“Defenders think in lists. Attackers think in graphs.” — John Lambert, Microsoft Threat Intelligence Center
That quote is one of the most honest things ever said about the differences between attackers and defenders. For years, security teams have lived in spreadsheets, alert queues, and SIEM tables full of rows and columns of events sorted by timestamp. Meanwhile, adversaries move laterally through your environment following relationships. A compromised account leads to a privileged service principal, which leads to a storage blob, which leads to exfiltration. That’s not a list. That’s a graph.
Microsoft Sentinel Graph is Microsoft’s answer to that difference, enabling graph-based security analysis that helps defenders uncover relationships, analyze attack paths, and gain deeper insights from Microsoft Sentinel data.
What Is Microsoft Sentinel Graph and Why Does It Matter for Security?
Before diving into the feature itself, it helps to speak the same language.
A graph is a collection of nodes (the items) and edges (relationships between those items). Your identity infrastructure is a good example of a graph. Users connect to groups, groups connect to roles, roles connect to resources.
Even an attacker’s kill chain is a graph. Initial access leads to credential dumping. Credential dumping leads to lateral movement. Lateral movement leads to data staging. Data staging leads to exfiltration.
Traditional SIEMs store all of this as flat tables. They excel at answering questions like “show me all failed logins in the last 24 hours.” They struggle with “if this user account is compromised, what could an attacker reach from there?”. Because that question requires traversing relationships, not scanning rows.
That is the core insight behind Microsoft Sentinel Graph. If you represent your security data as a connected graph, then suddenly you can ask, and answer, entirely different classes of questions.
What Microsoft Sentinel Graph Actually Does
Microsoft Sentinel Graph is a unified graph analytics capability built into Microsoft Sentinel. At its core, it models the relationships between assets, identities, activities, cloud resources, data flows, and threat intelligence as interconnected nodes and edges. Instead of storing a login event as a row in a table, the graph represents it as a relationship: User A authenticated to Device B at Time T.
The power is in what you can do with that model. Microsoft Sentinel graph enables defense across every stage of the security lifecycle, from pre-breach exposure management to post-breach incident response.
Pre-Breach: Attack Path Analysis
Before a breach happens, Microsoft Sentinel graph helps you understand where your real exposure lies. For instance, the out-of-the-box graph, ‘Attack paths to a critical asset,’ uses graph-based attack path analysis to surface recommendations. It does not simply say, ‘Fix this vulnerability.’ It shows a path an attacker could take from an internet-exposed service to your most critical assets.
This is a meaningful shift. Most vulnerability management tools tell you what is broken. Graph-based attack path analysis tells you what is currently exploitable.
Post-Breach: Blast Radius and the Incident Graph
Once an incident fires, the question becomes: how bad could this get?
The Incident Graph in Microsoft Defender XDR, powered by Microsoft Sentinel graph, gives you a visual map of a breach’s current impact and, critically, its possible future impact. This is what Microsoft calls Blast Radius analysis. Given this compromised entity, what are all the paths an attacker could take from here?
If a user account is compromised, blast radius answers questions like which systems can that account reach? What data can it touch? What privileges could it escalate to? Knowing this information in the first minutes of an incident is the difference between a contained response and a chaotic one.
Investigation: Graph-Based Hunting
Security analysts spend significant time building mental models of how things connect. Microsoft Sentinel graph externalizes that mental model. The graphs in Defender’s Advanced Hunting let analysts perform graph-based threat hunting by interactively traversing relationships between users, devices, and other entities, following paths, surfacing hidden privilege escalations, and identifying which incidents demand immediate attention.
Instead of writing a series of KQL queries and stitching the results together, analysts are exploring a visual representation of their environment’s real topology.
