# Two consoles: a recommendation is not an incident Source: https://ai.techclick.in/blog_azure_defender_sentinel_log Markdown: https://ai.techclick.in/blog_azure_defender_sentinel_log.md Publisher: Techclick Infosec Pvt Ltd Defender for Cloud recommendations vs Sentinel SIEM. You need Log Analytics. A recommendation is not a closed incident. ## The ticket CISO forwards a Defender recommendation: “JIT should be enabled on pay-api.” SOC marks the Sentinel incident “SQL brute force” as closed because the recommendation list is shorter this week. Those are not the same object. Quick interview answer Microsoft Defender for Cloud is CSPM + optional Defender plans (servers, SQL, storage, …): recommendations, secure score, regulatory. Microsoft Sentinel is SIEM/SOAR: connect data, analytics rules, incidents, hunting, automation. Both typically land on a Log Analytics workspace . Enabling a Defender plan is not “we have a SIEM.” Closing a recommendation is not closing an incident. You still need an owner, a timeline, and a control that would catch the next one. Hero · two queues Left: fix the posture. Right: investigate the attack. Do not merge the queues. Lab data · dummy only Tenant techclick-lab.in · MG tc-root / tc-landing / tc-workloads · subs sub-hub sub-spoke-app · hub VNet 10.40.0.0/16 · spoke 10.41.0.0/16 · Azure Firewall 10.40.0.4 · VPN GW public 203.0.113.50 · on-prem FortiGate WAN 203.0.113.10 . Not a live tenant. ## Mental model Defender for Cloud Microsoft Sentinel Question Are we configured badly? Is something attacking us / did it land? Unit of work Recommendation / alert / secure score Incident / hunt / analytics rule Needs Subscription + plans + workspace Workspace + connectors + rules This lab pay-api missing disk encryption rec Failed sign-ins for bg-emergency Logs in the middle - Defender for Cloud Log Analytics law-tc-lab Sentinel No workspace, no history. A recommendation screenshot is not a query. ## How to choose Need Open Not enough Missing NSG / disk / JIT Defender for Cloud recommendations A Sentinel workbook about France Correlate Entra + Firewall + pay-api Sentinel incident / hunt Secure score alone Keep 30+ days of sign-ins Workspace retention + export Portal last-24-hours click https://portal.azure.com Training mock · not live Azure portal Home Microsoft Entra ID Virtual networks Azure Firewall Microsoft Defender for Cloud → Recommendations ### Unhealthy resources Secure score 54% · dummy Recommendation Encrypt disk on pay-api Not an incident No attacker, no timeline Workspace law-tc-lab · also used by Sentinel Cancel Save Recommendation ≠ incident. Training mock. ## Runbook #### Side A — posture Defender for Cloud on sub-hub and sub-spoke-app . Connect law-tc-lab . Open recommendations for pay-api. Assign an owner. That is a change ticket, not a SOC close. - #### Side B — SIEM Enable Sentinel on the same workspace. Connect Entra sign-in, Azure Firewall, and Activity. Build one analytics rule: any bg-emergency sign-in → incident. - #### Side C — prove Generate a lab sign-in to a decoy. Incident appears with entities. Recommendation list did not change. Two queues, two closes. az · dummy az monitor log-analytics workspace show -g rg-hub -n law-tc-lab --query customerId -o tsv # 44444444-4444-4444-4444-444444444444 az security pricing list --query "[].name" -o tsv # VirtualMachines # SqlServers # StorageAccounts # Sentinel proof is the incident blade + KQL, not this list. # SigninLogs | where UserPrincipalName == "bg-emergency@techclick-lab.in" ## Four failures ### 1 · “Defender is on” as a close Which plan, which sub, which recommendation still unhealthy? ### 2 · Recommendation closed as an incident No IOCs, no user, no time. You closed homework. ### 3 · Sentinel with no connectors Empty SIEM. Pretty, blind. ### 4 · Two workspaces, no story Firewall in one, Entra in the other, nobody joins them. ## How to prove it Close only when 1) You named the product for the question. 2) Workspace ID is known. 3) A Sentinel incident has entities. 4) A Defender recommendation has an owner and a remediating change — separately. ## Traps Screenshot Does not prove Secure score 90% Nobody is in the tenant right now Sentinel enabled Connectors + rules + an on-call Recommendation “exempt” The risk left the building ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Defender for Cloud’s primary unit of work is… A SIEM incident A posture recommendation / secure score item A Private Endpoint A CA grant Correct: b . CSPM. Q2 Microsoft Sentinel is… Only disk encryption A SIEM/SOAR on a Log Analytics workspace An NSG replacement A landing-zone MG Correct: b . Sentinel overview. Q3 A recommendation is not an incident because… Recommendations are encrypted One is configuration debt; the other is a suspected event with evidence Sentinel cannot read Azure Secure score cannot go down Correct: b . Two queues. Q4 Both products typically need… A Log Analytics workspace A public IP on pay-api Owner on a Hotmail WAF on GatewaySubnet Correct: a . law-tc-lab. Q5 Best first rule in this lab? Alert on any bg-emergency sign-in Disable all connectors Exempt every recommendation Store logs on the VM disk only Correct: a . Break-glass monitor. Q6 “Defender is on” is incomplete until you name… The logo color Which plans, which subscriptions, which unhealthy recommendations remain The VPN PSK The tenant vanity domain only Correct: b . Failure 1. Check answers Reset Azure security class series: Shared + Entra · Landing zone · NSG vs Firewall vs WAF · Conditional Access · Key Vault + MI · Private Link · Defender + Sentinel · Hub-spoke · Identity path · Interview ## Sources - Microsoft Learn — Microsoft Defender for Cloud . - Microsoft Learn — What is Microsoft Sentinel? . Related: Azure session factory · Migration series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt