New capabilities coming to Microsoft Sentinel this Spring

New capabilities coming to Microsoft Sentinel this Spring

We are excited to share the latest advances coming to Microsoft Sentinel over the next few months as we transform the SOC (Security Operations Center) with industry-leading capabilities. As threats continue to scale in velocity and sophistication, security analysts need more powerful tooling optimized for their workflows. This spring, customers can expect significant innovations across the SecOps lifecycle with simplified operational experiences, enhanced visibility and insights and greater AI-driven outcomes, all of which will help security teams to combat the emerging threat.

 

Streamlining security operations

In the SOC, where every minute counts, efficiency is critical. Larger and more complex organizations can be slowed down when navigating multiple tenants, workspaces, and tooling, which is why we’ve improved that experience across SIEM and XDR in the unified SecOps experience. We’ve also heard from customers about the challenge of context switching between portals for daily case management for activities like triage and investigation. Case management workflows have traditionally been handled externally via non-security tools, but we’re launching an integrated management layer embedded directly into the SecOps experience. This spring, we are investing heavily in our tools for management of large scale SOCs and collaboration tools to simplify security operations and help teams make bigger impact.

Multi-Tenant and Multi-Workspace Capabilities in the unified SecOps platform coming to GA in May

We are excited to announce that all use cases will be generally available for Microsoft Sentinel customers in the unified SecOps platform in the Defender portal in the next few months. This includes unified management of multi-tenant, multi-workspace architecture across SIEM and XDR, delivering a number of new capabilities including:

• Aggregated view across SIEM and XDR: A single view of incidents and alerts across multiple tenants and workspaces.
• Unified incident detection and investigation: Detect and investigate incidents with better accuracy across multiple workspaces in a single place for SIEM+XDR.
• Unified case management: Collaborate and track cases across different tenants in a single queue.
• Improved threat hunting: Proactively search across multiple workspaces including Defender XDR.
• Effortless automation rule deployment: Deploy automation rule replicas across workspaces using the intuitive automation rule creation wizard.

To learn more about managing multi-tenant, multi workspace architecture on the unified SecOps platform, follow our tech community. We have upcoming blogs addressing frequently asked questions, as well as a video series demonstrating the Microsoft Sentinel experience in the unified platform.

In addition to our multi-workspace capabilities, we are also excited to announce the unified SecOps platform is available in GA for customers using GCCH and DoD clouds and Microsoft Sentinel without Defender XDR. GCC cloud customers can now use the experience in public preview. 

Case Management to GA with Expanded Functionality

Recently, we announced the addition of case management for our unified SecOps platform experience, delivering a purpose-built system to manage security incidents. We will continue to expand its capabilities to efficiently manage and collaborate on cases with AI-driven insights, automation, and seamless task coordination this Spring.

Coming soon, case management will support:

• Document and Collaborate: Utilize rich text case comments for better readability and structured content, enhancing collaboration. (coming soon)
• Review Case Summaries: Access Copilot-generated case summaries to understand case progress without manually reading through logs and notes (coming soon).
• Manage Attachments: Upload and manage attachments directly within cases, quickly adding evidence, log files, and screenshots (coming soon).
• Assign Cases Across Tenants: Manage and assign cases from a single queue without switching between tenants, increasing efficiency and coordination (coming soon).
• Configure Log App Playbooks: Enrich cases with data from threat intelligence or hunting queries or execute predefined response actions using public case management APIs (coming soon).
• Updated Incident Experience: Incidents experience will be updated to provide a new single, unified Task experience. This will consolidate tasks created by customer SOC teams, Copilot, and Defender for Experts, reducing context switching and enabling real-time updates on task status, ownership, and dependencies. (coming soon)

Expanding protection with more visibility and insights

In the ever-evolving landscape of cybersecurity, staying ahead of complex threats can only happen with full visibility of the digital environment and threat actor ecosystem. Microsoft Sentinel's advancements in threat intelligence and connectors are designed to provide security leaders with powerful insights across more of their entire digital environment. In the coming months, we’ll be making it easier to expand your coverage and receive actionable intelligence.

Advancing Threat Intelligence

Relevant, timely threat intelligence is critical for identifying and mitigating emerging threats before they can cause significant damage. It enables security teams to stay ahead of cybercriminals by understanding their tactics, techniques, and procedures. Up-to-date intelligence also supports proactive defense strategies, reducing the risk of breaches and data loss.  In the coming months, we’ll enable new ways to apply your threat intelligence and curate it for your organization’s unique needs.  Coming enhancements include:

• Expanded threat intel for advanced hunting: All data and indicators ingested through the Threat Intelligence Platform (TIP) will be available in advanced hunting. Customers will be able to create custom detections using indicators beyond IoCs including threat actors, TTPs, and identities, with relationships that aid in prioritization and triage. Additionally, alerts can now be prioritized based on industry-specific criticality, building on our previous enhancements. (coming soon)
• Geo-Context: Microsoft finished intelligence in threat analytics will include additional geo-context to help organizations focus on what matters most based on geographic security interests. (coming soon).
• Ingestion Rules: New ingestion rules allow for managing TI at scale before ingestion for a more curated experience. This enables the deletion of false positives, tagging of specific feeds, and personalizing TI to enhance detection precision and reduce noise (Public Preview).
• Microsoft Raw Intelligence:  For customers using MDTI, a connector to Microsoft Raw intelligence is now generally available for detection and enrichment. This IoC feed matches against customer logs to detect and contextualize threats with a new source of insight. (coming soon)

