Security
Microsoft Sentinel
Cloud-native SIEM with AI-powered threat detection and automated response.
Command it in chat
Ask the Orbit Assistant about your Microsoft Sentinel data in plain English — it plans the API calls and answers clearly, not with raw JSON.
Automate it with skills
Put Microsoft Sentinel inside autonomous skills and playbooks that run on schedules, webhooks, or events — and chain it with your other tools.
Governed by default
Set action policies and member access, require approvals where needed, and review recorded activity. Supported autonomy modes depend on your plan.
4 one-click shortcuts — plus the full API
These cover common tasks. API exploration depends on your plan, vendor permissions and supported endpoints. Workspace simulations use fictional data and may use AI Power. Real actions follow workspace approval policies and vendor limits.
List incidents
list_incidents
Get incident
get_incident
List incident alerts
list_incident_alerts
List analytics rules
list_alert_rules
Explore before you connect
Explore Microsoft Sentinel in a workspace with fictional sample data before adding credentials. Workspace simulations may use AI Power; signup may require a beta invite.
Explore in a workspace