AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Microsoft Sentinel and Defender XDR give security teams a strong foundation for visibility, detection, and response.
Their integration across Microsoft 365, Entra ID, Azure, and Defender helps analysts connect activity and investigate threats across the Microsoft environment.
Set coverage priorities around business risk. A finance mailbox, a customer-facing application, and a production network need different evidence and response procedures. Identify the threats that matter to each, then assess whether the current controls can reveal and interrupt them.
Start with a few practical questions:
These questions connect security investment to the organization’s actual needs. They also help distinguish a missing product from a deployment problem or an operating procedure that has never been tested.
Record the expected outcome for each important scenario. For account takeover, that might be identifying the affected identity, establishing what the attacker accessed, removing persistent access, and restoring the account safely.
Microsoft Sentinel can support that work by bringing evidence and detections together. The wider program establishes the priorities, ownership, and response arrangements that make the technology useful.
Microsoft’s strength is the connection between its security products. A suspicious email, a compromised account, and activity on an endpoint can become part of the same investigation. Analysts can follow those relationships through the Defender portal and use Microsoft Sentinel to bring in evidence from the wider environment.
The main capabilities include:
Defender for Endpoint provides prevention, behavioral detections, investigation evidence, and response actions on supported, onboarded devices.
Entra ID Protection identifies supported identity risks, while Defender for Identity adds visibility into supported identity infrastructure, including Active Directory.
Defender for Office 365 protects supported messaging and collaboration workloads, with capabilities depending on the plan and configuration.
Defender for Cloud and Defender for Cloud Apps cover supported workloads and applications, including selected non-Microsoft environments.
Microsoft Sentinel collects additional evidence, runs analytics, supports hunting, and coordinates procedures through automation rules and playbooks.
Defender can interrupt supported attack scenarios when the required products, signals, and permissions are in place.
For organizations already using the Microsoft stack, this integration provides a substantial advantage. It reduces the work needed to connect evidence and gives analysts native investigation and response tools.
The assessment is whether those capabilities are operating across the systems that matter. Owning a license does not establish deployment coverage, and a connected source does not establish that the required events are available.
Map the environment against what the SOC can actually observe. Include cloud services, business applications, privileged access, external assets, and systems outside normal endpoint management. Record missing sources and ownership gaps so they become work to resolve.
An asset inventory provides a starting point, but it should be checked against live evidence. Acquisitions, remote sites, development environments, supplier-managed systems, and new SaaS applications can extend beyond the systems normally included in monitoring.
Check more than the presence of a connector. Confirm the event categories, source scope, permissions, delivery delay, and history available to investigators.
A recent event from one cloud account does not establish that every account is covered. A healthy endpoint console does not establish that every critical server is onboarded.
The result should be a clear record of what the SOC can see, what it cannot see, and why.
Test whether that visibility supports useful detections, complete investigations, and timely containment. Keep coverage under review as the environment changes.
For a finance mailbox takeover, the evidence might include the initial sign-in, authentication changes, application consent, mailbox access, and forwarding. The response might require restricting the account, revoking sessions, removing persistence, and checking other affected users.
Assess the complete path:
ATT&CK mappings help organize detection coverage, but the number of mapped rules does not establish protection. A rule can remain enabled while its source is incomplete or its assumptions no longer match the environment.
Use approved tests and representative investigations to check the result. Record coverage as validated, partial, unverified, or out of scope, with an owner and next action.
Identity coverage should follow the access people and applications actually hold.
Entra ID may be central to the environment, but independent directories, SaaS-native accounts, local administrators, service accounts, and application credentials can provide additional routes into business systems.
Microsoft Sentinel can collect evidence from supported external sources, and Microsoft provides response integrations for selected non-Microsoft scenarios. The work is establishing what each integration can detect and what an authorized operator can do with it.
Check the full investigation:
Successful access, failed attempts, MFA changes, recovery methods, and session activity.
New application credentials, consent grants, privileged assignments, and added authentication methods.
Reliable relationships between the person, directory identity, application account, and affected resources.
Actions that stop the relevant access in the affected provider.
Evidence that the action took effect and the attacker’s access ended.
A password reset does not remove an application secret. Revoking an identity-provider session does not guarantee that every downstream application immediately ends its own session.
Test these distinctions with controlled identities before relying on them during an incident. Identity threat detection and response should connect the evidence and actions across the systems the organization uses.
Entra ID Protection provides a useful leaked-credentials detection. Microsoft checks discovered credential material against the tenant’s current valid password hashes. Hybrid-account matching depends on password hash synchronization.
Broader exposure monitoring should also consider credentials for independent services, stolen session material, infostealer records, and leaked company information.
