Sentinel Detection Engineering

Sentinel detection engineering is the discipline of building high-fidelity, well-tuned, maintainable detections and response automation. This skill covers the lifecycle — content sourcing, authoring, validating, automating, and versioning detections — not the broader SIEM architecture.

When to use

Authoring or maturing analytics rules, hunting queries, automation rules, and playbooks in Microsoft Sentinel. Use for KQL detection patterns, MITRE alignment, content-hub vs custom choices, and detection-as-code rollout.

Do not use this skill for Sentinel onboarding/architecture (sentinel), Defender XDR custom detections in isolation (defender-xdr), or generic KQL learning unrelated to detection.

Sources of content (use in this order)