IntegratedSOC
Menu

Investigations

Follow one investigation across the portfolio

A fictional case: analyst Alex traces Maya’s phishing email across the wheel.

Drawn on Microsoft 365 E5

A suspicious invoice reaches Maya in finance. Alex, a security analyst, follows the lead through email, identity, devices, cloud apps, data security and Sentinel. Each part shows what one product adds to the case and what has to be in place first.

Each part has a 4-step demo: play it (about 16 to 18 seconds of animation, not the time the real work takes) or step through it. With reduced motion on, a demo moves only when you choose the next step.

The FinanceDocs incident is a fictional scenario. The people, device and files are invented, and what an analyst can see in a real tenant depends on licenses, deployment and permissions.

The 12 products this investigation passes through, in their places on the wheel. Open the wheel
Reading the diagrams
  • Person
  • Resource
  • Signal or evidence
  • Product or service
  • Action
  • The step being shown
  • Native evidence
  • Other connection
  • Configured ingestion
  • Permitted action
12 partsContents
  1. Message
    1. 01EmailDefender for Office 365
  2. Person
    1. 02ITDRDefender for Identity
    2. 03IAMEntra ID
  3. Device
    1. 04EndpointDefender for Endpoint
    2. 05MDMIntune
  4. App
    1. 06CASBDefender for Cloud Apps
  5. Data
    1. 07Data securityInformation protection
  6. Connect and widen
    1. 08Hunting
    2. 09SIEMSentinel
    3. 10SOC AISecurity Copilot
  7. Record and preserve
    1. 11Audit logAudit
    2. 12Legal holdeDiscovery

Message

Part 1 of 12 · EmailDefender for Office 365

Follow the invoice message

Email evidence connects the suspicious invoice to Maya.

Lit: ISOC, Email, Mailboxes, Inbox, Meetings, Intranet, Files, Docs, Sheets, Slides, Hunting.Lit: Defender for Office 365 into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Exchange, Outlook, Teams, SharePoint, OneDrive, Word, Excel and PowerPoint. Incidents and hunting come with Defender XDR.Lit: Mailboxes, Inbox.Context only, with no route into ISOC here: Exchange and Outlook.Lit: Email, Meetings, Intranet, Files, Docs, Sheets, Slides, Mailboxes, Inbox.Lit: Defender for Office 365. Context only, with no route into ISOC here: Exchange, Outlook, Teams, SharePoint, OneDrive, Word, Excel and PowerPoint.Lit: Email, Mailboxes, Inbox, Meetings, Intranet, Files, Docs, Sheets, Slides.Lit: Defender for Office 365 into ISOC. Context only, with no route into ISOC here: Exchange, Outlook, Teams, SharePoint, OneDrive, Word, Excel and PowerPoint.Lit: ISOC, Hunting, Email, Mailboxes, Inbox, Meetings, Intranet, Files, Docs, Sheets, Slides.Lit: Defender for Office 365 into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Exchange, Outlook, Teams, SharePoint, OneDrive, Word, Excel and PowerPoint. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Message

The invoice is the investigation’s starting point.The invoice is the investigation’s starting point.

Protect

Email protection checks the invoice email.Configured Office 365 protection checks covered email and collaboration.

Investigate

Advanced investigation follows the email evidence.P2 supplies its advanced investigation and XDR integration.

Connect

Alex reviews the email evidence.Alex reviews the evidence his roles permit.

4 stepsReady

  1. The invoice is the investigation’s starting point.The invoice is the investigation’s starting point.

  2. Email protection checks the invoice email.Configured Office 365 protection checks covered email and collaboration.

  3. Advanced investigation follows the email evidence.P2 supplies its advanced investigation and XDR integration.

  4. Alex reviews the email evidence.Alex reviews the evidence his roles permit.

The steps as a diagram

Message. The invoice is the investigation’s starting point.The invoice is the investigation’s starting point.

Protect. Email protection checks the invoice email.Configured Office 365 protection checks covered email and collaboration.

Investigate. Advanced investigation follows the email evidence.P2 supplies its advanced investigation and XDR integration.

Native evidence

Connect. Alex reviews the email evidence.Alex reviews the evidence his roles permit.

