azure-sentinel

Azure Sentinel 技能

此技能为 Azure Sentinel 提供专业指导，涵盖故障排除、最佳实践、决策制定、架构与设计模式、限制与配额、安全、配置、集成与编码模式，以及部署。它结合了本地速查内容和远程文档获取功能。

如何使用此技能

IMPORTANT for Agent：使用下方的类别索引查找相关章节。对于带有行范围的类别（例如，L35-L120），请使用 read_file 读取指定行。对于带有文件链接的类别（例如，[security.md](security.md)），请使用 read_file 读取所链接的参考文件

IMPORTANT for Agent：如果 metadata.generated_at 的时间超过 3 个月，请建议用户从代码库拉取最新版本。如果无法使用 mcp_microsoftdocs 工具，请建议用户安装该工具：安装指南

此技能需要网络访问权限，以获取文档内容：

• 首选：使用 mcp_microsoftdocs:microsoft_docs_fetch，查询字符串为 from=learn-agent-skill。返回 Markdown。
• 备用：使用 fetch_webpage，查询字符串为 from=learn-agent-skill&accept=text/markdown。返回 Markdown。

类别索引

类别	行	说明
故障排除	L37-L50	诊断和修复 Microsoft Sentinel 数据引入、连接器（AWS/S3、Blob、Syslog/CEF、SAP）、KQL/作业、笔记本、MCP 工具，以及分析规则/计划规则执行问题。
最佳实践	L51-L74	设计、调优和运营 Microsoft Sentinel 的最佳实践：自动化、剧本、KQL 威胁搜寻、分析规则、UEBA、ASIM、监视列表、SOC 指标和解决方案质量。
决策制定	L75-L117	Sentinel 部署、定价和数据层规划方面的指导，以及迁移、集成、连接器和检测设计决策（包括从旧版 SIEM 和 SOAR 工具迁移）。
架构与设计模式	L118-L129	设计 Microsoft Sentinel 架构：工作区/租户布局、SIEM 模式、BCDR/复原能力、数据湖/图形设计，以及与其他 SIEM 共存或从其他 SIEM 迁移。
限制与配额	L130-L142	Sentinel 功能（规则、数据湖、MCP）的限制、配额、定价和可用性，以及搜索作业和监视列表的约束与安全管理，还有移除影响。
安全	L143-L163	保护 Microsoft Sentinel：配置角色、RBAC、剧本身份验证、CMK、存储/网络保护、SAP 和 AWS 安全集成、数据湖审核，以及安全的 MCP/Copilot 工具访问。
配置	L164-L300	配置 Microsoft Sentinel：数据连接器、ASIM 架构、分析规则、自动化/剧本、数据湖、SAP/Power Platform 解决方案、运行状况/审核和威胁情报集成。
集成与编码模式	L301-L346	将 Microsoft Sentinel 与外部数据、API、Logic Apps、MCP 工具和威胁情报源集成的模式与示例，以及通过 KQL、REST、图形和数据湖进行查询/自动化的模式与示例。
部署	L347-L361	部署和自定义 Sentinel 内容（规则、自动化、笔记本、SAP/BTP、数据湖）、CI/CD 和基于 ARM 的部署、云可用性，以及发布解决方案/Agent。

故障排除

主题	URL
排查 Sentinel 中 AWS S3 日志引入连接器的问题	https://learn.microsoft.com/en-us/azure/sentinel/aws-s3-troubleshoot
诊断并修复 Microsoft Sentinel Blob 连接器问题	https://learn.microsoft.com/en-us/azure/sentinel/azure-storage-blob-connector-troubleshoot
排查 Sentinel 中的 Syslog 和 CEF AMA 连接器问题	https://learn.microsoft.com/en-us/azure/sentinel/cef-syslog-ama-troubleshooting
排查 Sentinel 中的 KQL 查询和作业	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-troubleshoot
解决 Sentinel 数据湖中的常见 Jupyter 笔记本错误	https://learn.microsoft.com/en-us/azure/sentinel/datalake/notebooks-troubleshooting
Sentinel MCP 工具的最佳做法和故障排除	https://learn.microsoft.com/en-us/azure/sentinel/datalake/troubleshoot-sentinel-mcp
排查 Microsoft Sentinel 解决方案问题	https://learn.microsoft.com/en-us/azure/sentinel/isv/troubleshoot-sentinel-solutions
监视并排查 Sentinel 计划分析规则的执行情况	https://learn.microsoft.com/en-us/azure/sentinel/monitor-optimize-analytics-rule-execution
排查 Sentinel 无代理 SAP 数据连接器问题	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-deploy-troubleshoot
排查 Microsoft Sentinel 分析规则问题	https://learn.microsoft.com/en-us/azure/sentinel/troubleshoot-analytics-rules

