Azure Monitor, Log Analytics and Microsoft Sentinel concepts
In short: Azure Monitor is the platform for metrics and logs in Azure. Logs land in a Log Analytics workspace, where you query them with Kusto Query Language (KQL). Microsoft Sentinel sits on top of a workspace as a cloud SIEM and SOAR, turning logs into alerts, incidents and automated playbooks.
Azure Monitor and Log Analytics
Azure Monitor is the umbrella service for observability in Azure. It handles two main kinds of data: metrics (numbers over time, such as CPU percentage, kept for a short period and great for fast alerts) and logs (detailed records such as sign-ins, activity and application events).
| Log source | How to collect | Example table |
|---|---|---|
| Azure control plane (who changed what) | Activity log diagnostic setting | AzureActivity |
| Entra ID sign-ins and audit | Entra diagnostic settings | SigninLogs, AuditLogs |
| Resource logs (Key Vault, firewall) | Diagnostic settings per resource | AzureDiagnostics or resource tables |
| VMs and on-premises servers | Azure Monitor Agent with data collection rules | SecurityEvent, Syslog |
A Log Analytics workspace is the store for log data, with its own access control, retention and pricing. Many organisations keep one central security workspace per region to simplify queries and permissions.
Querying with KQL
Kusto Query Language (KQL) reads like a pipeline: start with a table, then filter, summarise and sort. This query finds accounts with many failed sign-ins in the last day:
SigninLogs
| where TimeGenerated > ago(1d)
| where ResultType != "0"
| summarize Failures = count() by UserPrincipalName, IPAddress
| where Failures > 20
| order by Failures descThe same skills work in Azure Monitor, Sentinel and Microsoft Defender XDR advanced hunting, so KQL is worth learning early.
Microsoft Sentinel
Microsoft Sentinel is a cloud-native SIEM (security information and event management) with SOAR (security orchestration, automation and response) features. It is enabled on top of a Log Analytics workspace and is increasingly used through the unified Microsoft Defender portal.
- Data connectors and Content hub solutions bring in Microsoft and third-party logs, such as firewalls via CEF or syslog.
- Analytics rules run KQL on a schedule (or in near real time) and raise alerts, which are grouped into incidents.
- Automation rules and playbooks (built on Azure Logic Apps) can assign incidents, add comments, notify people or disable a compromised account.
- Hunting queries and notebooks support proactive searches; workbooks give dashboards.
Running it well
- Decide what to collect from your threat model; not every log is worth paying for.
- Use cheaper log tiers or shorter retention for high-volume, low-value data.
- Start with built-in rule templates for identity, Azure activity and Defender alerts, then tune false positives.
- Map rules to MITRE ATT&CK to spot gaps.
- Write a short runbook per incident type and automate the routine steps.
- Restrict who can read the workspace; logs often contain personal data.
Tip: ingestion is the main Sentinel cost. Review data volume per table monthly, as you would any other cloud cost.
Practice
What is the difference between metrics and logs in Azure Monitor?
What does a Sentinel analytics rule do?
Which Azure service do Sentinel playbooks run on?
Key takeaways
- Azure Monitor handles metrics and logs; logs live in Log Analytics workspaces.
- Diagnostic settings and the Azure Monitor Agent bring data in.
- KQL is the query language across Monitor, Sentinel and Defender.
- Sentinel adds detections, incidents, hunting and automated playbooks.
- Collect with purpose and watch ingestion cost.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.