What to rememberWhat to remember, what it takes, sources
What to remember
The invoice email becomes evidence Alex can review.Plan 2 adds the investigation and XDR integration this story uses.
What it takes
Includes advanced email and collaboration protection, investigation and response capabilities. Configure policies and protect licensed users.
Status and sources
License rights; deployment remains separate
Open EmailDefender for Office 365 on the wheel Next: ITDRDefender for Identity

Person

Parts 2 and 3 · ITDR and IAMDefender for Identity and Entra ID

Part 2 of 12 · ITDRDefender for Identity

Follow an identity lead

Alex checks identity evidence associated with the invoice investigation.

Lit: ISOC, ITDR, IAM, Hunting.Lit: Defender for Identity into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Entra ID. Incidents and hunting come with Defender XDR.Lit: IAM.Context only, with no route into ISOC here: Entra ID.Lit: ITDR, IAM.Lit: Defender for Identity. Context only, with no route into ISOC here: Entra ID.Lit: ITDR, IAM.Lit: Defender for Identity into ISOC. Context only, with no route into ISOC here: Entra ID.Lit: ISOC, Hunting, ITDR, IAM.Lit: Defender for Identity into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Entra ID. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Lead

A fictional identity event becomes an investigation lead.A fictional identity event becomes an investigation lead.

Collect

A sensor collects the identity activity.Supported systems need configured sensors or connectors.

Detect

Defender for Identity analyzes the identity activity.Defender for Identity analyzes covered identity activity.

Review

Alex checks the identity evidence.Alex checks the evidence within his permitted scope.

4 stepsReady

  1. A fictional identity event becomes an investigation lead.A fictional identity event becomes an investigation lead.

  2. A sensor collects the identity activity.Supported systems need configured sensors or connectors.

  3. Defender for Identity analyzes the identity activity.Defender for Identity analyzes covered identity activity.

  4. Alex checks the identity evidence.Alex checks the evidence within his permitted scope.

The steps as a diagram

Lead. A fictional identity event becomes an investigation lead.A fictional identity event becomes an investigation lead.

Collect. A sensor collects the identity activity.Supported systems need configured sensors or connectors.

Detect. Defender for Identity analyzes the identity activity.Defender for Identity analyzes covered identity activity.

Native evidence

Review. Alex checks the identity evidence.Alex checks the evidence within his permitted scope.

What to rememberWhat to remember, what it takes, sources
What to remember
Activity on Maya’s account gives Alex evidence to check.Identity protection depends on deployed sensors and supported systems.
What it takes
Configure supported sensors or connectors and permissions. Verify source-specific infrastructure and availability. Entra ID P1/P2 remain separate components.
Status and sources
License rights; deployment remains separate
Open ITDRDefender for Identity on the wheel Next: IAMEntra ID

Part 3 of 12 · IAMEntra ID

Check Maya’s access

A configured access policy evaluates Maya’s sign-in.

Lit: ISOC, IAM.Lit: Entra ID into ISOC.Lit: IAM.Context only, with no route into ISOC here: Entra ID.Lit: IAM.Context only, with no route into ISOC here: Entra ID.Lit: IAM.Lit: Entra ID into ISOC.Lit: ISOC, IAM.Lit: Entra ID into ISOC.

Every part this story uses

Play the story, or choose a step.

Request

Maya requests access to a work app.Maya requests access to a work app.

Context

The request supplies sign-in context.The request supplies sign-in context.

Evaluate

An Entra policy checks sign-in risk, which also reaches ISOC.Configured policies evaluate their supported conditions, including sign-in risk.

Decide

The policy decides whether Maya gets access.Policy configuration determines the permitted access outcome.

4 stepsReady

  1. Maya requests access to a work app.Maya requests access to a work app.

  2. The request supplies sign-in context.The request supplies sign-in context.

  3. An Entra policy checks sign-in risk, which also reaches ISOC.Configured policies evaluate their supported conditions, including sign-in risk.

  4. The policy decides whether Maya gets access.Policy configuration determines the permitted access outcome.

The steps as a diagram

Request. Maya requests access to a work app.Maya requests access to a work app.

Context. The request supplies sign-in context.The request supplies sign-in context.

Evaluate. An Entra policy checks sign-in risk, which also reaches ISOC.Configured policies evaluate their supported conditions, including sign-in risk.

Decide. The policy decides whether Maya gets access.Policy configuration determines the permitted access outcome.

