Microsoft Sentinel

aid: microsoft-sentinel
name: Microsoft Sentinel
description: Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration,
  automation, and response (SOAR) solution. It provides REST APIs for managing incidents, analytics rules, threat intelligence,
  and automation playbooks.
type: Index
deliveryModel:
  model: saas
  open_source: false
  commercial: true
  callable_host: true
  label: Hosted service · you call their endpoint
  confidence: high
  source:
  - openapi
  - pricing
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: freemium
  onboarding: self-serve
  trial: false
  try_now: true
  public: false
  label: Freemium · Self-serve signup
  confidence: medium
  source:
  - plans
  - authentication
  - security
  generated: '2026-09-03'
  method: derived
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/icons/microsoft-sentinel.png
tags:
- Microsoft
- Security
- SIEM
- SOAR
- Threat Detection
url: https://azure.microsoft.com/en-us/products/microsoft-sentinel/
created: '2024-01-01'
modified: '2026-05-19'
specificationVersion: '0.23'
apis:
- aid: microsoft-sentinel:microsoft-sentinel-bookmarks-api
  name: Microsoft Sentinel Bookmarks API
  description: The Bookmarks API from Microsoft Sentinel — 1 operation(s) for bookmarks.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Bookmarks
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-bookmarks-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-incidents-api
  name: Microsoft Sentinel Incidents API
  description: The Incidents API from Microsoft Sentinel — 2 operation(s) for incidents.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Incidents
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-incidents-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-alert-rules-api
  name: Microsoft Sentinel Alert Rules API
  description: The Alert Rules API from Microsoft Sentinel — 2 operation(s) for alert rules.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Alert Rules
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-alert-rules-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-data-connectors-api
  name: Microsoft Sentinel Data Connectors API
  description: The Data Connectors API from Microsoft Sentinel — 1 operation(s) for data connectors.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Data Connectors
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-data-connectors-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- aid: microsoft-sentinel:microsoft-sentinel-threat-intelligence-api
  name: Microsoft Sentinel Threat Intelligence API
  description: The Threat Intelligence API from Microsoft Sentinel — 1 operation(s) for threat intelligence.
  humanURL: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  baseURL: https://management.azure.com/
  tags:
  - Threat Intelligence
  properties:
  - type: OpenAPI
    url: openapi/microsoft-sentinel-threat-intelligence-api-openapi.yml
  - type: Documentation
    url: https://learn.microsoft.com/en-us/rest/api/securityinsights/
  - type: GettingStarted
    url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
common:
- type: Plans
  url: plans/microsoft-sentinel-plans-pricing.yml
- type: RateLimits
  url: rate-limits/microsoft-sentinel-rate-limits.yml
- type: FinOps
  url: finops/microsoft-sentinel-finops.yml
- type: CapabilityMap
  url: capabilities/microsoft-sentinel-capability-edges.yml
  name: Microsoft Sentinel Business Capability Map
- type: AgenticAccess
  url: agentic-access/microsoft-sentinel-agentic-access.yml
- type: DomainSecurity
  url: security/microsoft-sentinel-domain-security.yml
- type: Authentication
  url: authentication/microsoft-sentinel-authentication.yml
- type: GitHubOrganization
  url: https://github.com/Azure
- type: Portal
  url: https://portal.azure.com/
- type: Website
  url: https://azure.microsoft.com/en-us/products/microsoft-sentinel/
- type: Documentation
  url: https://learn.microsoft.com/en-us/azure/sentinel/
- type: Pricing
  url: https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/
- type: GettingStarted
  url: https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard
- type: Authentication
  url: https://learn.microsoft.com/en-us/azure/active-directory/develop/
- type: TermsOfService
  url: https://www.microsoft.com/en-us/legal/terms-of-use
- type: PrivacyPolicy
  url: https://privacy.microsoft.com/en-us/privacystatement
- type: Support
  url: https://support.microsoft.com/
- type: StatusPage
  url: https://status.azure.com/
- url: https://techcommunity.microsoft.com/t5/s/gxcuf89792/rss/board?board.id=MicrosoftSentinelBlog
  type: Blog
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
x-parent: microsoft
x-relationship: product