Splunk / Microsoft Sentinel
The SIEM platforms that ingest security logs from across an organisation's infrastructure and surface threats, anomalies, and incidents in real time.
What it is
About Splunk / Microsoft Sentinel
Security Information and Event Management (SIEM) platforms collect, aggregate, and correlate security-relevant log data from across an organisation's infrastructure — endpoints, servers, firewalls, cloud services, identity systems, and applications — and apply detection rules and behavioural analytics to identify threats and security incidents. Splunk is the market-leading SIEM platform, widely deployed in large enterprises and government environments. Its search processing language (SPL) allows security analysts to query billions of events, build correlation searches that fire alerts when suspicious patterns emerge, and create dashboards showing the security posture across the estate in real time. Splunk also provides SOAR (Security Orchestration, Automation, and Response) capabilities for automating incident response playbooks. Microsoft Sentinel is the cloud-native SIEM built on Azure Log Analytics. It ingests data from Microsoft 365, Azure Active Directory, Defender products, and third-party connectors with minimal configuration overhead, uses Kusto Query Language (KQL) for search and detection rule authorship, and integrates with Microsoft's threat intelligence feeds. For organisations in the Microsoft ecosystem, Sentinel's tight integration with Defender for Endpoint, Defender for Cloud, and Entra ID gives security analysts a unified detection surface without additional connector configuration. For a Cybersecurity Analyst, SIEM is the primary operational tool — the platform where the working day is spent investigating alerts, writing detection rules, hunting for indicators of compromise, and tracking incident timelines.
What you can do with it
Capabilities
Write a Splunk SPL search that identifies accounts with more than 10 failed authentication attempts in 5 minutes followed by a successful login — a classic credential stuffing detection pattern — and save it as a scheduled alert firing to the SOC analyst queue
Build a Sentinel KQL detection rule that fires when a user's sign-in location changes by more than 500 km in less than 2 hours (impossible travel), correlating Entra ID sign-in logs with a geolocation enrichment table
Investigate a Sentinel incident triggered by a Defender for Endpoint alert — pivot from the alerted process to all network connections it made in the preceding hour, identify an outbound connection to a known malicious IP, and escalate with a full timeline in the incident comments
Create a Splunk dashboard showing the top 10 source IPs by failed authentication volume, broken down by target service, with a time sparkline for the past 7 days — for the weekly SOC metrics report
Use Splunk's threat hunting interface to search for evidence of lateral movement by querying Windows Event Log 4624 (successful logon) events for a specific user account across all hosts in the estate over a 48-hour window
How to learn it
Learning Resources
Splunk Free Training (splunk.com/en_us/training) — "Introduction to Splunk" and "Using Fields" are free; the Splunk Core Certified User certification is the standard entry credential for Splunk practitioners
Microsoft Sentinel Ninja Training (microsoft.com/security/blog/sentinel-ninja-training) — a free, self-paced learning path published by Microsoft covering onboarding, KQL fundamentals, detection rule writing, and incident response
TryHackMe Splunk and Sentinel rooms (tryhackme.com) — browser-based virtual environments where you work through simulated security investigations using Splunk and Sentinel without needing your own licence
The KQL Café (kqlcafe.com) — community resource for Sentinel KQL queries and detection rule patterns; the query library covers common detection scenarios with worked examples
Pro Tip
Learn SPL or KQL before you touch the dashboards. Every SIEM platform has a GUI for building dashboards and correlation rules, but the analysts who can write search queries from scratch solve incidents in minutes instead of hours. The GUI generates queries for you — but when an incident requires a custom search across three log sources that no pre-built rule covers, the analyst who knows the query language is the one who finds the threat. The query language is the core skill; the GUI is the convenience layer on top of it.
Skills that use this tool
Roles that use this tool
Alternatives