Defender XDR Unified Detections Meet Sentinel Data Lake

Tue, 24 Feb 2026 22:00:03 +0000

With the Unified Security Operations Platform (USOP), Microsoft introduces Unified Detections - a single detection framework spanning both Sentinel and Defender XDR data. Pair this with native Sentinel Data Lake ingestion for XDR tables, and you have a compelling cost-optimization story. But is it ready for prime time? Let’s dive into the capabilities, current limitations, and what it means for your detection strategy.

Architecture Overview
#

Previous Detection Architecture
#

In the ‘previous’ architecture, detections were created and managed separately for Microsoft Sentinel and Microsoft Defender XDR. This often led to overhead in terms of ‘where to create the detection’. Let’s take the use-case of IoC (Indicators of Compromise) based detections. Previously, if a security team wanted to create a detection based on IoCs imported via TAXII into Sentinel and the DeviceNetworkEvents table, they would need to ingest the DeviceNetworkEvents data into Sentinel as well and create the detection rule there. Furthermore, many MSSPs leveraged this pattern to create custom detections for their customers across Defender Advanced Hunting Data.

As part of the USOP onboarding, the following effects come into play, marked with an asterisk above:

Data Lake on Nicola Suter

Defender XDR Unified Detections Meet Sentinel Data Lake

Architecture Overview #

Previous Detection Architecture #

Architecture Overview
#

Previous Detection Architecture
#