最佳实践

主题	URL
为 SOAR 设计 Microsoft Sentinel 自动化规则	https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules
应用推荐的 Microsoft Sentinel playbook 模板和用例	https://learn.microsoft.com/en-us/azure/sentinel/automation/playbook-recommendations
应用 Microsoft Sentinel 工作区最佳实践	https://learn.microsoft.com/en-us/azure/sentinel/best-practices
应用 Sentinel 特有的数据收集最佳实践	https://learn.microsoft.com/en-us/azure/sentinel/best-practices-data
将自定义机器学习模型引入 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/bring-your-own-ml
应用 Sentinel 威胁搜寻示例 KQL 查询	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-sample-queries
微调 Microsoft Sentinel 分析规则检测	https://learn.microsoft.com/en-us/azure/sentinel/detection-tuning
解决 Sentinel 分析规则中的误报	https://learn.microsoft.com/en-us/azure/sentinel/false-positives
处理 Sentinel 分析规则中的数据引入延迟	https://learn.microsoft.com/en-us/azure/sentinel/ingestion-delay
使用 UEBA 数据调查 Sentinel 事件	https://learn.microsoft.com/en-us/azure/sentinel/investigate-with-ueba
开发和部署 Microsoft Sentinel 的 ASIM 解析器	https://learn.microsoft.com/en-us/azure/sentinel/isv/normalization-develop-parsers
将质量指南应用于 Sentinel 平台解决方案	https://learn.microsoft.com/en-us/azure/sentinel/isv/platform-solution-quality-guidance
将质量指南应用于 Sentinel SIEM 解决方案	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-siem-solution-quality-guidance
使用 Sentinel 事件指标管理 SOC 性能	https://learn.microsoft.com/en-us/azure/sentinel/manage-soc-with-incident-metrics
应用 Microsoft Sentinel SOC 的运营最佳实践	https://learn.microsoft.com/en-us/azure/sentinel/ops-guide
管理已弃用的 Microsoft Sentinel 解决方案生命周期	https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solution-deprecation
使用可自定义的异常检测发现威胁	https://learn.microsoft.com/en-us/azure/sentinel/soc-ml-anomalies
在 Sentinel 中应用 SOC 优化建议	https://learn.microsoft.com/en-us/azure/sentinel/soc-optimization/soc-optimization-access
有效应用 Microsoft Sentinel 监视列表	https://learn.microsoft.com/en-us/azure/sentinel/watchlists
管理 Sentinel 调查中的事件任务	https://learn.microsoft.com/en-us/azure/sentinel/work-with-tasks

决策

主题	URL
规划并执行 Sentinel 从 MMA 迁移到 AMA	https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate
决定并迁移由 Sentinel 警报触发的 playbook	https://learn.microsoft.com/en-us/azure/sentinel/automation/migrate-playbooks-to-automation-rules
决定何时使用 Microsoft Sentinel 数据湖层	https://learn.microsoft.com/en-us/azure/sentinel/basic-logs-use-cases
规划并估算 Microsoft Sentinel 计费成本	https://learn.microsoft.com/en-us/azure/sentinel/billing
分析并优化 Microsoft Sentinel 成本	https://learn.microsoft.com/en-us/azure/sentinel/billing-monitor-costs
选择并优化 Sentinel 预购成本计划	https://learn.microsoft.com/en-us/azure/sentinel/billing-pre-purchase-plan
降低并优化 Microsoft Sentinel 成本	https://learn.microsoft.com/en-us/azure/sentinel/billing-reduce-costs
为 Microsoft Sentinel 选择并配置 Cisco Secure Firewall 连接器	https://learn.microsoft.com/en-us/azure/sentinel/cisco-ftd-firewall
在 Sentinel 分析规则和 Defender 自定义检测之间进行选择	https://learn.microsoft.com/en-us/azure/sentinel/compare-analytics-rules-custom-detections
评估 Sentinel 连接器在不同云中的支持情况	https://learn.microsoft.com/en-us/azure/sentinel/data-type-cloud-support
在 Sentinel 中选择 KQL 作业、摘要规则和搜索作业	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-jobs-summary-rules-search-jobs
选择要引入 Sentinel 数据湖的日志	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-log-ingestion-guidance
选择 Sentinel 中的检测生命周期管理选项	https://learn.microsoft.com/en-us/azure/sentinel/detection-lifecycle-management-recommendations
将工作区加入 Sentinel 简化定价层	https://learn.microsoft.com/en-us/azure/sentinel/enroll-simplified-pricing-tier
规划 Microsoft Sentinel 部署以满足数据驻留要求	https://learn.microsoft.com/en-us/azure/sentinel/geographical-availability-data-residency
为 ISV 解决方案选择 Sentinel 平台组件	https://learn.microsoft.com/en-us/azure/sentinel/isv/which-platform-components-to-build
选择 Microsoft Sentinel 日志保留层	https://learn.microsoft.com/en-us/azure/sentinel/log-plans
规划 Sentinel 数据层和保留策略	https://learn.microsoft.com/en-us/azure/sentinel/manage-data-overview
确定 Sentinel 中 Defender XDR 数据类型在 GCC 云中的支持情况	https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-cloud-support
决定如何将 Microsoft Defender XDR 与 Sentinel 集成	https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration
规划在 Microsoft Defender 门户中使用 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/microsoft-sentinel-defender-portal
规划从旧版 SIEM 迁移到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration
将 ArcSight SOAR 自动化迁移到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-arcsight-automation
规划将 ArcSight 规则迁移到 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-arcsight-detection-rules
导出 ArcSight 历史数据以迁移到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-arcsight-historical-data
将旧版 SIEM 仪表板转换为 Sentinel 工作簿	https://learn.microsoft.com/en-us/azure/sentinel/migration-convert-dashboards
将导出的 SIEM 数据引入 Sentinel 目标平台	https://learn.microsoft.com/en-us/azure/sentinel/migration-export-ingest
为 Sentinel 历史数据选择目标平台	https://learn.microsoft.com/en-us/azure/sentinel/migration-ingestion-target-platform
为 Sentinel 迁移选择数据引入工具	https://learn.microsoft.com/en-us/azure/sentinel/migration-ingestion-tool
将 QRadar SOAR 自动化迁移到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-qradar-automation
规划将 QRadar 规则迁移到 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-qradar-detection-rules
导出 QRadar 历史数据以迁移到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-qradar-historical-data
将 Splunk SOAR 自动化迁移到 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-automation
将 Splunk 检测规则迁移到 Sentinel 分析	https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-detection-rules
导出 Splunk 历史数据以迁移到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/migration-splunk-historical-data
从战略层面确定 Microsoft Sentinel 数据连接器的优先级	https://learn.microsoft.com/en-us/azure/sentinel/prioritize-data-connectors
从 Sentinel SAP 代理迁移到无代理连接器	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-agent-migrate
使用 SIEM 迁移工具处理 Sentinel 检测	https://learn.microsoft.com/en-us/azure/sentinel/siem-migration
使用 Sentinel SOC 优化参考建议	https://learn.microsoft.com/en-us/azure/sentinel/soc-optimization/soc-optimization-reference

