An organization is designing a unified security operations strategy across its cloud and on-premises environments. The security team uses Microsoft Defender for Cloud to evaluate workload security posture, identify vulnerabilities, and detect active threats across their resources. To centralize enterprise-wide security data, the team must stream alerts and telemetry from Defender for Cloud into a native cloud service that delivers Security Information and Event Management (SIEM), advanced threat intelligence, and automated incident correlation. Which Azure service should the organization integrate with Microsoft Defender for Cloud to meet this requirement?

Microsoft Sentinel: ### What Microsoft Sentinel Is **Microsoft Sentinel** is a cloud-native **Security Information and Event Management (SIEM)** and **Security Orchestration, Automation, and Response (SOAR)** solution. Built directly on top of the **Azure Monitor Logs** and **Log Analytics** foundation, Sentinel ingests, correlates, and analyzes massive volumes of telemetry from diverse enterprise sources across multicloud, on-premises, and hybrid infrastructures. ### How It Meets the Requirement Microsoft Sentinel natively integrates with **Microsoft Defender for Cloud** via built-in data connectors. When connected: - **Defender for Cloud** acts as the cloud security posture management (CSPM) and cloud workload protection platform (CWPP) engine, generating granular security alerts and vulnerability findings. - **Microsoft Sentinel** ingests these alerts and events, correlating them with signals from identity providers, network firewalls, endpoints, and third-party applications to construct a holistic timeline of complex security incidents. ### Key Advantages and Capabilities - **Intelligent Analytics**: Leverages advanced machine learning and Microsoft threat intelligence to detect sophisticated multi-stage cyber attacks. - **Single Pane of Glass**: Aggregates security telemetry across multicloud environments into unified dashboards and investigation workbooks. - **Automated Incident Response**: Executes automated playbooks using **Azure Logic Apps** to remediate threats rapidly upon alert detection. - **Deep Investigation Tools**: Enables security operations center (SOC) analysts to hunt for active threats and track lateral movement using interactive graphs. ### Why This Is Optimal While **Microsoft Defender for Cloud** focuses on resource-level security posture and workload-specific threat detection, **Microsoft Sentinel** provides the enterprise-scale correlation, broad event aggregation, and threat hunting necessary for a modern security operations center.