On one hand, if you know what you're doing, Sentinel, KQL, MSTIC[0] are incredibly useful tools that show Microsoft's investment in security for the operations slanted folk. On the other hand, this is being billed as helping operationalize junior analysts navigate incidents better. I'm all for that, but the step from junior -> mid -> senior in SecOps/DnR/ThreatOps space generally comes from either annoyance at a friction in the processes faced, or genuine curiosity in something that's more of a SWE slant.

What I would like to see in this case is significant effort to expose decision context and learning points in the investigation so that when your incident goes for review or you grab a more senior analyst, they can have contest on how to grow the responder.

As a final note: i feel like we are hitting the marginal gains phase of what endpoint security tooling can look like. This tool probably gains significantly more traction if your org is a MS/Windows workstation shop. It may even play nice in Azure land. However, I would much rather see tooling shaped like this that are centered in production for detecting threats where we make money.

If you're hiring your first security engineer/head of security for your startup, it's much easier to reason about hiring someone with an AppSec or CloudSec background than it is detection. Perhaps shunting tooling that way will help the DNR people level up there and be valuable assets earlier.

Edit: forgot the MSTIC Link

https://github.com/microsoft/msticpy