架构与设计模式

主题	URL
设计 Sentinel 业务连续性和灾难恢复（BCDR）及跨区域复原能力	https://learn.microsoft.com/en-us/azure/sentinel/business-continuity-disaster-recovery
使用 Sentinel 数据湖设计自定义安全图谱	https://learn.microsoft.com/en-us/azure/sentinel/datalake/custom-graphs-overview
在现有 SIEM 旁部署 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/deploy-side-by-side
设计跨多个工作区和租户的 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
设计 Sentinel SIEM 解决方案组件和模式	https://learn.microsoft.com/en-us/azure/sentinel/isv/siem-components-to-include
规划多工作区和多租户 Sentinel 布局	https://learn.microsoft.com/en-us/azure/sentinel/prepare-multiple-workspaces
根据场景选择 Microsoft Sentinel 工作区设计	https://learn.microsoft.com/en-us/azure/sentinel/sample-workspace-designs
配置 Sentinel 中的多工作区和租户架构	https://learn.microsoft.com/en-us/azure/sentinel/use-multiple-workspaces

限制与配额

主题	URL
配置并了解 Sentinel 近实时规则	https://learn.microsoft.com/en-us/azure/sentinel/create-nrt-rules
Microsoft Sentinel 数据湖服务限制参考	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-service-limits
Microsoft Sentinel MCP 定价和使用限制	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-billing
了解 Sentinel 中 ASIM 的已知问题和限制	https://learn.microsoft.com/en-us/azure/sentinel/normalization-known-issues
了解移除 Microsoft Sentinel 的影响	https://learn.microsoft.com/en-us/azure/sentinel/offboard-implications
使用 Sentinel 搜索作业处理大型数据集	https://learn.microsoft.com/en-us/azure/sentinel/search-jobs
查看 Microsoft Sentinel 服务限制和配额	https://learn.microsoft.com/en-us/azure/sentinel/sentinel-service-limits
在 Microsoft Sentinel 中创建并上传监视列表	https://learn.microsoft.com/en-us/azure/sentinel/watchlists-create
安全地管理和更新 Sentinel 监视列表	https://learn.microsoft.com/en-us/azure/sentinel/watchlists-manage

