Important
The improved Microsoft 365 Defender portal is now available. This new experience brings Defender for Endpoint, Defender for Office 365, Microsoft 365 Defender, and more into the Microsoft 365 Defender portal. Learn what’s new.
Applies to:
- Microsoft 365 Defender
A modern Security Operations Center (SOC) is an intelligence-driven, adaptive organization that embraces threat defense strategy of moving security processes earlier in the deployment process so that security is built in. This means that the traditional assignment of isolated technologies and processes to single security analysts no longer supports the vast increase in data coming in from multiple sources. Security analysts and engineers are being asked to take a more holistic approach and to use shared insights across different platforms and disciplines to take effective action.
For this reason, the deployment and implementation of the Microsoft 365 Defender platform will need careful planning with the SOC team to optimize the day-to-day operations and lifecycle management of the Microsoft 365 Defender service itself. This content explores several concepts on how to operationalize and integrate Microsoft 365 Defender with either new or existing people, processes, and technologies that form the basis for modern security operations.
If you are not already familiar with Microsoft 365 Defender, see these articles:
If your organization has already implemented some aspects of Microsoft 365 Defender, these articles can either affirm or help improve your existing architecture and processes.
Note
As a Microsoft partner, Protiviti contributed to and provided material feedback to this article.
Target audience
This content is designed for the following:
- DevOps and Security Operations (SecOps) teams
- Security engineering teams
- IT teams
- CISOs and CTOs
- Red, Blue, and Purple Teams
- CSIRT & forensic teams
- Microsoft 365 administrators