Microsoft Sentinel Graph Across the Microsoft Security Stack
One of the more underappreciated aspects of Microsoft Sentinel Graph is how far it reaches. It is not just a Microsoft Sentinel feature. It is a graph analytics layer that supports capabilities across multiple Microsoft security products:
| Product | Capability | What It Enables |
| Microsoft Defender XDR | Incident Graph with Blast Radius | Visualize current and future breach impact in a single consolidated graph |
| Microsoft Defender XDR | Advanced Hunting Graphs | Interactively traverse entity relationships to uncover hidden attack paths |
| Microsoft Purview – Insider Risk Management | Data Risk Graph | Map user activity to detect exfiltration patterns and data leak blast radius |
| Microsoft Purview – Data Security Investigations | Data Risk Graph | Trace sensitive data access and movement across your environment |
The unifying thread is the same underlying graph layer. Investments in your Microsoft Sentinel graph model pay dividends across the full Microsoft security portfolio.
Custom Graphs: Bringing Your Own Data
Out-of-the-box graph capabilities cover a lot of ground, but every environment has situations that generic models do not capture. That is where Custom Graphs come in.
Custom graphs let you build your own graph models using data from the Microsoft Sentinel data lake, including non-Microsoft sources. You define the nodes and edges that matter for your environment, query them using Graph Query Language (GQL), and visualize the results directly in the Defender portal or in Jupyter notebooks through the Sentinel VS Code extension.
Some of the scenarios Microsoft surfaces for custom graphs illustrate what’s possible:
- Phishing kill chain with business context: Trace the chain from inbox to compromise.
- DNS C2 beacon detection: Identify devices exhibiting beaconing behavior by analyzing statistical patterns in DNS queries (low interval variance, high time coverage), separating automated attacker traffic from normal human browsing.
- OAuth privilege escalation: Surface service principals that granted permissions to themselves and added those permissions into a directory role.
- Behavioral attack chain detection: Find users and IPs that touch behaviors mapped to three or more distinct MITRE ATT&CK techniques and trace the full evidence chain.
Custom graphs can be run interactively during an investigation or materialized as a scheduled graph job that refreshes continuously, making them available to your whole team through the Defender portal and graph query APIs.
Microsoft Sentinel Graph and AI-Powered Security
There is a practical reason graph structures have become a priority right now, beyond just security analytics: AI agents need them.
When a Copilot or AI agent tries to investigate an incident, it needs context, not just isolated facts. A graph that links a suspicious user to the devices they have authenticated to, the files they have accessed, and the threat intelligence associated with their IP provides far richer context for an AI agent to reason over than a set of disconnected log tables.
Microsoft makes this explicit. Custom graphs provide the knowledge context that enables AI-powered agent experiences to work more effectively, accelerating investigations, revealing blast radius, and helping teams move from noisy, disconnected alerts to confident decisions at scale.
In other words, a graph is not just about how humans investigate. It is becoming foundational infrastructure for how AI-assisted security works.
Why Microsoft Sentinel Graph Matters for Security Teams
John Lambert’s quote has been cited in security circles for years because it names something real: the structural disadvantage defenders have been operating under. Attackers move through relationships. Defenders have been stuck analyzing events.
Microsoft Sentinel graph does not eliminate that gap overnight, but it helps level the playing field. When you can ask, ‘What is the blast radius of this compromised account?’ and get a visual answer in seconds rather than after hours of manual query writing, you are starting to think in the same model your adversaries use.
How Cyclotron Can Help
At Cyclotron, we have deep expertise in Microsoft Sentinel deployments, security operations transformation, and the broader Microsoft Security ecosystem. Whether your organization is just getting started with Sentinel or looking to unlock advanced capabilities like graph-based threat hunting, attack path analysis, blast radius analysis, and custom graph models, our team can help you move from alert-driven reaction to relationship-aware defense.
As a 2024 Microsoft Compliance Partner of the Year and finalist for the 2025 Microsoft Security Excellence Customer Champion, Cyclotron brings battle-tested expertise in threat protection, identity governance, and enterprise security architecture.
If your organization is ready to start thinking in graphs, contact Cyclotron to learn how we can accelerate your Microsoft Sentinel journey.