Welcome back to What's new in Microsoft Sentinel. In July, Sentinel adds custom detections support in Sentinel repositories, so you can manage detections as code alongside your analytics rules, playbooks, parsers, and workbooks, authoring in GitHub and deploying through the CI/CD pipelines you already use. In Sentinel data lake, table insights brings table-level observability into the Microsoft Defender portal, helping you track ingestion volume, spot week-over-week changes, and catch connectors that have gone silent, all without running a single KQL query. Connector coverage also expands with GitHub Audit logs, Agari, and Airlock Digital, bringing more of the signals that matter to you into one place.
Read on for the details, and if you're joining us at Black Hat USA 2026, don't miss the keynote from Agentic Security CVP David Weston and other Microsoft Security activities at this event. Explore our resources at the end to go deeper.
Sentinel innovations:
Sentinel SIEM
Custom detections support in Sentinel repositories [Public Preview]
Custom detections can be managed as code through Sentinel repositories, alongside analytics rules, playbooks, parsers, and workbooks, completing the detections-as-code workflow across the full Sentinel portfolio. Teams can author detections in GitHub, review through pull requests, and deploy via existing CI/CD pipelines or the Microsoft Security Bicep extension. Learn how to manage custom content with repository connections.
Behind the Build with Gigamon: Enriching Sentinel with network-derived telemetry
Learn how Gigamon's integration with Sentinel brings network-derived telemetry into your security investigations, correlated with the identity, endpoint, and cloud signals already in your workspace. By adding this runtime context, you can trace suspicious activity across environments and investigate threats that span traditionally siloed domains, with faster and more accurate investigations, higher-quality signal, and clearer visibility into encrypted and hybrid cloud traffic that logs alone often miss. Read the blog to explore the integration and what it means for your security operations.
Sentinel data lake
Table insights [Public Preview]
Table insights is a built-in monitoring view on the tables page in the Microsoft Defender portal that gives you table-level observability for your Sentinel workspace without running KQL queries or opening a separate workbook.
Table insights surfaces the signals you rely on most:
- 📊 Ingestion volume by tier – compare analytics versus data lake
- 📉 Day-over-week ingestion fluctuations – spot drops or spikes against the same day last week
- 🔝 Top 5 tables by daily ingestion volume – identify your biggest cost drivers at a glance
- 🕐 Last data received – catch connectors that stopped sending data
- 💰 Estimated daily ingestion cost – per-table cost to inform tier and retention decisions
- ⚠️ Volume anomaly – signed percentage change versus baseline to flag unusual behavior early
Figure 1: View all table insights and investigate your table behavior with Sentinel in the Defender portal.
Together, these signals help you spot collection failures early, so you can act before they turn into bigger problems. Learn more.
Connectors [Public Preview]
-
GitHub Audit logs (via Azure Storage Blob)
The GitHub Audit logs connector ingests GitHub Enterprise audit logs into Sentinel from Azure Blob Storage with near real-time latency, so you can view this data in workbooks, create custom alerts, and strengthen your investigations. This requires Audit log streaming to be set up on GitHub for an Enterprise. Learn how to stream audit logs.
-
Agari
The Agari Data connector allows ingesting logs from Agari APIs into Sentinel. This connector integrates with Agari Brand Protection (BP) and Phishing Defense (APD). It supports Data Collection Rules-based ingestion time transformations for efficient query execution.
-
Airlock Digital
Ingests Airlock Digital application control and execution events to strengthen endpoint threat detection and response.
Additional resources
Blogs and documentation:
- Configure table settings in Sentinel
- Manage data tiers and retention in Sentinel
- Sentinel CI/CD repositories sample
Upcoming events:
Featured event: Aug 1–6, Black Hat USA 2026 (Mandalay Bay, Las Vegas)
- Keynote with Agentic Security CVP David Weston
The end of rare: Defending when offense is cheap
Wednesday, Aug 5 | 9:15 AM – 10 AM - Main stage with Microsoft Security CVP Aarti Borkar and Microsoft Security Research VP Tanmay Ganacharya
Poisoned at the source: Inside Microsoft Threat Intelligence's hunt for supply chain attacks
Wednesday, Aug 5 | 2:30 PM – 3 PM - Main stage with Customer Success GM Wes Malaby
Mind the gap: Turning threat intelligence into decisive action with expert-led defense
Wednesday, Aug 5 | 11:25 AM – 11:45 AM - Mandalay Bay K with Principal Product Manager Naadia Sayed
Agentic security: What's next
Wednesday, Aug 5 | 11:15 AM – 12 PM - Microsoft Security Black Hat USA 2026 VIP mixer hosted by Microsoft Security CVP Aarti Borkar
Swingers at Mandalay Bay Resort – Register here
Wednesday, Aug 5 | 6 PM – 9 PM - Microsoft booth #2144 with live sessions, AMAs, and hands-on demos of our latest security innovations
- Learn more in our Black Hat 2026 blog
Upcoming webinars:
- Aug 6: Security Immersion Event: Into the Breach
- Aug 13–14: Microsoft Virtual Training Day: Predict and Defend Against Cybersecurity Threats
- Aug 19: Microsoft Security Immersion Event: Shadow Hunter
- Aug 20: Microsoft Security Immersion Event: Agent Hackathon
- Aug 25: Tech Brief: Modernize security operations with a unified platform
Stay connected
Check back each month for the latest innovations, updates, and events to ensure you’re getting the most out of Microsoft Sentinel. We’ll see you in the next edition!
Microsoft