Microsoft integrates SOC capabilities with Defender for enterprises
Microsoft is previewing Defender ISOC, bundling SIEM into Microsoft 365 E5 and E7 without an extra license.
Microsoft opened a public preview of the Integrated Security Operations Center in Microsoft Defender on September 23, letting Microsoft 365 E5 and E7 customers use SIEM capabilities without a separate Sentinel license. Logs from Microsoft security products, Entra ID Protection, and Azure and Office 365 activity are included without ingestion charges, while third-party data costs $2.40 per GB from October 1. Retention is 30 days during preview and rises to 90 days on November 15; organizations already running Sentinel are excluded until they can opt to move on that date. Analysts said the bundle can simplify Microsoft-centric operations but increases vendor dependency, and warned that future SOC agents could be targeted through telemetry manipulation or prompt injection.
- Public preview opened September 23 for eligible Defender Suite E5 or E7 customers.
- Microsoft first-party logs are included; third-party data costs $2.40 per GB.
- Preview retention is 30 days, rising to 90 days on November 15.
- Existing Sentinel customers stay excluded until an optional November 15 move.
- Analysts warn of lock-in and prompt-injection risk for future SOC agents.
- Vendors
- Microsoft
- Organizations
- MicrosoftIDCGreyhound Research
From the original article
3 min read at csoonline.com
Microsoft 365 E5 and E7 customers can now run security information and event management (SIEM) inside Microsoft Defender at no extra license cost. Microsoft is delivering the capability through the Integrated Security Operations Center (ISOC) in Microsoft Defender, which combines SIEM with Defender’s existing XDR, threat intelligence, automation and AI tools in a single portal.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.