SOC Defender Digest

SIEM vs Security Data Lake

• A SIEM is for detection and alerting while a security data lake stores large volumes of security data long-term at a...

New APIs enable programmatic threat hunts, investigations, business context, and remediation – wiring into SOAR playbooks without vendor delays.

-...

Microsoft Defender helps assess Secure Boot status—essential hardening against bypasses, as MSFT LNK bug exploitation ramps up in tenant environments.

Key distinctions for cost-effective SOC ops:

• SIEM excels at detection/alerting, not storage—multitool use spikes costs, cuts retention, creates...

Hands-on SC-300 labs for SOC analysts integrating Microsoft Sentinel with Entra ID:

• Lab 27 (BYOS): Create Sentinel workspace, connect Entra ID...

Sentinel UEBA for AWS CloudTrail

• 🔥 Behavior Analytics Without KQL Baselines: Microsoft Sentinel UEBA enriches AWS CloudTrail data with binary...

Two new Inspira agents now GA on Microsoft Security Store enhance Security Copilot for Sentinel and Defender XDR:

• MITRE ATT&CK Coverage Insight...

Microsoft Sentinel UEBA simplifies AWS defense by enriching raw CloudTrail logs with behavioral signals, distinguishing benign activity from...

Streamline workflows with these key steps:

• Install connectors from Content hub and enable Create incidents toggle in data connectors to auto-convert...

Copilot & KQL Hands-on Guidance

• 🔥 Purview Architecture for Safe Copilot: Article provides technical walkthrough of Microsoft Purview's unified...

Stalling on Copilot rollout due to data security? Purview delivers unified Data Security Posture Management across SharePoint, Teams, and...

Key tools for Sentinel SOC workflows:

• Kustainer UI: Open-source GUI for local Kusto Emulator—multi-source imports, graph viz, offline exports,...

New TTPs for SOC hunting in Microsoft Teams phishing:

• Spam flood emails, followed by cross-tenant Teams messages posing as IT to 'fix' spam.
  -...

• PhantomRPC flaw enables low-priv attackers with SeImpersonatePrivilege to impersonate high-priv processes via rogue RPC servers on unavailable...

Essential guide to Microsoft 365 feature deprecations and transformations in features/products – SOC teams, assess impacts on Defender suite telemetry, Sentinel ingestion, and tenant hardening now.

Unpatched CVE-2026-33825 (RedSun) turns Defender's cloud file rollback into an LPE vector, granting NT AUTHORITY\SYSTEM from standard user on...

Defender XDR Previews

• 🔥 NRT for Custom Rules: Custom detection rules in Microsoft Defender now support Near Real-Time (NRT) configuration on...

• Teams phishing delivers SNOW malware, AutoHotKey, rogue extensions
• Uses cloud services for data theft and lateral movement
• Real-world case for hunting these TTPs in Defender XDR or Sentinel Teams logs

• New Preview Feature: Custom detection rules in Microsoft Defender support Near Real-Time (NRT) configuration on Microsoft Sentinel data
• SOC...

Security teams extend Microsoft Sentinel with behavioral analytics, risk scoring, and guided investigations from New-Scale Analytics for better SOC operations.