安全

主题	URL
配置 Sentinel playbook 身份验证和权限	https://learn.microsoft.com/en-us/azure/sentinel/automation/authenticate-playbooks-to-sentinel
限制对 Sentinel Standard playbook 的访问	https://learn.microsoft.com/en-us/azure/sentinel/automation/define-playbook-access-restrictions
在 AWS 上启用自动攻击中断操作	https://learn.microsoft.com/en-us/azure/sentinel/aws-disruption
为 Microsoft Sentinel 配置客户管理的密钥	https://learn.microsoft.com/en-us/azure/sentinel/customer-managed-keys
在 Purview 中审核 Sentinel 数据湖和图活动	https://learn.microsoft.com/en-us/azure/sentinel/datalake/auditing-lake-activities
满足接入 Sentinel 数据湖和图的先决条件	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-onboarding
在 Azure AI Foundry 中使用 Sentinel MCP 工具	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-azure-ai-foundry
在 Copilot Studio 中连接 Sentinel MCP 工具	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-copilot-studio
使用 NSP 保护 Sentinel Azure Storage blob 连接器	https://learn.microsoft.com/en-us/azure/sentinel/enable-storage-network-security
在 Microsoft Sentinel 中保护 MSSP 知识产权	https://learn.microsoft.com/en-us/azure/sentinel/mssp-protect-intellectual-property
配置用于 Sentinel 数据访问的资源上下文 RBAC	https://learn.microsoft.com/en-us/azure/sentinel/resource-context-rbac
配置 Microsoft Sentinel 角色和权限	https://learn.microsoft.com/en-us/azure/sentinel/roles
为 Sentinel 连接器准备 SAP 安全设置	https://learn.microsoft.com/en-us/azure/sentinel/sap/preparing-sap
为 Sentinel SAP 用户分配所需的 ABAP 授权	https://learn.microsoft.com/en-us/azure/sentinel/sap/required-abap-authorizations
使用 Sentinel 内置的 SAP BTP 安全内容	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-btp-security-content
使用 Sentinel 内置 SAP 安全内容	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-solution-security-content
监视 SAP 安全参数是否发生可疑更改	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-suspicious-configuration-security-parameters

