All news with #microsoft sentinel tag

🔒 Microsoft announced major AI upgrades for Sentinel SIEM and Security Copilot, positioning them as agentic platforms. The update makes Sentinel data lake generally available and introduces public-preview releases of Sentinel graph and the Sentinel Model Context Protocol (MCP) Server so AI agents can access and act on SIEM data. Customers can now build custom agents with natural‑language prompts and discover third‑party agents via a revamped store. Microsoft positions agents to automate investigation and response but warns of increased noise, false positives and a new attack surface.

🔒 Microsoft announced the general availability of the Sentinel data lake and public previews of Sentinel Graph and the Sentinel Model Context Protocol (MCP) server. The release broadens Sentinel from a traditional SIEM into a unified, agentic security platform designed to ingest and correlate structured and semi-structured signals at scale. It is intended to give AI agents such as Security Copilot and developer tools in VS Code with GitHub Copilot richer contextual access for detection, retroactive hunting, and automated response while integrating with Defender and Purview.

🛡️ Microsoft announced expanded agentic security capabilities in Microsoft Sentinel, including the general availability of the Sentinel data lake and public preview of Sentinel Graph and the Model Context Protocol (MCP) server to enable AI agents to reason over unified security data. Sentinel ingests structured and semi-structured signals, builds vectorized, graph-based context, and integrates with Microsoft Defender and Microsoft Purview. Security Copilot now offers a no-code agent builder and developer workflows via VS Code/GitHub Copilot, while enhanced governance controls (Entra Agent ID, PII guardrails, prompt shields) aim to secure agent lifecycles.

🔒 Microsoft’s latest Forrester TEI study found a 242% return on investment over three years for organizations using Microsoft Defender. The analysis attributes $17.8 million in total benefits and reports an average payback period of less than six months for a composite organization. Integrated with Microsoft Sentinel, Defender streamlines SecOps by consolidating tooling, lowering false positives, and accelerating response through automation and KQL-enabled detections. Customers cite improved visibility across hybrid and multicloud environments and reduced operational overhead.