SOC for Cloud Environments · Topic 1 of 3
Azure SOC Architecture and Microsoft Sentinel
Learn the Azure SOC architecture, Microsoft Sentinel as SIEM and SOAR, Defender for Cloud, Defender XDR and the Azure log sources a SOC uses (CSA 312-39).
- 4 min
- Microsoft Sentinel is the cloud native SIEM and SOAR; data lives in a Log Analytics workspace and is queried with KQL.
- Data connectors bring data in; analytics rules create incidents; workbooks visualize; playbooks respond.
- Activity log covers control plane operations; Entra ID logs cover sign ins and directory changes.
What it is
An Azure SOC monitors Microsoft Azure, Microsoft 365 and connected on premises or other cloud resources using Microsoft's cloud native security tools. Its center is Microsoft Sentinel, a cloud native SIEM with built in SOAR, fed by logs and alerts from Azure services, Microsoft Defender products and third party sources.
Under the shared responsibility model, Microsoft secures the physical cloud infrastructure, while the customer secures identities, data, configurations and workloads it controls. The customer SOC watches its side.
How it works
Main Azure log sources
| Source | What it records |
|---|---|
| Azure Activity log | Control plane operations on subscriptions and resources, such as creating or deleting a VM |
| Microsoft Entra ID sign in logs | User and service sign ins, with location, device and result |
| Microsoft Entra ID audit logs | Directory changes, such as new users, role assignments and app consents |
| Resource logs | Data plane activity inside a service, such as Key Vault access or storage reads |
| Virtual network flow logs | IP traffic flowing through virtual networks |
| Azure Firewall and WAF logs | Allowed and denied traffic, web attack detections |
| Microsoft Defender alerts | Detections from Defender for Cloud and Defender XDR products |
Azure Monitor collects these, and a Log Analytics workspace stores them. Analysts query the data with Kusto Query Language (KQL).
Microsoft Sentinel building blocks
| Feature | What it does |
|---|---|
| Data connectors | Bring in data from Microsoft services, firewalls, other clouds and syslog or CEF sources |
| Analytics rules | Detection logic that turns matching data into alerts and incidents |
| Incidents | Grouped, related alerts that analysts investigate and assign |
| Workbooks | Dashboards and visual reports |
| Hunting | Saved and custom queries for proactive threat hunting |
| UEBA | Behavior baselines for users and devices to find anomalies |
| Threat intelligence | Imports indicators and matches them against logs |
| Automation rules | Simple actions on incidents, such as assigning, tagging or running a playbook |
| Playbooks | Response workflows built on Azure Logic Apps, such as disabling a user or blocking an IP |
| Content hub | Packaged solutions with connectors, rules, workbooks and playbooks |
Microsoft is moving the Sentinel experience into the Microsoft Defender portal, so analysts work Sentinel and Defender XDR incidents in one queue.
Other Microsoft security tools
| Tool | Role in the SOC |
|---|---|
| Microsoft Defender for Cloud | Cloud security posture management (CSPM) with a secure score and recommendations, plus workload protection plans for servers, storage, databases, containers and more |
| Microsoft Defender XDR | Correlates Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps into unified incidents |
| Microsoft Entra ID Protection | Detects risky users and risky sign ins, such as leaked credentials or impossible travel |
| Azure Firewall, WAF and DDoS Protection | Network and web protection that also produces logs |
| Azure Key Vault | Protects secrets, keys and certificates; its logs show who accessed them |
| Azure Policy | Enforces and audits configuration standards |
How an Azure SOC detects and responds
The SIEM provides wide correlation and retention, the Defender products provide deep detection on their own layers, and playbooks provide automated containment with analyst approval where needed.
A worked example
Sentinel raises an incident: a user signed in from a new country, then a new role assignment of Owner on a subscription appeared in the Activity log. The analyst confirms with the user's manager that neither action was expected.
A playbook disables the account and revokes its sessions, and the analyst removes the role assignment. Entra ID audit logs and Activity logs are then reviewed for other changes made during the session.
How the exam asks about this
- "Which Microsoft service is the cloud native SIEM and SOAR for Azure?" → Microsoft Sentinel.
- "In Microsoft Sentinel, what are automated response workflows built on?" → Azure Logic Apps (playbooks).
- "Which Azure log shows who deleted a virtual machine?" → The Azure Activity log.
What to remember for the exam
- Microsoft Sentinel is the cloud native SIEM and SOAR; data lives in a Log Analytics workspace and is queried with KQL.
- Data connectors bring data in; analytics rules create incidents; workbooks visualize; playbooks respond.
- Activity log covers control plane operations; Entra ID logs cover sign ins and directory changes.
- Defender for Cloud gives posture management and workload protection; Defender XDR correlates endpoint, email, identity and cloud apps.
- Under shared responsibility, the customer's SOC owns identities, data and configuration.
Do not confuse Microsoft Sentinel with Microsoft Defender for Cloud. Sentinel is the SIEM and SOAR; Defender for Cloud is posture management and workload protection that sends alerts to it.
Common mistakes
Thinking Microsoft monitors the customer's accounts. Identity, data and configuration security is the customer's job under shared responsibility.
Mixing Activity and resource logs. Activity logs show management operations; resource logs show activity inside a service.
Forgetting identity. In Azure most attacks start with an account, so Entra ID sign in and audit logs are essential sources.
Check yourself
Where does Microsoft Sentinel store the data it analyzes?
In a Log Analytics workspace, which analysts query with KQL.
What does a Sentinel analytics rule produce?
Alerts, grouped into incidents that analysts investigate.
Which tool gives a secure score and posture recommendations for Azure resources?
Microsoft Defender for Cloud, through its cloud security posture management.
Topic 1 of 3 in SOC for Cloud Environments
Test yourself on SOC for Cloud Environments
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.