Permitted action

What to rememberWhat to remember, what it takes, sources
What to remember
A policy decides whether Maya’s sign-in gets access.Conditional Access requires P1; risk capabilities require P2.
What it takes
Includes P2 identity risk capabilities alongside P1. Configure Conditional Access, identity protection policies and roles.
Status and sources
License rights; deployment remains separate
Open IAMEntra ID on the wheel Next: EndpointDefender for Endpoint

Device

Parts 4 and 5 · Endpoint and MDMDefender for Endpoint and Intune

Part 4 of 12 · EndpointDefender for Endpoint

Trace Atlas-04

Alex inspects suspicious activity on Maya’s onboarded laptop.

Lit: ISOC, Endpoint, OS, Hunting.Lit: Defender for Endpoint into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Windows. Incidents and hunting come with Defender XDR.Lit: OS.Context only, with no route into ISOC here: Windows.Lit: Endpoint, OS.Lit: Defender for Endpoint. Context only, with no route into ISOC here: Windows.Lit: Endpoint, OS.Lit: Defender for Endpoint into ISOC. Context only, with no route into ISOC here: Windows.Lit: ISOC, Hunting, Endpoint, OS.Lit: Defender for Endpoint into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Windows. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Device

Atlas-04 is the device in Maya’s report.Atlas-04 is the device in Maya’s report.

Observe

Defender for Endpoint provides investigation tools for Atlas-04.Onboarded Endpoint P2 provides its endpoint investigation capabilities.

Trace

Alex follows the fictional process evidence.Alex follows the fictional process evidence.

Investigate

Alex inspects the evidence from Atlas-04.His device scope determines which evidence he can inspect.

4 stepsReady

  1. Atlas-04 is the device in Maya’s report.Atlas-04 is the device in Maya’s report.

  2. Defender for Endpoint provides investigation tools for Atlas-04.Onboarded Endpoint P2 provides its endpoint investigation capabilities.

  3. Alex follows the fictional process evidence.Alex follows the fictional process evidence.

  4. Alex inspects the evidence from Atlas-04.His device scope determines which evidence he can inspect.

The steps as a diagram

Device. Atlas-04 is the device in Maya’s report.Atlas-04 is the device in Maya’s report.

Observe. Defender for Endpoint provides investigation tools for Atlas-04.Onboarded Endpoint P2 provides its endpoint investigation capabilities.

Trace. Alex follows the fictional process evidence.Alex follows the fictional process evidence.

Native evidence

Investigate. Alex inspects the evidence from Atlas-04.His device scope determines which evidence he can inspect.

What to rememberWhat to remember, what it takes, sources
What to remember
Alex has device evidence from Atlas-04 to inspect.Full endpoint investigation requires P2, onboarding and permissions.
What it takes
Includes endpoint detection and response. Devices still require onboarding; server licensing is separate.
Status and sources
License rights; deployment remains separate
Open EndpointDefender for Endpoint on the wheel Next: MDMIntune

Part 5 of 12 · MDMIntune

Check the state of Atlas-04

Priya checks management and compliance for Maya’s laptop.

Lit: MDM, OS.Context only, with no route into ISOC here: Intune and Windows.Lit: OS.Context only, with no route into ISOC here: Windows.Lit: MDM, OS.Context only, with no route into ISOC here: Intune and Windows.Lit: MDM, OS.Context only, with no route into ISOC here: Intune and Windows.Lit: MDM, OS.Context only, with no route into ISOC here: Intune and Windows.

Every part this story uses

Play the story, or choose a step.

Device

Atlas-04 is the managed device in this scenario.Atlas-04 is the managed device in this scenario.

Enroll

Enrollment establishes its device management relationship.Enrollment establishes its device management relationship.

Manage

Intune applies the chosen device and app policies to Atlas-04.Intune applies the configured device and app policies.

Assess

Compliance policies show whether Atlas-04 is compliant.Configured compliance policies supply device compliance context.

4 stepsReady

  1. Atlas-04 is the managed device in this scenario.Atlas-04 is the managed device in this scenario.

  2. Enrollment establishes its device management relationship.Enrollment establishes its device management relationship.

  3. Intune applies the chosen device and app policies to Atlas-04.Intune applies the configured device and app policies.

  4. Compliance policies show whether Atlas-04 is compliant.Configured compliance policies supply device compliance context.

