Use Microsoft Fabric for custom security analytics
Analysis / inference: Microsoft Sentinel now supports integration with Microsoft Fabric to enable advanced data enrichment, machine learning, and graph-based relationship modeling.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft has enabled the ability to use Microsoft Fabric's KQL, notebooks, and graph modeling tools to analyze data stored in the Microsoft Sentinel data lake tier.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis integration allows security teams to leverage Microsoft Fabric's advanced data processing, machine learning, and graph modeling capabilities on top of Microsoft Sentinel data, enabling more complex analytics and enrichment workflows that go beyond standard KQL limitations.
Security teams can now build automated pipelines for data enrichment and complex detection logic, with the ability to push findings back into Sentinel for incident response.
Section 03 · Recommended actions
- Explore Microsoft Fabric mirroring for Sentinel tables
- Evaluate the use of Fabric notebooks for complex threat hunting workflows
- Review documentation on the Logs Ingestion API to automate the return of findings to Sentinel
- Verify availability of Microsoft Fabric in your Azure region
- Review existing Data Collection Rules (DCR) for potential ingestion of Fabric-processed findings
- Assess current data lake storage costs for mirrored Sentinel data