Microsoft Sentinel — hunting & detection

Author and review KQL for Microsoft Sentinel (Azure Log Analytics) workspaces. This skill covers Sentinel-native tables and operational specifics; for endpoint telemetry (process, file, registry, device-level network) use microsoft-defender-endpoint; for vendor-neutral KQL optimisation use kusto-query-language.

1. When to use Sentinel vs Defender