Comparing Microsoft Azure Sentinel and Microsoft Graph Security API integrations with SIR
Summarize
Summary of Comparing Microsoft Azure Sentinel and Microsoft Graph Security API integrations with SIR
This document outlines the differences between Microsoft Azure Sentinel and Microsoft Graph Security API integrations with the ServiceNow Security Incident Response (SIR) module. Notably, Microsoft has extended the deprecation timeline for Azure Sentinel in the Azure portal to March 2027, urging users to transition to the Defender portal integration, which offers a built-in migration utility for seamless profile conversion.
Show less
Key Features
- Microsoft Azure Sentinel: A cloud-based SIEM and SOAR solution providing intelligent security analytics, alert detection, threat visibility, and incident response. It automates the creation of security incidents in SIR and updates their status based on incident actions.
- Microsoft Graph Security API: Serves as a programmatic interface connecting various security providers, facilitating alert ingestion from multiple sources—including Azure Sentinel—and automating incident creation in SIR using a standard schema.
Key differences include:
- Azure Sentinel ingests its own incidents with entity information, while the Graph Security API ingests alerts from various providers.
- Azure Sentinel supports incident status updates, whereas the Graph Security API supports alert status changes and closures for selected providers.
Key Outcomes
- Choose Azure Sentinel if your workflow involves preliminary investigations conducted in Azure Sentinel, followed by further investigation in SIR.
- Select the Microsoft Graph Security API if you plan to perform investigations directly in SIR and need to ingest alerts from Azure Sentinel.
- Note that alert data from Azure Sentinel is richer, but you cannot update alerts directly in Azure Sentinel using either integration.
You can view the differences between Microsoft Azure Sentinel and Microsoft Graph Security API integrations and choose the right integration with your ServiceNow AI Platform instance.
Microsoft has extended the deprecation of the Azure Sentinel experience in the Azure portal from March 2026 to March 2027.
If you are currently using the Azure Sentinel integration with Security Incident Response (SIR), we strongly recommend migrating to the new Defender portal integration as soon as possible. The Defender integration includes a built-in migration utility that automatically converts your existing Sentinel profiles into Defender profiles, while ensuring continuity of incidents created through Sentinel after the transition. For more information, see Microsoft Sentinel to Defender Migration Guide.
Microsoft Azure Sentinel - Incident Ingestion overview
Microsoft Azure Sentinel is a cloud-based security information event management (SIEM) and security orchestration automated response (SOAR) solution. Microsoft Azure Sentinel delivers intelligent security analytics and threat intelligence across the enterprise. It provides a single solution for alert detection, threat visibility, proactive hunting, and threat response.
Microsoft Graph Security API overview
The Microsoft Graph Security API is an intermediary service (or broker) that provides a single programmatic interface for connecting multiple security providers (Native to Microsoft as well as ServiceNow Partners).
The Microsoft Graph Security API integration addresses these issues by using the Microsoft Graph Security API to connect with different Microsoft security technologies like Azure Sentinel, Microsoft Defender Advanced Threat Protection, and Azure Advanced Threat Protection. Alerts from Microsoft Security providers are ingested and security incidents are automatically created in Security Incident Response.
Summary of feature differences
| Microsoft Azure Sentinel | Microsoft Graph Security API |
|---|---|
| Ingests Microsoft Azure Sentinel incidents along with entity information (when available) and automates security incident creation in SIR. | Ingests alerts from multiple Security providers (including Azure Sentinel) in a standard schema and automates security incident creation in SIR. |
| Automates Microsoft Azure Sentinel incident status
updates for Security Incident Response so that you can create and close
security incidents. Note: ServiceNow updates the status of Microsoft Azure Sentinel incidents based on the
security incident creation or closure. |
Supports alert updates (alert status change and alert closure) for selected security
providers. Note: For more information on the Microsoft Graph Security API
supported security providers, view the Microsoft documentation. |
Use this integration if your scenario includes the following conditions:
|
Use this integration if your scenario includes the following conditions:
|
| Alert is an entity in Microsoft Azure Sentinel. You cannot retrieve standalone or specific alerts using the Microsoft Azure Sentinel Management API. You can only retrieve the alert data associated with an incident. The alert data available using this integration is richer than the alert data available using the Microsoft Graph Security API. | The Microsoft Azure Sentinel normalized alert data is available. The Microsoft Azure Sentinel alert fields that are mapped internally in Microsoft Graph Security API, and are available in Microsoft Graph Security API, are available for use in this integration. |
| You cannot update alerts in Microsoft Azure Sentinel using this integration. |