Connect each finding to a real access path:
An infostealer finding needs device investigation as well as credential remediation. Otherwise, the device may expose the replacement credentials.
Keep discovery time separate from compromise time. A record found today may describe an older theft, while an application grant or stolen session may provide continuing access.
A cloud connector can be working while important activity remains outside the investigation.
An organization may collect management events but omit data access. One production account may be connected while development accounts, acquired environments, or newly created regions remain unmonitored.
Microsoft Sentinel and the wider Defender stack support multi-cloud and SaaS environments. Validate coverage at the account, application, and event-category level.
For each important source, establish:
Use a representative event to test the path from the source audit interface to the Microsoft Sentinel record and the intended detection. Confirm the actor, target, action, outcome, and timestamps.
Normalization helps analytics work across products. It still needs validation because similar field names can describe different behavior.
New applications and cloud accounts should enter the security onboarding process as they are introduced. Waiting for an incident to reveal missing collection leaves the SOC trying to reconstruct activity it never recorded.
Cost and tier decisions are covered in Microsoft Sentinel Cost Optimization. The coverage requirement is that the chosen design supports the detection and investigation the organization needs.
Internal monitoring usually begins with known systems. Attackers can also find forgotten services, abandoned websites, exposed administration interfaces, and infrastructure operated by third parties.
Defender External Attack Surface Management discovers internet-facing infrastructure through relationships to known assets. It provides a useful external view, including assets missing from internal inventories.
Discovery should lead to ownership and remediation. For each important finding, establish:
A forgotten remote-access portal becomes more significant when its credentials appear in a leak. An exposed server becomes more urgent when observed activity suggests exploitation.
Use attack surface management to connect these observations to investigations and remediation.
For service providers, Defender EASM has an access restriction to plan around. Microsoft documents that it does not support cross-tenant resource access through Azure Lighthouse.
An attacker-controlled domain may exist solely to imitate the organization, with no legitimate connection to its infrastructure.
Dedicated monitoring should look for:
For example, a fake login page at acmecorp-support.com may target customers of acmecorp.com without appearing in the company’s own web logs.
acmecorp-support.com
acmecorp.com
Email telemetry can reveal impersonation once a message reaches a monitored mailbox. External monitoring can identify infrastructure and abuse outside that observed traffic.
Confirmed findings need a response process: preserve evidence, block relevant access paths, notify affected parties where appropriate, and coordinate removal. Continue checking after a takedown request to establish whether the threat is still active.
Lookalike domain monitoring is part of that wider process. See What Is Digital Brand Protection? for the broader scope.
Microsoft’s threat intelligence can support these investigations, but access to intelligence does not establish a complete brand-monitoring and takedown service.
Exposure information should influence what the SOC investigates and what the wider security team fixes first.
An unexpected connection from an internet-facing server with an actively exploited vulnerability deserves different attention from similar activity on a controlled test system.
Microsoft provides vulnerability and exposure-management capabilities. Check which assets they assess, whether findings are current, and how that information reaches investigators.
Useful case context includes:
Include appliances and other systems that do not run an endpoint agent. These may require external assessment, configuration evidence, or another collection method.
For prioritizing vulnerabilities, combine exploitation evidence with reachability and business impact. A large CVE count alone is a weak basis for incident priority.
Keep the timing clear. A system patched today may have been vulnerable when suspicious access occurred. Historical investigations need evidence of its state at the relevant time.
AI introduces two related coverage questions: what employees share with AI services, and what AI agents are authorized to access.
Microsoft provides capabilities across Defender for Cloud Apps, Purview Data Security Posture Management, and Entra Agent ID. Supported deployments can help discover AI applications, investigate sensitive-data interactions, and govern integrated agent identities.
The practical limits depend on the user’s actual path.
A managed browser with the required extension and policies may provide evidence that a network connection cannot. An unmanaged device or an application using an API may follow a different route. An internal agent with mailbox permissions needs an identity and access review even if it never visits a public AI website.
Assess visibility at each level:
Keep these distinctions in investigations. A connection record does not prove confidential data was uploaded, and an agent inventory does not automatically cover every script or browser extension.
For important apps and agents, record the owner, business purpose, users, sanctioned status, available audit evidence, and permissions. Bring suspicious access and data-handling findings into the security operating process.
Threat hunting extends coverage to activity that existing detections have not raised.
Microsoft provides substantial hunting tools, including KQL, hunts, advanced hunting, and AI assistance. Their value depends on the questions being asked, the evidence available, and whether someone owns the result.
Use a repeatable threat hunting methodology to define the behavior, affected systems, time window, expected evidence, and legitimate explanations.
A useful hunting program includes:
Search for persistence, account abuse, lateral movement, and unusual data access.
