diff --git a/Instructions/Labs/Lab_27_MicrosoftSentinelKustoQueries.md b/Instructions/Labs/Lab_27_MicrosoftSentinelKustoQueries.md index bf124e5b..01bbb3a1 100644 --- a/Instructions/Labs/Lab_27_MicrosoftSentinelKustoQueries.md +++ b/Instructions/Labs/Lab_27_MicrosoftSentinelKustoQueries.md @@ -11,7 +11,7 @@ lab: ## Lab scenario -Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution. Through connecting data sources from Microsoft and third-party security solutions, you have the ability to execute security operations tasks. In this lab exercise, you will create a Microsoft Sentinel workspace with data connectors to Azure AD for executing hunting queries using Kusto Query Language (KQL). +Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution. Through connecting data sources from Microsoft and third-party security solutions, you have the ability to execute security operations tasks. In this lab exercise, you will create a Microsoft Sentinel workspace with data connectors to Microsoft Entra ID for executing hunting queries using Kusto Query Language (KQL). #### Estimated time: 30 minutes @@ -39,7 +39,7 @@ Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution. Through 1. If prompted, select **OK** to activate the Microsoft Sentinel free trial. -#### Task 2 - Add Azure AD as a Data source +#### Task 2 - Add Microsoft Entra ID as a Data source **Note** - As of 2/8/2024, the data source is now Microsoft Entra ID. 1. In **Microsoft Sentinel**, navigate on the menu to **Content management** and select **Content hub**.