Lab Setup

Use an Azure subscription and Microsoft Entra tenant that you are authorized to administer. This lab requires the Security Administrator role and a Microsoft Sentinel-enabled workspace. Use privileged roles only for the duration of the exercise and follow your organization's least-privilege practices.

===

Configure Microsoft Sentinel Data Collection and Automation

Your SOC cannot automate triage if data sources are disconnected and workflow actions are missing. In this lab, you will connect high-value Microsoft data sources, verify ingestion in the workspace, and configure an automation rule that drives a pre-built playbook.

In this lab, you will:

  • Review the pre-provisioned Sentinel workspace state.
  • Connect the Microsoft Defender XDR connector.
  • Connect the Azure Activity connector.
  • Verify event ingestion with a Log Analytics query.
  • Build an automation rule for high-severity incidents.
  • Link the rule to the pre-built playbook.
  • Review content available through Content Hub.

This exercise should take approximately 45 minutes to complete.

Note: This lab uses the pre-provisioned Sentinel workspace sc500-lab4e-sentinel and playbook sc500-incident-playbook.

Create a Log Analytics space

  1. Sign in to the Azure portal https://portal.azure.com with your Administrator account.

  2. In the Search resources... bar, find and open Log Analytics Workspaces.

  3. Select the + Create option.

  4. Create a Workspace with these settings:

    • Subscription = Use the default provided
    • Resource Group = Create New --> lab4e-rg
    • Name = sc500-lab4e-sentinel
    • Region = Use the default

  5. Select Review + create.

  6. When the validation finishes, select Create.

Review / Create a Workspace for use in Microsoft Sentinel

  1. Use the search bar to open Microsoft Sentinel.

  2. Select workspace sc500-lab4e-sentinel.

  3. Use the Add button to attach Sentinel to the workspace.

  4. Review the workspace overview and confirm the current baseline state (connectors and incidents).

Connect Microsoft Defender XDR

  1. In the Microsoft Sentinel menu, expand the Configuration section. Then open Data connectors.

  2. Search for and select Microsoft Defender XDR.

  3. Open the connector page and select Open connector page.

  4. Complete the connection workflow if requested. By default XDR should be connected automatically.

  5. Enable bi-directional incident synchronization if presented in connector options.

  6. Save settings.

  7. Record what data this connector contributes (alerts/incidents/entities).

Connect Azure Activity

  1. In Data connectors, search for Azure Activity.

  2. Open the connector and connect the active subscription.

  3. Save the connector configuration.

  4. Confirm connector status shows connected.

Verify Ingestion

  1. Open Logs for sc500-lab4e-sentinel.

  2. Run the following query:

    AzureActivity
| take 10

  3. Confirm at least one row is returned.

  4. Record values from one result:

    Field Value
    OperationName
    Caller
    TimeGenerated

  1. In Sentinel, open Automation then Automation rules.

  2. Select Create and configure:

    • Rule name: sc500-auto-triage
    • Trigger: Incident created
    • Condition: Severity equals High

  3. Add actions:

    • Change severity to Critical
    • Assign owner to User1
    • Run playbook: sc500-incident-playbook

  4. Save the automation rule.

  5. Open sc500-incident-playbook and review:

    • Trigger type
    • Key action steps
    • Final action output target

  6. Record these details in your notes.

Review Content Hub Package Scope

  1. Open Content hub in Sentinel.

  2. Search for Microsoft Defender XDR.

  3. Open the solution details page and review included content types.

  4. Record at least two analytics rule names or content artifacts listed in the package.

Summary

In this lab, you established Sentinel collection and orchestration fundamentals:

  • Connected core Microsoft security telemetry sources.
  • Verified that events are ingesting into the workspace.
  • Configured incident automation to standardize triage actions.
  • Linked automation to a reusable playbook.

This creates the base operating pattern for SOC data readiness and repeatable incident response automation.