Moving Sentinel to the Defender portal

Timeline

From the capture of 12 Oct 23:53 UTC

12 undated sections
24 with conditions

Requirements, exceptions and scope

GuidanceRequirementException2 conditions2 passages
This article explains how to transition your Microsoft Sentinel experience from the Azure portal to the Defender portal. If you use Microsoft Sentinel in the…
PrerequisitesScope1 condition1 passage
Review planning guidance, complete prerequisites, and onboardScopeTentative1 passage
Onboarding to the Defender portal with customer-managed keys (CMK)RequirementScope1 condition2 passages
Confirm and configure data collectionExceptionScope3 conditions2 passages
Configure analytics rulesExceptionScopeRecommendation4 conditions6 passages
Configure automation rules and playbooksRequirementExceptionScopeRecommendationTentative14 conditions10 passages
Configure APIsRequirementRecommendation2 conditions2 passages
Update incident triage processes for the Defender portalScopeRecommendation1 condition2 passages
Understand how alerts are correlated and incidents are merged in the Defender portalRequirementExceptionScope2 conditions3 passages
Note changes for investigations with Advanced huntingScope1 passage
Investigate with UEBA in the Defender portalRequirementException3 conditions2 passages

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

Observed history and review priority

Captured 12 Oct 23:53 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.

Review priority. Extracted assertions require review · Publisher marks guidance tentative · Applicability or exceptions require review

0 date changes and 0 condition changes across 0 compared revisions. Suggested check interval: 24 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 2

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

12 Oct 23:53 UTC · 41 candidates
8 Oct 23:13 UTC · 29 candidates