Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Guide to build and publish Microsoft Sentinel SIEM solutions

4 September 2026Doc update+56 / −35 lines

In brief

The guide now focuses on the Microsoft Sentinel SIEM solution lifecycle, adds a lifecycle diagram, and documents prerequisites for publishing to Azure Commercial Marketplace, including joining the Microsoft Cloud Partner Program and creating a Partner Center account.

What Defender admins need to know

Administrators involved in Sentinel partner integrations can use the revised lifecycle guidance and prerequisites when planning solution development and publication.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Build and publish Microsoft Sentinel SIEM solutions

Microsoft Sentinel SIEM and platform includes a range of capabilities that partners can use to create impactful solutions they can publish through the Microsoft Security Store or the Sentinel SIEM Content Hub. By building on top of Sentinel, partners can enable new scenarios that use a wide breadth of security data, processing capabilities,data and AI experiences, without needing new pipelines, processinganalytics capabilities or storage infrastructure.to help customers detect and respond to threats.

For example,This article provides an overview of the lifecycle of building and publishing Microsoft Sentinel SIEM solutions, from learning about Sentinel and planning your solution, to building, testing, and publishing it to customers. Each section includes links to more detailed documentation to help you canthrough each step of the process.

:::image type="content" source="media/sentinel-integration-guide/sentinel-integration-timeline.png" lightbox="media/sentinel-integration-guide/sentinel-integration-timeline.png" alt-text="Diagram that shows high-level phases for the Microsoft Sentinel SIEM solution lifecycle from learn through go-to-market.":::

Prerequisites

Before you create and publish a connectorSIEM solution to bring new data into Sentinel, analyze that data with Sentinel Jupyter notebook jobs,Azure Commercial Marketplace, join the Microsoft Cloud Partner Program and create an agent that uses MCP tools to analyzeaccount in Partner Center. See the new data along with other data alreadyfollowing resources for more information:

Learn about Microsoft Sentinel

Step Description
Learn about Sentinel TheMicrosoft Sentinel platform includes a data lake, graph, and MCP server.

The SIEM is a scalable, cloud-native security information and event management (SIEM) application that delivers an intelligent and comprehensive solution for SIEM and security orchestration, automation, and response (SOAR). It provides cyberthreat detection, investigation, response, and proactive hunting, with a bird's-eye view across your enterprise.

Data lake, graph, and MCP capabilities give developers the ability to create solutions that can use tools from Sentinel’s Model Context Protocol (MCP) server to extract insights from any Sentinel data.

For more information, see:
What is Microsoft Sentinel?
Identify what to build The most important step to a greatsuccessful integration is deciding which types of content to include in your solution. Explore the following resources to understand Microsoft Sentinel.

For more information, see:
Technology Integration Scenarios with Microsoft SentinelTechnology Integration Scenarios with Microsoft Sentinel
Building Microsoft Sentinel Integrations - Part 1: Onboarding
Decide which components to include in your solution
Review the docs There is's a rich collection of documentation to support with your journey. Here are some key resources to get you started.

For more information, see:
Guide to understand Microsoft Sentinel solution repository in GitHub
Guide to understand ASIM (Advanced Security Information Model) Schema
Guide to understand Kusto query language
Become a Cloud Partner and create a Publisher Account Microsoft Sentinel solutions are published on the Azure Commercial Marketplace. To publish to the marketplace, join the cloud partner program.

For more information, see:
Guide to understand Microsoft commercial marketplace
Guide to create a commercial marketplace account in Microsoft Partner Center
Join ISV Success program
Sign up for Microsoft for Startups program, if applicable

Build your solution

Once you have a good understanding of Microsoft Sentinel and the solution you want to building.building, follow these steps:

Step Description
Provisioning environment To help you get started with building and testing your solution, we recommend you sign up for an Azure Free Trial and a Microsoft Sentinel Free Trial.

For more information, see:
Sign up for an Azure Free Trial
Then sign up for a Microsoft Sentinel Free Trial (Scroll down to 'Free trial')
Complete the training lab We highly recommend the training lab to get fully ramped up with Microsoft Sentinel. This lab provides hands-on practical experience for product features, capabilities, and scenarios.

For more information, see:
Complete the Microsoft Sentinel Training Lab
Build a connector Microsoft Sentinel is built on data. Most solutions start with bringing the data from a customer’customer's environment into Microsoft Sentinel. To understand how to build a connector, refer to the following resources.

For more information, see:
Guide to Building Microsoft Sentinel Data ExperiencesDevelop a SIEM solution for Microsoft Sentinel
Build custom connectors with AI in Microsoft Sentinel
Create a pull codeless connector for Microsoft Sentinel
Webinar: Creating Data Connectors
Build your SIEM content In addition to data, your solution can offer a rich array of other components to help customers get the most out of your data. For example, you can offer detections, workbooks, playbooks, and hunting queries to make your offering readily usable by customers.

For more information, see:
What can you contribute and how can you create contributions?
Create Jupyter notebook jobs and Security Copilot agentsSecurity Copilot agents and Sentinel data lake jobs allow you to create powerful solutions that can reason over data in the Sentinel data lake and identify threats and surface insights. The following resources explain how to use those capabilities.

Get started with Microsoft Security Copilot
Create and manage Jupyter notebook jobs
Running notebooks on the Microsoft Sentinel data lake
Using AI with Sentinel data lakeMicrosoft Sentinel’s security data lake unifies long‑term, cost‑effective retention with rich, security‑specific context. That foundation pairs naturally with Model Context Protocol (MCP) tools and Microsoft Copilot for Security to deliver agentic (tool‑using, goal‑directed) workflows for Security Operations Center (SOC) teams.

