Microsoft Sentinel Launches AI-Driven Agentic SIEM Platform for Enterprise Security

Microsoft Sentinel now offers a general‑availability agentic SIEM platform that unifies security data, context and intelligent agents to help teams detect, investigate, and respond at AI speed. The system centres a unified security data lake, with graph‑based relationships and vectorised data to provide rich context, while AI agents reason across environments in real time.

It also includes a no‑code agent builder in Security Copilot and MCP‑enabled coding support in VS Code for GitHub Copilot–powered agent creation, enabling custom investigations and automated responses. Sentinel integrates with Microsoft Defender and Microsoft Purview, giving teams enhanced visibility and orchestration under one roof, and the architecture is designed to be open and extensible for partner agents.

Microsoft is collaborating with Accenture, ServiceNow, and Zscaler to strengthen the ecosystem, with sessions and demonstrations planned at Microsoft Secure on 30 September–1 October 2025 and at Microsoft Ignite on 17–21 November 2025, in San Francisco or online, where security teams can see the platform in action. according to Microsoft.