# Control 3.9: Microsoft Sentinel Integration - Screenshot Specifications

## Required Screenshots

| Filename | Portal | Navigation Path | What to Capture |
|----------|--------|-----------------|-----------------|
| `01-azure-sentinel-overview.png` | Azure | Sentinel → Overview | Sentinel dashboard |
| `02-azure-sentinel-connectors.png` | Azure | Sentinel → Data connectors | Connector list |
| `03-azure-sentinel-pp-connector.png` | Azure | Data connectors → Power Platform | Power Platform connector |
| `04-azure-sentinel-connector-config.png` | Azure | Connector → Configuration | Connector setup |
| `05-azure-sentinel-analytics.png` | Azure | Sentinel → Analytics | Analytics rules |
| `06-azure-sentinel-rule-create.png` | Azure | Analytics → Create | Rule creation |
| `07-azure-sentinel-incidents.png` | Azure | Sentinel → Incidents | Incident queue |
| `08-azure-sentinel-workbooks.png` | Azure | Sentinel → Workbooks | Dashboards/workbooks |
| `09-azure-sentinel-automation.png` | Azure | Sentinel → Automation | Playbooks |

## Notes for Verification

- Sentinel workspace is configured
- Power Platform connector is enabled
- Analytics rules detect agent threats
- Incidents flow to Sentinel

---

[Back to Control 3.9](../../controls/pillar-3-reporting/3.9-microsoft-sentinel-integration.md)
