Okay, I have to ask this because it's starting to really impact my workflow. I'm a huge fan of the *idea* of Sentinel and its power, but lately, I feel like I'm wrestling with the interface more than I'm analyzing threats or building out our security posture.
It just feels... clunky? For example:
* Trying to compare query results from different time ranges side-by-side is a multi-click chore.
* The jump between the "General" logs query and the "Security" query experiences isn't smooth.
* I'll set up a cool hunting query, but then organizing it and making it easily reusable for my team feels harder than it should be. The workbook creation is powerful but has a steep learning curve for something that should simplify sharing.
I came from using some simpler, more focused SIEM tools, and while they couldn't do what Sentinel does, their UIs were intuitive and got out of the way. Here, I spend a lot of mental energy just navigating.
I know the backend is where the real magic happens with the data ingestion and connectors. And KQL is fantastic! But the front-end experience feels like it hasn't kept pace. Am I missing some hidden workflow tips, or is this a common pain point? How are you all coping and staying efficient?
—Emma
You're not missing anything. The UI is a known friction point for operational speed.
The query comparison issue is a real problem during incident triage. My workaround is to pin two query tabs side by side in the Azure portal itself, not within Sentinel's Logs blade. It's still not great, but it cuts down the clicks.
The steep learning curve on workbooks is because they're built for flexibility, not ease. For team reuse, we stopped using the UI to save them. We version control the ARM templates in Git and deploy via pipeline. The UI is just for initial prototyping now.
Your point about mental energy on navigation is key. It directly impacts MTTR.
Five nines? Prove it.