Analyst(s): Krista Case, Fernando Montenegro
Publication Date: July 24, 2025
Microsoft has launched Sentinel Data Lake, an update to its security platform designed to make long-term security log storage more cost-effective and centralized. Integrating advanced analytics, AI, and now Defender Threat Intelligence, it aims to enhance a security team’s ability to detect and respond to complex threats more efficiently.
What is Covered in this Article:
- Microsoft’s release of Sentinel Data Lake and changes to its Threat Intel offering
- The appeal of a more integrated approach for security operations
- The potential benefits of a growing number of AI-centric security workloads
The News: Microsoft has launched Sentinel Data Lake in public preview, a cloud-native extension of Microsoft Sentinel that centralizes security logs from over 350 Microsoft and third-party connectors into a purpose-built, cost-effective data lake tier supporting long-term retention, priced at under 15 % of traditional analytics log storage. The platform enables advanced analytics via Kusto Query Language (KQL), Python/Spark jobs, and Jupyter notebooks, and it integrates directly with Security Copilot and Defender XDR. The company also announced the unification of Microsoft Defender Threat Intelligence within Sentinel and XDR at no extra cost.
Microsoft Now Offers a Security Data Lake. Time To Jump Into the Water?
Analyst Take: The Futurum Group has been tracking four major trends this year related to the evolution of the cybersecurity market: the dominance of AI as a topic, be it in security for AI, AI for security, or protection against AI-enabled threats; how organizations are tackling the expansion of the attack surface, both in terms of numbers and in complexity; the preference for platform-centric offerings over point products; and the evolution of data protection into cyber resilience.
This announcement from Microsoft touches on all of those, in some way, shape, or form.
SIEM deployments have long been growing overly costly and complex, especially as the volume of data they are attempting to ingest for exploration, spanning real-time detection and response as well as longer-term compliance and threat hunting use cases, continues to grow. Customers will still have to be strategic with the data that they retain, but the introduction of Microsoft’s lower-cost, retention-oriented Microsoft Sentinel Data Lake is a notable step towards addressing the cost-retention tradeoffs that are a critical risk, as today’s sprawling attack surfaces and sophisticated, fast-changing threat vectors require blind spots to be eliminated.
At the same time, it portends the possibility of a centralized data lake for AI-enriched threat context and response. When married with the flexibility of being built on open formats (e.g., Kusto tables, Apache Spark, Python notebooks), this will likely improve security teams’ ability to use AI agents for security, in turn bolstering their ability to protect against fast-moving, difficult-to-detect AI-driven attacks. Examples include improving the ability to correlate cross-log patterns and initiate a response in near real time. Naturally, visibility, context, and response will be further improved by integrating Defender Threat Intelligence directly into Sentinel and Defender XDR.
The bottom line? The announcement positions Sentinel from a more rigid and expensive silo into a more flexible and comprehensive platform that is more cost-efficient and better able to detect and respond to emerging threats. It will be especially appealing for large enterprises, MDR service providers, and organizations in compliance-heavy environments looking to scale their SOC capabilities and increase the nimbleness of their security teams while addressing the need for cost optimizations.
What to Watch:
- Have we as an industry arrived at a repeatable pattern with data lakes and integrated threat intel? It’s a common technology evolutionary pattern that as things become more stable, they become foundational for higher-value capabilities. This announcement ties into a raft of other offerings, signalling a possible consensus on what modern security operations will look like.
- Will customer uptake patterns of new functionality match Microsoft’s expectations? While Microsoft is making the case for unification on its data lake, customers need to account for numerous constraints to this integration, above and beyond cost.
- How will this set of capabilities affect the deployment of more agentic AI-type workloads? While this is a key proposed benefit of the new offering, many customers are at different stages of maturity in adopting agentic AI workflows. They may have other needs related to the underlying data.
- What will the competitive response look like? Microsoft competes on multiple fronts and many of its competitors also propose similar approaches, from AWS and Google, through Cisco, Elastic, DataDog, to security platform vendors including Palo Alto Networks, CrowdStrike, SentinelOne, and others.
See the complete press release on Microsoft’s website.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other insights from Futurum:
Azure Kubernetes Services (AKS) Powers AI Workloads And Addresses Complexity
Microsoft Q3 FY 2025 Earnings Beat on Strong Cloud and AI Services Growth
Microsoft Embraces the Development Community on the Path to Agentic AI
Author Information
Krista Case brings over 15 years of experience providing research and advisory services and creating thought leadership content. Her vantage point spans technology and vendor portfolio developments; customer buying behavior trends; and vendor ecosystems, go-to-market positioning, and business models. Her work has appeared in major publications including eWeek, TechTarget and The Register.
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
