Loading story…
Microsoft has announced significant enhancements to its Sentinel Security Information and Event Management (SIEM) platform, introducing advanced agentic capabilities and a unified data lake to address the evolving landscape of AI-driven cybersecurity threats. The latest upgrades enable Sentinel to operate more autonomously, allowing it to respond to cyber threats with minimal human intervention. Central to these improvements is the adoption of graph-based context, which allows the platform to map and analyze the interconnections within a network, providing a holistic view of potential attack paths and relationships between digital assets. This graph-based approach is designed to empower Security Copilot agents, which leverage AI to assist security teams in threat detection and response. The general availability of the Sentinel data lake provides a cloud-native, purpose-built repository for ingesting, managing, and analyzing vast amounts of security data from diverse sources. By integrating structured and semi-structured signals, Sentinel builds a rich, contextual understanding of an organization’s digital estate, enhancing the ability to detect subtle attack patterns and correlate signals across domains. The platform’s semantic access and agentic orchestration features allow defenders to utilize AI agents not only within Security Copilot but also in developer environments such as VS Code with GitHub Copilot. With these capabilities, security teams can retroactively hunt for attacker behaviors over historical data, automatically trigger detections based on the latest adversary tradecraft, and surface high-fidelity alerts. Integration with other Microsoft security tools, such as Defender and Purview, ensures that graph-powered context is available within familiar workflows, streamlining the process of tracing attack paths, understanding the impact of incidents, and prioritizing response actions. The enhancements are part of Microsoft’s broader strategy to capitalize on the industry’s transition to AI-powered cybersecurity, positioning Sentinel as a central platform for modern security operations. These developments aim to provide organizations with greater operational resilience by leveraging AI-driven automation and advanced analytics. The unified data lake and agentic features are expected to improve visibility, accelerate incident response, and reduce the burden on human analysts. Microsoft’s focus on agentic security platforms reflects the growing need for autonomous, context-aware solutions in the face of increasingly sophisticated cyber threats. The public preview of Sentinel Graph and the Model Context Protocol (MCP) server further extends the platform’s capabilities, offering new tools for defenders to correlate data and orchestrate AI-driven responses. Overall, the upgraded Sentinel platform represents a significant step forward in the integration of AI and automation within enterprise cybersecurity operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft announced an expansion of Microsoft Sentinel into an agentic security platform with a unified data lake, positioning the product to address AI-era cybersecurity operations.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has announced significant enhancements to its Sentinel Security Information and Event Management (SIEM) platform, introducing agentic AI capabilities designed to improve threat detection, investigation, and response. At the annual Microsoft Secure virtual event, the company previewed the new Sentinel security graph and the Model Context Protocol (MCP) server, both of which are intended to transform Sentinel from a traditional SIEM into a comprehensive security operations and management platform. The agentic AI functionality will empower Security Copilot agents to conduct more precise and rapid investigations, enabling security teams to respond to threats with greater speed and accuracy. The Sentinel MCP server is a key component, allowing for the integration of both pre-defined and custom agents, which can leverage AI-powered reasoning across unified security data. This extensibility is expected to help organizations move from reactive to predictive security postures, automating threat anticipation and response at scale. Microsoft’s approach aligns with broader industry trends, as competitors like Cisco, CrowdStrike, and Palo Alto Networks also expand their SIEM offerings into full-featured security operations platforms. The new features build upon the July launch of Microsoft Sentinel Data Lake, which provides scalable storage for log files and security data, further enhancing the platform’s analytical capabilities. The integration of agentic AI is positioned as a solution to the growing challenge of overwhelmed security teams, offering automation and intelligence to streamline operations. Microsoft’s security leadership, including corporate VP Vasu Jakkal, has emphasized the importance of these advancements in shifting the security paradigm. The company is also promoting educational resources and sessions, such as those highlighted in the Microsoft Ignite sessions catalog, to help organizations understand and secure agentic AI implementations. These sessions are designed to guide security professionals through the new capabilities and best practices for leveraging AI in security operations. The overall strategy reflects Microsoft’s commitment to providing a unified, extensible, and intelligent security platform for enterprise customers. By integrating agentic AI and expanding the Sentinel ecosystem, Microsoft aims to address both current and emerging cyber threats more effectively. The enhancements are expected to facilitate better collaboration between human analysts and AI agents, improving incident response times and reducing manual workloads. Organizations adopting these new features will benefit from increased automation, deeper insights, and a more proactive security posture. The announcement underscores the rapid evolution of security operations platforms and the central role of AI in modern cybersecurity defense.
