Sentinel normalization guidance now prohibits cross-table enrichment and preserves record cardinality

The period’s most consequential update was revised Sentinel parser guidance: parsers are limited to their declared source table, one normalized output per source record, and scalar or local static mappings. Cross-table enrichment, watchlists, multi-value expansion, joins, aggregation, and deduplication are explicitly excluded. Companion AI-agent guidance permits query-local lookup mappings only when keys are unique. Defender XDR also added detailed advanced-hunting graph guidance, while seven Azure Storage alert entries now use Informational severity. Other changes were mainly editorial, with added troubleshooting steps for the Sensor v3.x RPC Audit Misconfigured alert.

• Sentinel · Cloud and workloads

  Sentinel parser guidance draws strict normalization boundaries

  The revised guidance limits parsers to the declared source table and one normalized output per source record, using scalar or local static mappings. It explicitly excludes cross-table enrichment, watchlists, multi-value expansion, joins, aggregation, and deduplication; source filtering must use fields from the current event.

• Sentinel · Cloud and workloads

  AI-agent parser guidance preserves record-by-record output

  Parser-creation skills are described as normalizing each source record independently while preserving record cardinality. Query-local datatable or lookup mappings are allowed only when lookup keys are unique; same-table and cross-table event enrichment are not used.

• Defender XDR · Hunting and detection

  Advanced hunting receives dedicated graph-mapping guidance

  A new page explains how to prepare query results, configure graph nodes and edges, apply relationship conditions, and use recognized entity types and identifiers for Defender enrichment.

• Defender XDR · Hunting and detection

  Advanced hunting results guidance expands visual relationship workflows

  The updated article documents mapping results to nodes and edges through Builder or JSON, then exploring entity enrichment, relationship details, folding, and mapping edits without writing a graph-specific query.

• Defender for Cloud · Cloud and workloads

  Seven Azure Storage alert entries now show Informational severity

  The documented severity for seven Azure Storage alerts changed from High, Medium, or Low variants to Informational. Administrators should use the revised labels when reviewing and prioritizing these documented alerts.

This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.