New and improved data connectors

Announced in 2024, our revamped Codeless Connector Platform (CCP) provides users, partners and developers the ability to create connectors for ingesting data into Microsoft Sentinel without extensive coding or infrastructure management, enhancing efficiency and scalability. Connectors created using CCP are fully SaaS, with no requirements for service installations, and include health monitoring. We continue to invest in this platform, moving more connectors over and making it easier for customers to leverage the service including:

• Modernizing Existing Connectors with CCP: By utilizing the CCP alternatives for currently Azure Function-based connectors, customers will benefit from a centrally managed SaaS platform that facilitates data ingestion at scale. Recent noteworthy migrations to CCP include VMware Carbon Black, Okta Single Sign-On, SentinelOne, and Palo Alto Cortex XDR.
• Expanding Data Collection: New CCP-enabled data connectors will expand out-of-box data collection from third-party products, including Workday, GCP workloads (Audit Logs, Security Command Center, Cloud Armor), and AWS Web Application Firewall.

New ISV Integrations coming soon:

• Netskope: Built on the CCP, this connector seamlessly streams CASB alerts, DLP incidents, and threat logs into Microsoft Sentinel, delivering real-time visibility and actionable insights. With a one-click setup and automated data flow, the integration simplifies incident management. This empowers security teams to focus on rapid incident response and proactive policy enforcement, boosting both security posture and operational efficiency (Available now)
• 1Password: This integration enhances security monitoring by enabling the ingestion of 1Password events API data directly into Microsoft Sentinel. This offers visibility into audit events, sign-in activity, and shared item usage. (Coming in April)

Empowering the SOC with greater AI-driven outcomes

As cyber attacks scale in quantity and sophistication, , security teams must harness the promise of AI to accelerate their response and amplify their impact. We are investing in new ways that help teams to do this: through ML-based recommendations to enhance risk management and manage costs and expand the ways customers can get the most out of Security Copilot. For a deep dive on innovations for Security Copilot read here.

New Recommendation Types for SOC Optimization coming in April

Our SOC optimization feature provides targeted recommendations to help customers get the most out of Microsoft Sentinel, with suggestions to improve security and manage costs. New optimization types deliver new suggestions to help customers better manage their scaling volumes of SIEM data.

• Risk-Based Optimization: Prioritize security coverage based on potential impact and likelihood of risks, ensuring resources are allocated effectively to address the most critical threats. This not only enhances cybersecurity but also builds resilience and agility, enabling informed decisions about cybersecurity investments.
• Resource Optimization: Identify opportunities to optimize resource allocation and reduce workspace size for significant cost savings, improved data management efficiency, and alignment with business goals.
• Cost Optimization: Recommendations on the most cost-effective commitment tier, reducing unnecessary expenses and maximizing value.
•  

 

 

• Data-to-Cost Insights: Detailed insights into data usage and cost-saving opportunities help customers make informed decisions that balance cost savings with value increases.
• AI MITRE Tagging: Leverage AI models to analyze untagged detections and provide tagging recommendations to improve security coverage.

Security Copilot Enriched Incident Summaries in the Microsoft Sentinel Azure portal, coming to public preview in April

As one of the industry's first generative AI solutions, Security Copilot empowers SOC analysts by optimizing daily operations while enhancing efficiency and accuracy. Today, we’re excited to announce the upcoming public preview of Security Copilot Incident Summaries –embedded in the Microsoft Sentinel Azure portal and designed to provide enriched insights!

Incident Summaries are already generally available and widely used by customers in Microsoft Defender and the Security Copilot standalone portal. Similarly, Sentinel-specific summaries have been actively utilized within the standalone Copilot experience. Now, we’re bringing this capability directly into the Sentinel Azure portal while introducing key enhancements driven by customer feedback.

This capability delivers a comprehensive overview of security incidents by consolidating data from multiple alerts and highlighting key details such as timelines, impacted assets, and indicators of compromise. By offering clear, comprehensive insights, Incident Summaries help security teams better understand the scope and impact of an incident, making it particularly valuable during the triage phase. Analysts can quickly grasp the attack narrative, assess its validity, and determine next steps with greater confidence.

Benefits include:

• Enriched insights providing additional context on device risk, user risk, Microsoft Defender Threat Intelligence, and Sentinel watchlist matches – enhancements driven by customer input.
• A structured format where events are mapped to MITRE tactics and presented in chronological order, creating a clear narrative of the attack progression and simplifying threat analysis and response.
• Built-in caching now available directly within the Sentinel Azure portal, expanding on the functionality already available in Microsoft Defender to support faster access to summaries.  
• Backend optimizations that streamline how summaries are generated, ensuring a responsive experience that scales efficiently with usage. 

 

Read more about Security Copilot’s announcements here.

 

Conclusion

Microsoft Sentinel is a technology that empowers teams to work together efficiently to stay safer, and we are excited by all that is coming in the next few months to support this.

 

Learn more about the latest innovations at the Microsoft Secure digital event on April 9, 2025. Register now and visit our booth at RSA.

Learn More Resources:

 

What's New: Create your own codeless data connector | Microsoft Community Hub

Creating Custom Connectors for Microsoft Sentinel

Optimize security operations | Microsoft Learn