Microsoft integrates SOC capabilities with Defender for enterprises
Microsoft 365 E5 and E7 customers can now run security information and event management (SIEM) inside Microsoft Defender at no extra license cost. Microsoft is delivering the capability through the Integrated Security Operations Center (ISOC) in Microsoft Defender, which combines SIEM with Defender’s existing XDR, threat intelligence, automation and AI tools in a single portal. “Security cannot…
Microsoft is rolling out a new Integrated Security Operations Center (ISOC) within Defender for Enterprise customers, bundling SIEM functionality with XDR, threat intelligence, automation and AI tools. This integration aims to eliminate the need for separate SIEM tools, as attackers increasingly leverage AI agents to automate large-scale attacks.
While the preview phase is not production-ready, it offers free ingestion of logs from Microsoft's own security products for organizations with a Microsoft Defender Suite and Microsoft 365 E5 or E7 license. Third-party security tools and other outside sources data is charged at $2.40 per GB on a pay-as-you-go basis. ISOC is not a standalone product, but it includes features such as workbooks and natural-language-to-SOAR automation that previously required a separate Microsoft Sentinel purchase.
However, the preview excludes organizations with an active Sentinel workspace, and Microsoft has not specified when the preview phase will end.
Written by urgent.news from Computerworld's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
