Microsoft Expands Sentinel Into Agentic Security Platform With Unified Data Lake

Microsoft has expanded its Sentinel SIEM into a unified agentic platform with the general availability of a Sentinel data lake, unveiled alongside a public preview of Sentinel Graph and Sentinel Model Context Protocol server. The move aims to give defenders a single platform to ingest signals, correlate across domains, and empower AI agents built in Security Copilot or with GitHub Copilot, among other developer platforms.

Microsoft first released the Sentinel data lake in public preview earlier this July to unify signals and enable AI models to have full context for detecting patterns and surfacing high-fidelity alerts. The shift towards an agentic defence is supported by graph-based context and semantic access, said by Vasu Jakkal, corporate vice president at Microsoft Security, in a post shared with The Hacker News.

Microsoft also noted that Sentinel can be used to secure AI workflows by allowing users to build Security Copilot agents in a Sentinel MCP server-enabled coding environment such as VS Code with GitHub Copilot, tailored to organisational workflows. In addition, the company intends to roll out enhancements to Azure AI Foundry to provide more protection for AI agents against (cross-)prompt injection attacks.

According to Microsoft, the data lake lays the foundation for an agentic defence by bringing data from diverse sources to support AI models with full context.