配置

主题	URL
在 Sentinel 中将事件实体添加为威胁指标	https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence
使用 Sentinel ML 异常类型进行检测	https://learn.microsoft.com/en-us/azure/sentinel/anomalies-reference
使用 API 示例为 Sentinel 创建数据收集规则	https://learn.microsoft.com/en-us/azure/sentinel/api-dcr-reference
审核 Microsoft Sentinel 查询和工作区活动	https://learn.microsoft.com/en-us/azure/sentinel/audit-sentinel-data
使用 SentinelAudit 表审核用户活动	https://learn.microsoft.com/en-us/azure/sentinel/audit-table-reference
配置 Microsoft Sentinel 自动化规则属性和条件	https://learn.microsoft.com/en-us/azure/sentinel/automation-rule-reference
配置 Sentinel playbook 以自动响应威胁	https://learn.microsoft.com/en-us/azure/sentinel/automation/automate-responses-with-playbooks
配置和管理 Microsoft Sentinel playbook	https://learn.microsoft.com/en-us/azure/sentinel/automation/create-playbooks
为 Power Platform 部署 Business Apps Sentinel 解决方案	https://learn.microsoft.com/en-us/azure/sentinel/business-applications/deploy-power-platform-solution
将 CEF 密钥映射到 Microsoft Sentinel CommonSecurityLog 字段	https://learn.microsoft.com/en-us/azure/sentinel/cef-name-mapping
了解 Sentinel 的 Syslog 和 CEF AMA 连接器	https://learn.microsoft.com/en-us/azure/sentinel/cef-syslog-ama-overview
配置 Sentinel Security Events 以检测异常 RDP	https://learn.microsoft.com/en-us/azure/sentinel/configure-connector-login-detection
配置 Sentinel 中的引入时数据转换	https://learn.microsoft.com/en-us/azure/sentinel/configure-data-transformation
配置 Sentinel 中的 Fusion 多阶段攻击检测规则	https://learn.microsoft.com/en-us/azure/sentinel/configure-fusion-rules
将 AWS 服务日志连接到 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-aws
将 AWS EKS 审核日志从 S3 引入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-aws-eks
将 AWS WAF 日志从 S3 引入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-aws-s3-waf
将 Azure Virtual Desktop 遥测数据连接到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-virtual-desktop
配置 Sentinel 的 Azure 和 Microsoft 服务连接器	https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-windows-microsoft-services
配置通过 AMA 将 syslog 和 CEF 引入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-cef-syslog-ama
通过 AMA 将自定义文本日志收集到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-custom-logs-ama
将 Microsoft Defender for Cloud 警报引入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-defender-for-cloud
使用 AMA 将 Windows DNS 日志流式传输到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-dns-ama
将 Google Cloud Platform 日志引入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform
使用 Sentinel DCR API 配置 Logstash 输出	https://learn.microsoft.com/en-us/azure/sentinel/connect-logstash-data-connection-rules
在 Sentinel 中启用 Defender Threat Intelligence 数据连接器	https://learn.microsoft.com/en-us/azure/sentinel/connect-mdti-data-connector
将 Microsoft Defender XDR 数据流式传输到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender
将 Purview Information Protection 数据流式传输到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-purview
配置基于 API 的 Microsoft Sentinel 数据连接器	https://learn.microsoft.com/en-us/azure/sentinel/connect-services-api-based
配置基于诊断设置的 Sentinel 连接	https://learn.microsoft.com/en-us/azure/sentinel/connect-services-diagnostic-setting-based
配置基于 Windows 代理的 Sentinel 数据连接器	https://learn.microsoft.com/en-us/azure/sentinel/connect-services-windows-based
在 Sentinel 中从模板配置计划分析规则	https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rule-from-template
在 Sentinel 中配置自定义计划分析规则	https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules
配置 Sentinel 根据已连接的警报创建事件	https://learn.microsoft.com/en-us/azure/sentinel/create-incidents-from-alerts
根据查询自定义 Microsoft Sentinel 警报属性	https://learn.microsoft.com/en-us/azure/sentinel/customize-alert-details
自定义 Microsoft Sentinel 中的实体时间线活动	https://learn.microsoft.com/en-us/azure/sentinel/customize-entity-activities
配置 Azure Storage Blob CCF 数据连接器规则	https://learn.microsoft.com/en-us/azure/sentinel/data-connection-rules-reference-azure-storage
配置 GCP Codeless Connector Framework 数据连接规则	https://learn.microsoft.com/en-us/azure/sentinel/data-connection-rules-reference-gcp
配置 RestApiPoller 数据连接器和规则 JSON	https://learn.microsoft.com/en-us/azure/sentinel/data-connector-connection-rules-reference
定义 Codeless Connector Framework 数据连接器 UI JSON	https://learn.microsoft.com/en-us/azure/sentinel/data-connector-ui-definitions-reference
为 Microsoft Sentinel 配置自定义数据引入和转换	https://learn.microsoft.com/en-us/azure/sentinel/data-transformation
在 Sentinel 数据湖中使用资产数据表映射	https://learn.microsoft.com/en-us/azure/sentinel/datalake/asset-data-tables
在 Microsoft Sentinel 中创建和管理自定义图	https://learn.microsoft.com/en-us/azure/sentinel/datalake/create-custom-graphs
