentinel — https://learn.microsoft.com/en-us/azure/sentinel/overview Sentinel data connectors — https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources Azure Monitor — https://learn.microsoft.com/en-us/azure/azure-monitor/overview
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
curl -sS https://learn.microsoft.com/en-us/azure/sentinel/overview | head -10
cat > "$CLOUD_LAB/azure/sentinel-named-literacy.txt" <<'EOF'
Microsoft Sentinel literacy (YOUR workspace):
SIEM/SOAR on Azure: analytics rules, incidents, playbooks
Connectors: Entra ID, Defender, Azure Activity, firewalls
KQL: hunt and correlate in YOUR workspace logs
Lab: document connector checklist — no unauthorized log export from stranger tenants
EOFCommand — copy this
grep -E 'Sentinel|YOUR workspace|no unauthorized' "$CLOUD_LAB/azure/sentinel-named-literacy.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: Microsoft Sentinel (https://learn.microsoft.com/en-us/azure/sentinel/overview); Sentinel data connectors (https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources); Azure Monitor (https://learn.microsoft.com/en-us/azure/azure-monitor/overview). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Sentinel parallels hunt and SIEM literacy
Same L2 skills: entity pivot, time alignment, hypothesis on sign-in anomalies — Azure-native syntax (KQL) instead of SPL. Defenders restrict workspace RBAC — students design on paper before prod workspace.
Never import employer Sentinel export without ticket — lab fictional incidents only.
3. Literacy ≠ stranger workspace access
Forbidden: using leaked workspace keys to query stranger tenant logs. Allowed: Sentinel named card — connectors, rule purpose, triage checklist on $CLOUD_LAB.
Ship: Sentinel named card for YOUR lab subscription. Next: Azure Lab.
4. What you ship: Sentinel named card for $CLOUD_LAB
Connectors, rule purpose, incident triage fields. $CLOUD_LAB named. NO stranger workspace. chmod 600.
5. What you record before the next lesson
Date. Sentinel card. $CLOUD_LAB named. File t31-m05-l03-sentinel-named.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Query stranger Log Analytics with leaked key. Skip entity pivot in triage.
Right
Write Sentinel named card for YOUR $CLOUD_LAB. Next: Azure Lab.
Mission: sketch Sentinel on YOUR lab subscription
1) Name three data connectors for lab tenant. 2) One fictional analytics rule purpose. 3) Incident triage: entities, time, first KQL pivot. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Entra sign-in connector is identity hunt foundation on Azure.
Knowledge Check
APPLY: Microsoft Sentinel is primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Sentinel incidents bundle alerts with entities for analyst triage.
True or False
Knowledge Check
APPLY: Sentinel literacy on Cyberlium avoids:
Multiple choice