Microsoft has made significant strides in enhancing its security offerings for Microsoft 365 E5 and E7 customers by integrating Security Information and Event Management (SIEM) functionality directly into Microsoft Defender, eliminating extra licensing fees.
The new feature, known as the Integrated Security Operations Center (ISOC), merges SIEM capabilities with existing tools like Extended Detection and Response (XDR), threat intelligence, and automation, all accessible from a unified portal. Rob Lefferts, Microsoft’s corporate vice president for Threat Protection, emphasized that separating protection and operations hampers defenders' ability to counter AI-driven attacks effectively. He stated that current adversaries leverage AI to orchestrate widespread attacks, and the delays caused by using disparate tools can leave organizations vulnerable.
Previously, while E5 and E7 subscriptions included Microsoft Defender XDR, customers had to purchase SIEM separately through Microsoft Sentinel. The ISOC launch, made public on September 23, 2023, allows users to access logs from Microsoft’s security products without incurring ingestion fees. However, data ingested from third-party tools will incur a cost of $2.40 per GB after October 1, 2023, on a pay-as-you-go basis.
This development is particularly appealing for organizations that primarily use Microsoft products, according to Yih Khai Wong from IDC Asia/Pacific. Most telemetry already exists within the Microsoft ecosystem, making it cost-effective for businesses to integrate Sentinel’s SIEM into E5 and E7 subscriptions since they don’t have to deal with separate licenses.
A Constructive Addition
Microsoft clarifies that ISOC is not an entirely new product but a beneficial addition to its security suite. The ISOC page indicates that features like workbooks and natural-language playbook automation were previously contingent on separate Sentinel purchases. The roll-out of case management and workbooks began on September 23, requiring no extra configuration from users.
The ISOC capabilities encompass logs from Defender for Endpoint, Office 365, Identity, Cloud Apps, and Azure, along with Microsoft Entra ID Protection logs. The initial data retention period is set at 30 days but will extend to 90 days beginning November 15, 2023.
Cost Implications Beyond Basics
For users who need more than the basic ISOC offerings, additional analysis requires an ISOC workspace, which necessitates an Azure subscription. This workspace provides access to over 500 data connectors, user and entity behavior analytics (UEBA), continuous integration/continuous deployment (CI/CD) repositories, and additional threat intelligence.
Organizations working in mixed environments might have to assess the total cost of ownership versus their current SIEM expenditures, particularly if they rely on non-Microsoft products. The current public preview is not available for those with an active Sentinel workspace, but Microsoft intends to make the transition viable starting November 15, 2023.
Consolidating security operations under a single vendor can streamline processes but could heighten dependency on that vendor’s pricing models and update cycles. CISOs currently using separate SIEMs should conduct a thorough evaluation of migration costs, potential re-training needs, and the complexity of contractual obligations before making any decisions.
Sanchit Vir Gogia from Greyhound Research suggests that organizations need to preserve their highest-value detection capabilities across vendors before adopting ISOC, signaling potential limitations in connectivity quality despite Microsoft’s claim of over 500 integration points.
Next Steps for Agent Strategy
Lefferts suggests that ISOC will serve as a cornerstone for the agent strategy introduced with Project Perception earlier this year. However, Gogia questions the necessity of a single vendor for successful SOC operations, noting that while Microsoft has provided a pathway for integration, it hasn't definitively shown that consolidating under one umbrella is essential.
Details on how actions taken by agents in ISOC will be managed, including logging and auditing processes, remain scarce. Gogia highlights the importance of caution, recommending that organizations establish distinct agent identities and restrict their permissions to mitigate potential risks associated with agents altering critical security settings.
Wong points out that while Microsoft’s integration may simplify operations, it also expands the attack surface, raising the stakes in terms of data security. Threat actors could manipulate the information upon which agents depend or weaponize integration features to influence decision-making.
In essence, Microsoft is facilitating easier product adoption, but the real test for users will be their ability to maintain control and oversight within their security frameworks, ensuring that they can challenge and potentially reverse any automated decisions made by these integrated solutions. Microsoft has yet to provide a response to inquiries about these developments.