为 Sentinel 图查询构建深层链接 URL	https://learn.microsoft.com/en-us/azure/sentinel/datalake/create-deep-links-graph-queries
在 Sentinel 数据湖中配置联合数据连接器	https://learn.microsoft.com/en-us/azure/sentinel/datalake/data-federation-setup
在 Sentinel 数据湖中创建和计划 KQL 作业	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-jobs
在 Sentinel 数据湖中配置和计划 KQL 作业	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-jobs
在 Sentinel 数据湖中配置和运行 KQL 查询	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-queries
在 VS Code 中配置和计划 Sentinel 笔记本作业	https://learn.microsoft.com/en-us/azure/sentinel/datalake/notebook-jobs
配置 Sentinel 数据湖连接器和保留期	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-connectors
根据 KQL 创建和配置自定义 Sentinel MCP 工具	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-create-custom-tool
为 AI 查询配置 Microsoft Sentinel MCP 服务	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started
在 Sentinel 中使用 DNS AMA 连接器字段和规范化架构	https://learn.microsoft.com/en-us/azure/sentinel/dns-ama-fields
为 D365 Finance 部署 Sentinel Business Apps 解决方案	https://learn.microsoft.com/en-us/azure/sentinel/dynamics-365/deploy-dynamics-365-finance-operations-solution
启用 Sentinel 资源的审核和运行状况监视	https://learn.microsoft.com/en-us/azure/sentinel/enable-monitoring
参考 Microsoft Sentinel 实体类型和标识符	https://learn.microsoft.com/en-us/azure/sentinel/entities-reference
查看 Sentinel 中由 Fusion 检测到的多阶段攻击场景	https://learn.microsoft.com/en-us/azure/sentinel/fusion-scenario-reference
配置和解读 Sentinel 审核与运行状况监视	https://learn.microsoft.com/en-us/azure/sentinel/health-audit
使用 SentinelHealth 表监视 SIEM 运行状况	https://learn.microsoft.com/en-us/azure/sentinel/health-table-reference
将威胁情报指标批量导入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/indicators-bulk-file-import
为 Sentinel 配置推送式无代码连接器	https://learn.microsoft.com/en-us/azure/sentinel/isv/create-push-codeless-connector
构建和发布 Sentinel 自定义图解决方案	https://learn.microsoft.com/en-us/azure/sentinel/isv/develop-custom-graph-platform-solutions
为 Sentinel 开发 Jupyter 笔记本分析	https://learn.microsoft.com/en-us/azure/sentinel/isv/develop-notebook-platform-solutions
将示例遥测数据引入 Sentinel 数据湖	https://learn.microsoft.com/en-us/azure/sentinel/isv/ingest-sample-data
为 Sentinel 解决方案配置分析规则	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-analytic-rules-creation
将租户加入 Microsoft Sentinel 数据湖	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-data-lake-onboarding
为 Sentinel 解决方案编写威胁搜寻查询	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-hunting-rules-creation
将 Sentinel 解析器定义并发布为 Kusto 函数	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-parsers-creation
创建和配置 Sentinel 摘要规则	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-summary-rules-creation
为解决方案构建和配置 Sentinel 工作簿	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-workbook-creation
管理 Sentinel 分析规则的模板版本	https://learn.microsoft.com/en-us/azure/sentinel/manage-analytics-rule-templates
配置 Sentinel 表层级和保留设置	https://learn.microsoft.com/en-us/azure/sentinel/manage-table-tiers-retention
在 Sentinel 分析规则中配置实体映射	https://learn.microsoft.com/en-us/azure/sentinel/map-data-fields-to-entities
在 Sentinel 中使用 Microsoft Purview Information Protection 审核记录类型	https://learn.microsoft.com/en-us/azure/sentinel/microsoft-purview-record-types-activities
配置 Defender 警报分组，使其与 Sentinel 事件匹配	https://learn.microsoft.com/en-us/azure/sentinel/migrate-sentinel-incident-creation-rules-alert-grouping
查看和管理 Sentinel 中的 MITRE ATT&CK 覆盖范围	https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage
审核和监视 Sentinel 分析规则运行状况	https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity
监视 Sentinel 自动化规则和 playbook 的运行状况	https://learn.microsoft.com/en-us/azure/sentinel/monitor-automation-health
使用工作簿监视 Sentinel 数据连接器运行状况	https://learn.microsoft.com/en-us/azure/sentinel/monitor-data-connector-health
监视 Sentinel 中 SAP 连接器的运行状况和性能	https://learn.microsoft.com/en-us/azure/sentinel/monitor-sap-system-health
通过 Lighthouse 加入和管理多个 Sentinel 租户	https://learn.microsoft.com/en-us/azure/sentinel/multiple-tenants-service-providers
配置 Sentinel 中的多工作区事件视图	https://learn.microsoft.com/en-us/azure/sentinel/multiple-workspace-view
配置近实时分析规则以快速检测	https://learn.microsoft.com/en-us/azure/sentinel/near-real-time-rules
在 Sentinel 中配置和管理 ASIM 工作区解析器	https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-workspace-parsers
在 Sentinel 中使用 ASIM 通用架构字段	https://learn.microsoft.com/en-us/azure/sentinel/normalization-common-fields
在 Sentinel 中实现 ASIM Application Entity 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-entity-application
在 Sentinel 中实现 ASIM Device Entity 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-entity-device