Check whether a new campaign or technique is relevant to the environment.
Use retrospective threat hunting when new information changes the interpretation of earlier activity.
Turn validated findings into reviewed rules and investigation procedures.
Record hunts that find nothing as well as those that raise incidents. State what was searched, what was found, and what remained unavailable. No matches in an incomplete source is an inconclusive result.
Historical reach depends on the evidence retained and accessible through the data lake. Confirm the period that can actually be searched before reporting it as covered.
Keep custom detections under active maintenance. Parser changes, connector changes, exclusions, and table-tier changes can weaken a rule without removing it from the deployment.
AI can expand investigative capacity, but supported scenarios and execution controls need separate assessment. See Agentic SOC on Microsoft Sentinel.
Coverage includes the ability to act when the threat appears.
A high-severity alert at 2 a.m. needs a defined investigation owner, an available decision-maker, and working access to the affected systems. These arrangements should be part of the service design.
For every important response path, document:
Test actual actions on controlled accounts and devices. Permission to open an incident is different from permission to isolate a host, remove an inbox rule, or restrict an application.
Also define responsibility for operational faults. A security service needs someone to repair failed collection and broken automation, not only someone to review the incidents that still arrive.
Microsoft Defender Experts MDR is sold separately from the underlying security products.
Plan 2 currently requires Microsoft Sentinel and at least 1,500 licensed seats. Customers retain responsibilities including connector maintenance, their own detection content, data quality, permissions, retention, and ingestion costs.
Neither plan is a separate incident response engagement.
For any service arrangement, assign the remaining work explicitly. Someone needs to maintain local rules, execute third-party response guidance, and provide forensic support when required.
A serious incident may require forensic collection, investigation across unmonitored systems, recovery coordination, and sustained work outside the normal queue.
Establish how those capabilities will be available before they are needed.
The preparation should cover:
Which records and artifacts must be retained before they rotate or disappear?
Can responders retrieve evidence if normal administrator identities are compromised?
How will appliances, unmanaged devices, and specialist systems be examined?
Can relevant records be recovered from the data lake in time to support the investigation?
Who provides specialist assistance, under what authority, and through which escalation path?
Preserve underlying records, identifiers, timestamps, and collection details. A case summary helps explain the incident, while the original evidence allows investigators to validate it.
Exercise an identity compromise and an endpoint or ransomware scenario. Follow the work through containment, evidence collection, handover, recovery decisions, and reporting. Use the findings to improve both the technology and the operating procedures.
Network visibility becomes a priority when the coverage assessment identifies important activity that existing sources cannot observe.
Microsoft Sentinel can analyze network evidence, but it is not itself a packet sensor. Network detection and response depends on deployed collection points and the traffic they can see.
Microsoft already provides relevant capabilities. Defender for Endpoint records network activity on supported endpoints, Network Protection can block supported malicious destinations, and device discovery helps identify unmanaged systems. Defender for IoT adds monitoring options for OT and enterprise IoT environments.
Assess what remains outside those observation points.
An appliance communicating with a server, two unmanaged devices exchanging traffic, or lateral movement inside an unmonitored segment may leave little useful endpoint evidence. A firewall may also miss traffic that stays within the same network segment.
NDR is useful when it fills a defined visibility gap and brings the resulting evidence into the same investigation as identity and endpoint activity.
Validate sensor placement before relying on it. Check mirrored interfaces, both traffic directions, remote sites, dropped packets, and traffic that bypasses the monitored links.
Encryption also affects what can be established. Network metadata can support an investigation without exposing the full content of an encrypted session.
For deployment considerations, see What Is Network Detection and Response? and network detection and response. Decisions about retaining or filtering verbose records belong in Microsoft Sentinel Cost Optimization.
Deception adds monitored resources that have no legitimate production purpose. Interaction with a decoy account, planted credential, or believable file share can reveal an attacker searching for access.
The useful result is evidence about the source system, account, and subsequent activity.
The earlier Defender for Endpoint deception preview was retired in 2025. Organizations that used it should verify what remains deployed before counting it as an active control.
A maintained deception deployment can include:
On realistic discovery paths, without useful production access.
That resemble valuable resources and record browsing or access.
In relevant management or server segments.
Monitored for enumeration, authentication attempts, or unexpected use.
Placement and interpretation matter. Routine scanners, backup systems, and authorized testing can touch decoys. Distinguish those interactions from unexplained credential use or interactive access.
Send findings into Microsoft Sentinel with the source identity, timestamp, affected decoy, and response owner. Connect the evidence to surrounding activity for lateral movement detection.
Review the deployment after network and directory changes. The hacker deception capability should remain believable, isolated, and operational.
