Microsoft integrates SOC capabilities with Defender for enterprises

Microsoft 365 E5 and E7 customers can now run security information and event management (SIEM) inside Microsoft Defender at no extra license cost. Microsoft is delivering the capability through the Integrated Security Operations Center (ISOC) in Microsoft Defender, which combines SIEM with Defender’s existing XDR, threat intelligence, automation and AI tools in a single portal. “Security cannot operate at AI speed when protection and operations are built as separate systems,” Rob Lefferts, corporate vice president of Microsoft Threat Protection, wrote in a blog post announcing ISOC. He said attackers now use AI agents to automate attacks at scale, and that every handoff between separate tools slows defenders down. Until now, E5 and E7 included Defender XDR but not SIEM, which Microsoft sells separately as Microsoft Sentinel. Under ISOC, logs from Microsoft’s own security products are available without ingestion charges. From Oct. 1, data ingested from third-party security tools and other outside sources will be metered at $2.40 per GB on a pay-as-you-go basis, Microsoft said in a technical blog post. The company opened ISOC as a public preview, meaning it is not fully production-r…

≈