在 Sentinel 中实现 ASIM User Entity 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-entity-user
在 Microsoft Sentinel 中管理和自定义 ASIM 解析器	https://learn.microsoft.com/en-us/azure/sentinel/normalization-manage-parsers
将 Sentinel 分析规则转换为 ASIM 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-modify-content
将 AI Agent 遥测数据映射到 ASIM Agent 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-agent
使用 ASIM Alert 架构规范化安全警报	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-alert
在 Microsoft Sentinel 中使用 ASIM Asset Entity 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-asset
将审核跟踪日志映射到 ASIM Audit 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-audit
使用 ASIM 架构规范化身份验证日志	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication
将 DHCP 服务器事件映射到 ASIM DHCP 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-dhcp
使用 ASIM DNS 架构规范化 DNS 日志	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-dns
使用 Microsoft Sentinel ASIM Email Event 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-email
将文件活动日志映射到 ASIM File Event 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-file-event
使用 ASIM Network 架构规范化网络会话	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-network
在 Sentinel 中应用 ASIM Process Event 规范化架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-process-event
使用 ASIM 架构规范化 Windows 注册表事件	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-registry-event
将用户管理活动映射到 ASIM 架构	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-user-management
使用旧版 Microsoft Sentinel 网络规范化架构 v0.1	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-v1
使用 ASIM Web Session 架构规范化 Web 流量	https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-web
使用 MSTICPy 配置 Microsoft Sentinel Jupyter 笔记本	https://learn.microsoft.com/en-us/azure/sentinel/notebook-get-started
为 Sentinel 配置 MSTICPy 和 Jupyter 笔记本	https://learn.microsoft.com/en-us/azure/sentinel/notebooks-msticpy-advanced
还原和管理已存档的 Sentinel 日志数据	https://learn.microsoft.com/en-us/azure/sentinel/restore
在 Sentinel 中配置 SAP HANA 审核日志收集	https://learn.microsoft.com/en-us/azure/sentinel/sap/collect-sap-hana-audit-logs
为 Sentinel 配置无代理 SAP 数据连接器	https://learn.microsoft.com/en-us/azure/sentinel/sap/deploy-data-connector-agentless
在 Sentinel 中配置 SAP 安全内容和检测	https://learn.microsoft.com/en-us/azure/sentinel/sap/deployment-solution-configuration
使用 SAP Sentinel 工作区函数进行安全分析	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-solution-function-reference
参考 SAP Sentinel 日志、表和架构	https://learn.microsoft.com/en-us/azure/sentinel/sap/sap-solution-log-reference
使用 Sentinel 无代理连接器停止 SAP 数据收集	https://learn.microsoft.com/en-us/azure/sentinel/sap/stop-collection
在 Sentinel 中配置 SAP 连接器轮询和 DCR	https://learn.microsoft.com/en-us/azure/sentinel/sap/update-sap-connector-data-collection-rule
在 Sentinel 中配置计划分析规则	https://learn.microsoft.com/en-us/azure/sentinel/scheduled-rules-overview
使用 Microsoft Sentinel 安全警报架构字段	https://learn.microsoft.com/en-us/azure/sentinel/security-alert-schema
为 XDR 连接器配置 Sentinel 警报架构	https://learn.microsoft.com/en-us/azure/sentinel/security-alert-schema-differences
了解 Sentinel 开箱即用内容的集中管理	https://learn.microsoft.com/en-us/azure/sentinel/sentinel-content-centralize
配置 Sentinel Zero Trust (TIC 3.0) 监视解决方案	https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solution
为 Sentinel 设置 Azure Storage Blob 连接器	https://learn.microsoft.com/en-us/azure/sentinel/setup-azure-storage-connector
配置和使用 Sentinel 摘要规则	https://learn.microsoft.com/en-us/azure/sentinel/summary-rules
配置 Microsoft Sentinel 警报中的自定义详细信息	https://learn.microsoft.com/en-us/azure/sentinel/surface-custom-details-in-alerts
在 Sentinel 中配置威胁情报源集成	https://learn.microsoft.com/en-us/azure/sentinel/threat-intelligence-integration
在 Sentinel 中配置筛选和拆分数据转换	https://learn.microsoft.com/en-us/azure/sentinel/transformation-filter-split
参考 UEBA 实体扩充和数据源	https://learn.microsoft.com/en-us/azure/sentinel/ueba-reference
为特定应用程序配置通过 AMA 收集的 Custom Logs	https://learn.microsoft.com/en-us/azure/sentinel/unified-connector-custom-device
启用与 Microsoft 威胁情报匹配的分析	https://learn.microsoft.com/en-us/azure/sentinel/use-matching-analytics-to-detect-threats
使用 Microsoft Sentinel 内置监视列表架构	https://learn.microsoft.com/en-us/azure/sentinel/watchlist-schemas
在 KQL 查询和检测规则中使用监视列表	https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries
为 Sentinel 选择 Windows 安全事件集	https://learn.microsoft.com/en-us/azure/sentinel/windows-security-event-id-reference
在 Sentinel 中查询 STIX 对象并迁移到新的 TI 表	https://learn.microsoft.com/en-us/azure/sentinel/work-with-stix-objects-indicators
大规模预配和运营 Sentinel 工作区管理器	https://learn.microsoft.com/en-us/azure/sentinel/workspace-manager

