Build custom graphs (Preview)
Analysis / inference: Microsoft Sentinel now supports building custom security graphs in preview to map attack paths and blast radiuses across the data lake and third-party sources.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Microsoft Sentinel has added a custom graphs capability in preview, allowing analysts to construct tailored security graphs, execute Graph Query Language (GQL) queries, and visually traverse relationships.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisThis feature introduces custom security graphs into Microsoft Sentinel and the Microsoft Defender portal, enabling security analysts to map attack paths, assess blast radii, and power AI-driven investigations using Graph Query Language (GQL).
Analysts can now visually traverse threat paths and investigate blast radii using the Defender portal graphs experience, expanding investigative workflows beyond standard KQL tables.
Section 03 · Recommended actions
- Review the Custom Graph overview documentation in Microsoft Sentinel to understand schema design.
- Explore the graphs section in the Microsoft Defender portal to test GQL queries and interactive graph traversal.
- Verify preview access to custom graphs within the Microsoft Sentinel section of the Microsoft Defender portal.
- Examine custom graph schemas and evaluate their utility for upcoming threat hunting or attack path analysis.