Lesson 18 — Microsoft Sentinel Fusion

Learning objectives

After completing this lesson, you should understand how Microsoft Sentinel Fusion creates high-confidence incidents from related security signals.

• Explain what Microsoft Sentinel Fusion is.
• Understand multi-stage attack correlation.
• Recognise contributing alerts, entities and context.
• Compare Fusion with traditional analytics rules.
• Investigate Fusion incidents safely and methodically.

The problem this solves

Attack campaigns rarely appear as one perfect alert.

Fusion helps analysts see how separate detections may belong to the same attack sequence.

Multi-stage attacks

A multi-stage attack moves through several phases such as initial access, credential use, persistence, lateral movement and data access.

Fusion helps identify when different alerts may represent those connected stages.

Machine learning correlation

Fusion uses Microsoft-managed machine learning models rather than a single analyst-written KQL query.

The models look for combinations of signals, entities, timing and behaviour that are more meaningful together than separately.

Contributing alerts

A Fusion incident may contain alerts from several Microsoft security services.

Each contributing alert must be reviewed because it may explain a different stage of the attack.

Shared entities

Fusion commonly relies on shared entities such as accounts, hosts, IP addresses, applications, mailboxes and cloud resources.

Accurate entity mapping makes those relationships easier to identify and investigate.

Timeline correlation

Timing is critical during correlation.

Alerts occurring in a logical sequence may reveal progression from initial access to persistence or impact.

UEBA context

Behavioural anomalies can strengthen the context surrounding a Fusion incident.

For example, an unusual sign-in may become more significant when followed by mailbox changes and endpoint activity.

Where the signals come from

• Microsoft Defender XDR
• Microsoft Defender for Endpoint
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Microsoft Defender for Cloud Apps
• Microsoft Entra ID and connected Sentinel data

Investigating a Fusion incident

• Review every contributing alert.
• Confirm shared entities.
• Reconstruct the timeline.
• Open the underlying evidence.
• Validate whether the stages form one attack.

Use the Investigation Graph

The Investigation Graph helps visualise how the contributing alerts and entities connect.

Use it to identify pivots, then return to the raw telemetry to confirm each relationship.

Use entity pages

Entity pages provide historical, behavioural and alert context for accounts, hosts and IP addresses.

This can help establish whether the Fusion incident represents a broader pattern.

Common mistake

A common mistake is investigating only the highest-severity alert in the incident.

Lower-confidence alerts may reveal how the attacker entered, moved or persisted.

False positive considerations

Correlation increases confidence, but legitimate administrative work can still create unusual combinations of alerts.

Validate the sequence against change records, user context and expected business activity.

Best practices

• Keep Microsoft security connectors healthy.
• Use accurate entity mapping.
• Review UEBA and threat intelligence context.
• Investigate all contributing alerts.
• Document the confirmed attack sequence.

Agent Foskett takeaway

Fusion connects evidence that may look weak or unrelated when viewed alone.

Its value comes from showing the analyst a possible multi-stage attack that must then be validated carefully.