Jun 29, 2026
Recent developments in detection engineering have focused on enhancing security measures for Microsoft Copilot, cloud environments, and non-human identities (NHIs). Detection rule repositories have seen significant updates, with 82 new and 328 modified rules across platforms such as Elastic, KQL, Splunk, Sigma, and YARA. New detection rules specifically target Microsoft 365 Copilot account compromise, including suspicious authentication patterns, usage anomalies, and prompt injection attempts, as well as eDiscovery log analysis. Additional rules address attacks against Ollama servers, covering DDoS, remote code execution, data exfiltration, and prompt injection, reflecting the growing threat landscape for AI-powered services. Azure environments have received new detection logic for destructive actions, such as Restore Point Collection and Storage Account deletions, and for identifying critical identity compromises in Microsoft Entra ID, including admin-confirmed compromises and Privileged Identity Management (PIM) failures. AWS detection coverage has improved with rules for federated user logins lacking multi-factor authentication, as well as enhanced monitoring for root user and IAM privilege escalation activities. Auth0 detections now correlate successful logins with suspicious TLS fingerprints, increasing the ability to spot anomalous access. Updates also refine detection of advanced process and memory manipulation techniques, such as API calls from spoofed parent processes, return-oriented programming (ROP) gadgets, image hollowing, and direct syscalls. System tampering, including boot file owner changes, is now more effectively detected. The focus on NHIs is growing, with organizations recognizing the need to modernize threat detection and response for these entities, as highlighted by guidance on using ITDR playbooks for NHI compromise. The cybersecurity community is also discussing the operational impact of AI in security operations centers (SOCs), noting that AI-driven tools can increase alert volumes and complexity. Industry newsletters emphasize the importance of consolidating cloud security platforms to manage risk in dynamic environments and highlight the ongoing challenges posed by the rapid adoption of AI and cloud technologies. Security leaders are encouraged to prioritize critical assets and adapt detection strategies to address evolving threats, particularly those targeting identity and access management systems. The integration of AI into detection engineering is transforming how threat intelligence is operationalized, enabling faster and more accurate rule creation. As organizations face increasing complexity in their security environments, staying informed about the latest detection rule changes and best practices is essential for maintaining robust defenses. The collective updates and guidance underscore the need for continuous improvement in detection engineering to keep pace with sophisticated adversaries and emerging attack vectors.
Jun 29, 2026
Major technology vendors and cybersecurity researchers are rapidly integrating artificial intelligence and automation into security operations, with Microsoft unveiling a comprehensive suite of AI-powered enhancements across its Defender ecosystem. These updates include proactive features such as Predictive Shielding for automatic attack disruption, a natural language Threat Hunting Agent, and expanded integration with third-party services like AWS and Okta. Microsoft is also addressing the growing challenge of non-human digital identities and agent sprawl, while expanding Security Copilot with dozens of new agents to automate tasks for security operations, identity, and IT teams. Meanwhile, the industry is seeing a surge in AI-driven detection engineering, with new and updated rules targeting advanced threats such as Windows defense evasion, credential access, phishing, and supply chain attacks. However, the adoption of generative AI models introduces new risks, as demonstrated by research into the Chinese DeepSeek-R1 model, which was found to generate insecure code—especially when prompted with politically sensitive topics. This raises concerns about the security implications of using foreign AI models, particularly those subject to state influence or censorship. Additionally, the threat landscape is evolving with the emergence of LLM-generated malware, adaptive AI-driven malware detection, and the use of AI in both offensive and defensive cyber operations. Security teams are urged to remain vigilant as AI technologies reshape both the tools available to defenders and the tactics employed by adversaries.
Jun 29, 2026