集成与编码模式

主题	URL
在 Microsoft Sentinel playbook 中使用自动化集成	https://learn.microsoft.com/en-us/azure/sentinel/automation/integrations
利用 Azure Logic Apps 工作流创建 Sentinel playbook	https://learn.microsoft.com/en-us/azure/sentinel/automation/logic-apps-playbooks
通过 Logic Apps 使用 Microsoft Sentinel playbook 触发器和操作	https://learn.microsoft.com/en-us/azure/sentinel/automation/playbook-triggers-actions
配置 AWS 环境以将日志发送到 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-aws-configure-environment
将 Microsoft Entra ID 日志连接到 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory
使用 Azure Functions 将 Microsoft Sentinel 与数据源集成	https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-functions-template
将 STIX/TAXII 威胁源和导出集成到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-taxii
将威胁情报平台连接到 Sentinel（旧版连接器）	https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-tip
通过上传 API 将 TIP 源集成到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-upload-api
在 Sentinel 中使用 AI 编写自定义图	https://learn.microsoft.com/en-us/azure/sentinel/datalake/create-graphs-with-ai
使用 GQL 语法和运算符查询 Sentinel 图	https://learn.microsoft.com/en-us/azure/sentinel/datalake/gql-reference-for-sentinel-custom-graph
从客户端调用 Sentinel 自定义图 REST API	https://learn.microsoft.com/en-us/azure/sentinel/datalake/graph-rest-api
在 Sentinel 图中查询和可视化自定义图	https://learn.microsoft.com/en-us/azure/sentinel/datalake/graph-visualization
使用 REST API 在 Sentinel 数据湖上运行 KQL	https://learn.microsoft.com/en-us/azure/sentinel/datalake/kql-queries-api
从 Jupyter notebook 查询 Sentinel 数据湖	https://learn.microsoft.com/en-us/azure/sentinel/datalake/notebook-examples
使用 Sentinel 图提供程序 API	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-graph-provider-reference
使用 Sentinel MCP Agent 创建工具	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-agent-creation-tool
在 ChatGPT 或 Claude 中启用 Sentinel MCP 连接器	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-chatgpt-claude-connector
使用 Sentinel MCP 数据探索工具	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-data-exploration-tool
使用 Sentinel MCP 实体分析器构建 Logic Apps	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-logic-apps
将 Sentinel MCP 工具添加到 Security Copilot	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-security-copilot
将 Sentinel MCP 工具与 VS Code 集成	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-use-tool-visual-studio-code
使用 MicrosoftSentinelProvider 类访问数据湖	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-provider-class-reference
在 Sentinel 中查询和使用联合数据源	https://learn.microsoft.com/en-us/azure/sentinel/datalake/using-data-federation
使用 REST API 为 Sentinel 实体补充地理位置数据	https://learn.microsoft.com/en-us/azure/sentinel/geolocation-data-api
通过 Log Analytics REST API 管理 Sentinel 威胁搜寻查询	https://learn.microsoft.com/en-us/azure/sentinel/hunting-with-rest-api
将 Defender for Cloud 事件集成到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/ingest-defender-for-cloud-incidents
使用 Sentinel 数据开发 Security Copilot Agent	https://learn.microsoft.com/en-us/azure/sentinel/isv/build-agent-security-copilot
为 Microsoft Sentinel 构建拉取式无代码连接器	https://learn.microsoft.com/en-us/azure/sentinel/isv/create-codeless-connector
构建 AI 辅助的自定义 Sentinel 数据连接器	https://learn.microsoft.com/en-us/azure/sentinel/isv/create-custom-connector-builder-agent
在 Sentinel 连接器中实现嵌套 API 轮询	https://learn.microsoft.com/en-us/azure/sentinel/isv/custom-connector-nested-api-polling
实现多帐户 Sentinel 无代码连接器模式	https://learn.microsoft.com/en-us/azure/sentinel/isv/multi-account-ccf-connector
创建 Sentinel playbook 以实现自动响应	https://learn.microsoft.com/en-us/azure/sentinel/isv/sentinel-playbook-creation
使用 ASIM KQL 分析器执行规范化 Sentinel 查询	https://learn.microsoft.com/en-us/azure/sentinel/normalization-about-parsers
在 KQL 查询中应用 ASIM 辅助函数	https://learn.microsoft.com/en-us/azure/sentinel/normalization-functions
将 Microsoft Purview 洞察集成到 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/purview-solution
从调查实体触发 Sentinel playbook	https://learn.microsoft.com/en-us/azure/sentinel/respond-threats-during-investigation
调用 Sentinel SOC 优化建议 API	https://learn.microsoft.com/en-us/azure/sentinel/soc-optimization/soc-optimization-api
通过上传 API 将威胁情报 STIX 对象导入 Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/stix-objects-api
使用 Sentinel playbook 提取非原生事件实体	https://learn.microsoft.com/en-us/azure/sentinel/tutorial-extract-incident-entities
为特定设备配置通过 AMA 传输的 Syslog	https://learn.microsoft.com/en-us/azure/sentinel/unified-connector-syslog-device
使用旧版 Sentinel 上传指标 API 上传 STIX IOC	https://learn.microsoft.com/en-us/azure/sentinel/upload-indicators-api

部署

主题	URL
设置自定义 Sentinel 内容的 CI/CD 部署	https://learn.microsoft.com/en-us/azure/sentinel/ci-cd
自定义 Sentinel 中基于存储库的内容部署	https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-deploy
将 Azure Stack Hub 虚拟机载入 Microsoft Sentinel	https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-stack
从 Microsoft Defender 门户部署 Sentinel 数据湖	https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-lake-onboard-defender
按云检查 Microsoft Sentinel 功能的可用性	https://learn.microsoft.com/en-us/azure/sentinel/feature-availability
通过 ARM 模板部署 Sentinel 分析规则	https://learn.microsoft.com/en-us/azure/sentinel/import-export-analytics-rules
通过 ARM 模板部署 Sentinel 自动化规则	https://learn.microsoft.com/en-us/azure/sentinel/import-export-automation-rules
打包并部署 Sentinel 图形/笔记本解决方案	https://learn.microsoft.com/en-us/azure/sentinel/isv/package-publish-notebook-graph-solutions
将 Microsoft Security Copilot Agent 发布到商店	https://learn.microsoft.com/en-us/azure/sentinel/isv/publish-agent-to-security-store
通过 Partner Center 发布 Sentinel SIEM 解决方案	https://learn.microsoft.com/en-us/azure/sentinel/isv/publish-sentinel-solutions
部署适用于 SAP BTP 的 Microsoft Sentinel 解决方案	https://learn.microsoft.com/en-us/azure/sentinel/sap/deploy-sap-btp-solution
准备部署 Sentinel SAP 无代理连接器	https://learn.microsoft.com/en-us/azure/sentinel/sap/prerequisites-for-deploying-sap-continuous-threat-monitoring