For more information, see:
What is MCP?
Microsoft Security Copilot documentationMicrosoft Sentinel components and patterns
Security, privacy and compliance For details on Secure Future Initiative (SFI) requirements, see https://aka.ms/securefutureinitiative
Follow the Security Development Lifecycle (SDL) practices for:
- Threat modeling
- Secure configuration
- Dependency hygiene
- Penetration testing in coordination with your security team
- Use only approved tools for vulnerability tracking and patch management. For more information, see Microsoft Security Development Lifecycle

Test your solution

Once the solution is built,built you need to package and test it to ensure that it meets the quality standards and is ready for publishing. The Microsoft Sentinel engineering staff reviewsyour solution. Once you have tested you will validate your solution locally and provides feedback.then submit a pull request (PR), address feedback as needed, and have your PR approved and merged.

Step Description
Microsoft merges PR & generates packagePackage and test your SIEM solution Upon the successful completion of all technical feedback, Microsoft Sentinel engineering staff merges the pull request into the main branch,Once your solution is built, package it and generates the final package you needtest it to submit with your offer.ensure that it meets SIEM solution quality standards and is ready for publishing.

For more information, see Develop a SIEM solution for Microsoft Sentinel and Microsoft Sentinel SIEM solution quality guidelines.
Submit a pull request for SIEM content to get feedback and receive a packageRun local validation Run validation scripts against your packaged solution to check whether your solution passes CI validation checks before you submit a PR. For SIEM content, raisemore information, see Local validation scripts.
Open a GitHub pull requestRaise a pull request (PR) in the Microsoft Sentinel solutions repository so the Microsoft Sentinel engineering staff can review it and provide feedback. Once the
Resolve technical feedback is providedfeedback, merge PR, and any outstanding issues are resolved, thegenerate packageThe Microsoft Sentinel engineering staff reviews your solution and provides feedback. After you address all technical feedback, the engineering staff merges the pull request into the main branch,branch and generates the final package that you need to submit with your offer. For more information, see Microsoft Sentinel and Microsoft 365 Defender- Pull requestDevelop SIEM solutions.

Publish

Step Description
Create an offer Once you have a solution package, you’you're ready to create an offer in the Security Store or Marketplace. For more information on how to publish your solution, see the following resources.

For more information, see:
Publish Solutions to Microsoft Sentinel
Test Offer Preview We create a version of your offer that is accessible only to the preview audience you specified. Creating a preview offer ensures that specific audiences test your solution before your solution is broadly shared with all customers. We recommend keeping your solution in preview for at least four weeks to gather feedback from customers and address any issues that arise.  

For more information, see:
Status of Microsoft Sentinel solution after publishing in the Microsoft Partner centerMicrosoft Sentinel Solution Lifecycle in Partner Center
Fix certification issues Offers submitted to the commercial marketplace must be certified before being published. If your offer fails any of the checks or if you aren't eligible to submit an offer of that type, a certification failure report is sent to your email address. The errors also show up within Action Center in Partner Center. For more information, see Certification issuesCertification issues. After the issues are fixed, you can resubmit the offer for certification. This triggers the review process again and once the offer passes certification. Your solution is published to the marketplace and available for customers in Microsoft Sentinel content hub within two working days.
Make the offer broadly available Ensure that you validatedvalidate all aspects of your solution in preview phase before you make the test offer live. Ensure that you validate all aspects of your solution in preview phase before you make the offer live.

For more information, see:
Publisher approval

Preview

After your solution is published to the Azure Commercial Marketplace, you can make it available to customers in preview mode. This section provides guidance on how to make your solution available to customers in preview mode.

StepDescription
Inform customersSocialize the availability of your solution with your customers so that they can test and provide feedback on the solution.
Resolve support issuesAs customers use the preview version of your solution, they might encounter issues. Be prepared to address these issues as they arise. In addition to issues, customers might also request new features or enhancements. Depending on the feedback, you need to iterate on your solution before making it generally available.
Continue for four weeksWe recommend keeping your solution in preview for at least four weeks to gather feedback from customers and address any issues that arise.Publisher approval

Go to Market (GTM)

After your solution is in preview for at least four weeks and you address any issues that customers encounter, you can make your solution generally available to all customers.

|Step| Description| |Listen for customer feedback|Continue to monitor feedback and support requests as your solution gains traction.| |Enhance solution|Based on customer feedback, you might need to enhance your solution to meet customer needs. Customer feedback might require the addition of new features, improving performance, or addressing any issues that customers encounter.|

Microsoft offers the following programs to help partners approach Microsoft customers:

  • Microsoft Partner Network (MPN): The primary program for partnering with Microsoft is the Microsoft Partner Network. Membership in MPN is required to become an Azure Marketplace publisher, which is where all Microsoft Sentinel solutions are published.

  • Azure Marketplace: Microsoft Sentinel solutions are delivered via Azure Marketplace, where customers discover and deploy both Microsoft and partner-supplied Azure integrations.

    Microsoft Sentinel solutions are one of many types of offers found in Marketplace. You can also find solution offerings embedded in Microsoft Sentinel content hub.

  • Microsoft Intelligent Security Association (MISA). MISA helps Microsoft Security partners create awareness about partner-created integrations with Microsoft customers and improve discoverability for Microsoft Security product integrations.

    Joining the MISA program requires a nomination from a participating Microsoft Security product team. Building any of the following integrations can qualify partners for nomination:

    • A Microsoft Sentinel data connector and associated content, such as workbooks, sample queries, and analytics rules.
    • Published Logic Apps connector and Microsoft Sentinel playbooks.
    • API integrations, on a case-by-case basis.

To request a MISA nomination review or ask questions, contact [email protected].

Related content

Publish solutions to Microsoft Sentinel \ No newline at end of file