MMS 2026 at MOA

Description:
Develop a comprehensive threat-hunting strategy that integrates MCP Server for natural-language analysis with graph-driven investigations in Microsoft Sentinel. Learn to transform KQL queries into reusable MCP tools and connect them with Copilot or custom agents. Use entity mapping and User and Entity Behavior Analytics (UEBA) to uncover connections between identities, hosts, IPs, and apps while navigating through realistic incident scenarios.

What you will learn:

• Operationalize agentic hunting: Transform your team's common KQL queries into reusable MCP tools, enhancing efficiency with Copilot integration.
• Think in graphs, not tables: Navigate complex relationships (Account ↔ Device ↔ IP ↔ App) to speed up triage and root-cause analysis.
• Fortify your ingestion pipeline: Gain insights on normalization (ASIM), enrichment, and cost control within the Sentinel data lake.
• Implement a rollout checklist covering roles, permissions, change management, and metrics to ensure successful adoption of graph and MCP.