Microsoft Integrates SIEM into Defender, Enhances Security Operations for Enterprises

Microsoft has rolled out an enticing update for its Microsoft 365 E5 and E7 customers by integrating security information and event management (SIEM) directly into Microsoft Defender, at no additional licensing cost. This enhancement, part of the Integrated Security Operations Center (ISOC), combines SIEM with existing features such as extended detection and response (XDR), threat intelligence, and automation tools, all accessible from a single portal.

Rob Lefferts, corporate vice president of Microsoft Threat Protection, articulated the need for such integration, emphasizing that separate security systems can't compete with attackers utilizing AI for automated attacks. "Security cannot operate at AI speed when protection and operations are built as separate systems," he stated in a blog post introducing the ISOC.

Historically, while the E5 and E7 plans provided access to Defender XDR, SIEM capabilities had to be acquired separately through Microsoft Sentinel. This shift means that logs from Microsoft’s security offerings won’t incur ingestion charges, enhancing cost-effectiveness. Starting October 1, data from third-party security tools will cost $2.40 per GB, charged on a pay-as-you-go model.

Opened to public preview on September 23, ISOC is designed for organizations with a Microsoft Defender Suite and a Microsoft 365 E5 or E7 license, and it comes without a minimum seat requirement, although it's not yet fully production-ready.

For organizations already using Microsoft products, adopting ISOC appears advantageous. Yih Khai Wong, a senior research manager at IDC Asia/Pacific, explained that much of the relevant telemetry already resides in systems like Defender, Entra, and Microsoft 365. Therefore, this bundling effectively makes data ingestion free, as no additional licenses are needed to re-analyze data that the organization already holds.

A benefit, not a product

Microsoft clarified that ISOC isn't a standalone product but rather an enhancement to existing offerings. Capabilities like workbooks and natural-language-to-SOAR automation, which previously required a separate Sentinel purchase, are now integrated into Microsoft Defender.

Since its launch on September 23, Microsoft has rolled out features including case management, workbooks, and natural-language playbook generation to eligible customers, requiring no extra configuration. Initially, the data offered will cover Defender for Endpoint, Office 365, Identity, Cloud Apps, and relevant Azure and Office 365 activity logs. Data retention will start at 30 days during the preview period, increasing to 90 days on November 15.

Cost considerations

However, for functions beyond the core offerings, companies will need an ISOC workspace, which in turn requires an Azure subscription. This workspace expands access to over 500 data connectors along with user and entity behavior analytics (UEBA), continuous integration/continuous deployment (CI/CD) repositories, and extensive threat intelligence.

Wong pointed out that organizations with a mixed vendor environment need to conduct a nuanced cost analysis. For businesses with significant non-Microsoft data sources, careful comparison against current SIEM costs is essential. Current ISOC trials do not apply to organizations already utilizing a Sentinel workspace, and Microsoft has assured that nothing will change for existing Sentinel customers. Those interested may transition to ISOC starting November 15.

Consolidating various security, identity, and productivity operations under one vendor could simplify investigations, but it also heightens reliance on that specific vendor’s roadmap and security capabilities. Chief Information Security Officers not utilizing a unified SIEM must weigh the effort of migrating against training, contractual intricacies, and exit costs.

Sanchit Vir Gogia, chief analyst at Greyhound Research, recommended that enterprises aiming to switch to ISOC should ensure they can replicate their highest-value cross-vendor detections before moving away from an established SIEM. He cautions that while Microsoft claims to support over 500 connectors, this breadth doesn't guarantee equivalent functionality across all data sources.

Advancing agent strategies

The ISOC initiative is positioned as the core for the agent-based strategy introduced alongside Project Perception in July. Gogia raised questions regarding the necessity of a single vendor for an agent-oriented Security Operations Center (SOC), noting that while Microsoft has created helpful integration paths, it hasn't conclusively proven that a singular provider is essential.

Moreover, details regarding how agent actions within ISOC are tracked, audited, or reversed are still lacking. Gogia emphasized that significant risks emerge when agents are empowered to make impactful changes. These changes could involve adjustments to identity, endpoint, or cloud policies, which can have far-reaching consequences. He advocates for strong safeguards, including distinct agent identities and independent approvals for critical alterations.

The addition of agents could potentially increase the attack surface. Wong highlighted that adversaries may exploit the telemetry that an agent relies upon, disrupt contextual data, or apply prompt injection techniques to influence agent decision-making. Ultimately, Microsoft must prove that while it has simplified the integration process, it hasn't compromised customers' ability to challenge and reverse actions within the system.

Microsoft has yet to respond to inquiries for further comment.