Microsoft Sentinel — Technology Profile & Architecture

Core Information

#core_information

Name, description, vendor website, logo, technology type and tags.

Overview & Role

Cloud-native SIEM and SOAR platform for threat detection and response.

Domain Classification & Tags

Information Security

Performance Profile

#performance_profile

Typical read and write throughput, payload size and processing latency.

Read Performance Profile

Throughput: Varies greatly with query complexity and data volume (e.g., hundreds to thousands of queries per minute for dashboards/alerts, or fewer for complex ad-hoc hunting queries)

Payload Size: Varies greatly with query results (e.g., 1 KB for simple counts to GBs for large raw log exports)

Processing Latency: Typically 100 ms to several seconds for simple queries, up to minutes for complex, large-scale queries

Write Performance Profile

Throughput: Up to 100 TB/day per workspace (soft limit, can be increased), or millions of events/sec

Payload Size: Varies by log type (e.g., 100 bytes to several KB per event)

Processing Latency: Typically 30 seconds to 5 minutes for data to be available for querying after ingestion (end-to-end latency)

Architecture Diagram

#architecture_diagram

Reference diagram of the technology's internal architecture.

Component Architecture & Topology

open_in_new Standalone Tab

Features

#features

Catalogued product capabilities and what each one does.

Empirical data for features is currently being compiled in the global catalog.

Typical Use Cases

#typical_use_cases

Scenarios the technology is commonly chosen for.

Empirical data for typical use cases is currently being compiled in the global catalog.

Known Customers

#known_customers

Publicly referenced organisations using the technology.

Empirical data for known customers is currently being compiled in the global catalog.

Known Integrations

#known_integrations

Other products and services it is documented to work with.

Empirical data for known integrations is currently being compiled in the global catalog.

Connectors

#connectors

Directional data connections to other technologies, with direction and maturity.

Empirical data for connectors is currently being compiled in the global catalog.

Reference Architectures

#reference_architectures

Published architectures where the technology is used or mentioned.

No published reference architecture blueprints currently link to Microsoft Sentinel.

Security Features

#security_features

Built-in security and access-control capabilities.

Empirical data for security features is currently being compiled in the global catalog.

Known Issues

#known_issues

Documented limitations, defects and operational pitfalls.

Empirical data for known issues is currently being compiled in the global catalog.

Guidelines

#guidelines

Recommended practices for adopting and operating the technology.

Empirical data for guidelines is currently being compiled in the global catalog.

Standards & Compliance

#standards_and_compliance

Standards, certifications and control requirements it maps to.

Empirical data for standards & compliance is currently being compiled in the global catalog.

Sources

#sources

Documentation and research references behind the recorded information.

Empirical data for sources is currently being compiled in the global catalog.

Expert Validation

#expert_validation

Whether domain experts reviewed and confirmed the content.

Empirical data for expert validation is currently being compiled in the global catalog.