Microsoft Sentinel is a cloud-native security information and event management (SIEM) service with security orchestration and automated response. It collects data from users, devices, applications and infrastructure, on-premises and across clouds, through built-in and custom connectors. Analytics rules group alerts into incidents, threat intelligence and watchlists add context, and hunting queries and notebooks support investigation. Playbooks based on Azure Logic Apps automate responses. It is delivered as a cloud service on Azure and managed in the Microsoft Defender portal or the Azure portal.
Microsoft is a US company headquartered in Redmond, Washington, and Sentinel is proprietary. Data is stored in the region of the associated Log Analytics workspace. For workspaces in Europe, Sentinel processes customer data in Europe; for most other locations it processes data in a US region. Supported European regions include France, Germany, Italy, Norway, Sweden and Switzerland. As a US provider, Microsoft is subject to the US CLOUD Act, which lets US authorities compel production of data it controls, wherever stored. Security logs often contain personal data, so European organisations should weigh that.