Operational technology and enterprise IoT introduce assets that may not support conventional endpoint monitoring. They also bring different response constraints.
Defender for IoT provides dedicated OT sensor capabilities. Enterprise IoT features extend visibility into supported corporate devices such as cameras, printers, and conferencing systems. Verify the deployment and management path because the Defender portal has documented preview capabilities and feature differences.
The assessment should include:
Which networks and communication paths are actually observed?
Are supplier connections, jump hosts, and engineering workstations monitored?
Who owns building management, access control, cameras, and similar devices?
Who can decide whether a connection or system can be interrupted?
Passive monitoring is often important in sensitive environments. Review discovery settings because standard Defender for Endpoint device discovery can include active probing, which may not be approved on every network.
Validate monitoring with operations staff using agreed traffic observations and controlled exercises. Detection should identify the system and activity involved. The response procedure should explain who can act without compromising plant safety or availability.
Where existing collection leaves important paths unobserved, extend network detection and response to those locations.
Turn the assessment into a plan with an owner, affected scope, and validation requirement for each improvement.
Prioritize weaknesses that prevent the SOC from investigating a credible threat or containing a critical system.
Close a finding when the required capability works and has been validated. Keep accepted limitations visible.
Repeat the assessment after significant changes to infrastructure, licenses, integrations, or service responsibilities. Reporting progress by attack scenario and business service gives leadership a clearer view of protection than a growing list of connected products.
ThreatDefence extends Microsoft Sentinel and Defender through one platform and license, adding NDR, deception, attack surface management, brand and lookalike-domain monitoring, dark web monitoring, AI usage visibility, identity threat detection across providers, and DFIR. Findings join the same cases as Microsoft incidents.
ThreatDefence is a Microsoft Solutions Partner for Security. Its 24x7 SOC investigates and responds within approved authority, including session revocation and host isolation through Defender and Entra. Scheduled hunting, a monthly hunting report, and an incident response retainer are included in the standard service. Data and AI processing stay in region, in Australia or the United States.
Microsoft Sentinel data costs typically fall 50 to 70% through the service’s data management. A free Microsoft Sentinel cost and coverage review maps the current deployment, identifies coverage gaps, and shows where to start.
Add network sensors for connection history, protocol records, and detections that firewall logs alone cannot show.
Discover internet-facing domains, hosts, and services, and bring exposure findings into the same investigations.
Track lookalike domains and cloned login pages targeting your users and customers.
Match leaked credentials to enabled accounts so exposed users can be reset before they are used.
See which AI services are reached from your network and compare activity with your approved list.
Combine exposure, vulnerabilities, and control gaps into one view of what to fix first.
Explore Microsoft Sentinel MDR
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
Map important attack scenarios to the systems, evidence, detections, and actions needed to investigate and contain them. Verify deployment and source health, test representative behavior, and record partial or unverified coverage with an owner and next action.
Microsoft Sentinel provides SIEM, analytics, hunting, and automation capabilities. Its effective coverage depends on connected sources, deployed sensors, detection content, accessible history, and response operations. Defender XDR and other Microsoft products add capabilities with their own scope and prerequisites.
Its OT sensors and enterprise IoT capabilities address different environments. Enterprise IoT can improve visibility into corporate devices such as printers and cameras. Verify the actual traffic and assets observed before treating either deployment as complete IT network coverage.
The earlier Defender for Endpoint deception public preview was retired in 2025. Verify that a current, maintained deception deployment is operating before counting decoys or credential lures as part of your coverage.
No. Microsoft documents that Defender EASM requires authentication to the tenant holding the resource and does not support Azure Lighthouse cross-tenant resource access.
Defender EASM discovers infrastructure associated with the organization’s attack surface. Comprehensive monitoring of attacker-registered lookalikes, cloned sites, and brand impersonation should be assessed separately.
Microsoft integrated the intelligence experience into the Defender portal and retired the legacy standalone portal on August 1, 2026. Check current permissions and feature availability in the Defender experience.
Microsoft uses external breach sources to detect confirmed exposure of current matching credentials. This provides useful credential protection, but it does not establish complete coverage of stolen sessions, non-Entra accounts, or leaked company information.
Its published scope provides response guidance for supported third-party products. Assign someone to execute that guidance. Separately configured Microsoft platform automation may support particular external response actions.
Microsoft distinguishes Defender Experts MDR from a separate incident response engagement. Confirm the arrangements for forensic investigation and recovery support before an incident.
Yes. Supported connectors and appropriate analytics can identify activity from other identity providers and SaaS applications. Validate the required events, identity mapping, and response actions in each provider.
What Is Network Detection and Response?
Lookalike Domain Monitoring
Lateral Movement Detection