One of the challenges we’ve faced so far in using Defender data in our solution SecuRadar has been the additional costs. If we wanted to use this data for correlation with other security sources, automation, advanced analytics, or security agent operations, we had to transfer and store Defender logs in Sentinel, which entailed additional operational costs. Furthermore, the amount of these costs depended on the volume of data processed, so it wasn’t always easy to accurately estimate the costs in advance.
A few days ago, Microsoft introduced a new feature in Microsoft Defender— Integrated Security Operations Center (ISOC). With this move, Microsoft is continuing to deepen the integration of Defender XDR and Microsoft Sentinel technologies and to simplify the entire security operations stack.
ISOC enables customers to use the data they already have in Microsoft Defender directly for security monitoring, incident investigation, and automation. For eligible customers, Microsoft is offering 30 days of Defender data retention for free as part of the preview, along with the ability to easily combine and correlate this data with other security logs.