The steps as a diagram

Device. Atlas-04 is the managed device in this scenario.Atlas-04 is the managed device in this scenario.

Enroll. Enrollment establishes its device management relationship.Enrollment establishes its device management relationship.

Manage. Intune applies the chosen device and app policies to Atlas-04.Intune applies the configured device and app policies.

Assess. Compliance policies show whether Atlas-04 is compliant.Configured compliance policies supply device compliance context.

What to rememberWhat to remember, what it takes, sources
What to remember
The compliance state of Atlas-04 is known.Enrollment and policy setup remain separate from license selection.
What it takes
Includes Intune P1 plus the currently listed advanced capabilities, including Endpoint Privilege Management, Enterprise Application Management and Cloud PKI. Tenant activation and phased rollout are separate checks.
Status and sources
License rights; deployment remains separate
Open MDMIntune on the wheel Next: CASBDefender for Cloud Apps

App

Part 6 of 12 · CASBDefender for Cloud Apps

Check the connected SaaS app

Alex follows the finance team’s permitted SaaS activity.

Lit: ISOC, CASB, Hunting.Lit: connected sources into Defender for Cloud Apps; Defender for Cloud Apps into ISOC. ISOC uses Incidents and hunting. Incidents and hunting come with Defender XDR.An outside source, not yet connected.An outside source, not yet connected to Defender for Cloud Apps.Lit: CASB.Lit: Defender for Cloud Apps; connected sources into Defender for Cloud Apps.Lit: CASB.Lit: connected sources into Defender for Cloud Apps; Defender for Cloud Apps into ISOC.Lit: ISOC, Hunting, CASB.Lit: connected sources into Defender for Cloud Apps; Defender for Cloud Apps into ISOC. ISOC uses Incidents and hunting. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

App

The team’s fictional finance app provides another lead.The team’s fictional finance app provides another lead.

Connect

An app connection links the finance app.A supported app connection requires its own configuration.

Observe

Cloud Apps provides discovery and protection.Cloud Apps provides the configured discovery and protection capabilities.

Investigate

Alex reviews the finance app’s activity.Alex reviews available activity within his access scope.

4 stepsReady

  1. The team’s fictional finance app provides another lead.The team’s fictional finance app provides another lead.

  2. An app connection links the finance app.A supported app connection requires its own configuration.

  3. Cloud Apps provides discovery and protection.Cloud Apps provides the configured discovery and protection capabilities.

  4. Alex reviews the finance app’s activity.Alex reviews available activity within his access scope.

The steps as a diagram

App. The team’s fictional finance app provides another lead.The team’s fictional finance app provides another lead.

Connect. An app connection links the finance app.A supported app connection requires its own configuration.

Observe. Cloud Apps provides discovery and protection.Cloud Apps provides the configured discovery and protection capabilities.

Investigate. Alex reviews the finance app’s activity.Alex reviews available activity within his access scope.

Native evidence

What to rememberWhat to remember, what it takes, sources
What to remember
The finance app’s activity gives Alex another lead.SaaS subscriptions and Cloud Apps protection are separate.
What it takes
This is the full Defender for Cloud Apps product. Connect supported SaaS applications and configure the relevant discovery and access controls.
Status and sources
License rights; deployment remains separate
Open CASBDefender for Cloud Apps on the wheel Next: Data securityInformation protection

Data

Reaches ISOC on E5 or E7Data loss alerts reach the Defender incident queue with E5 level rights, once an admin turns off the built-in rule that keeps them out. Source (opens in a new tab)

Part 7 of 12 · Data securityInformation protection

Protect the finance document

Maya’s sensitive finance content needs its own protection policies.

Lit: ISOC, Data security, Intranet, Mailboxes, Files, Hunting.Lit: Information protection into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: SharePoint, Exchange and OneDrive. Incidents and hunting come with Defender XDR.Lit: Intranet.Context only, with no route into ISOC here: SharePoint.Lit: Data security, Intranet.Lit: Information protection. Context only, with no route into ISOC here: SharePoint.Lit: Mailboxes, Files, Data security, Intranet.Lit: Information protection. Context only, with no route into ISOC here: SharePoint, Exchange and OneDrive.Lit: ISOC, Hunting, Data security, Intranet, Mailboxes, Files.Lit: Information protection into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: SharePoint, Exchange and OneDrive. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Content

FinanceDocs contains fictional sensitive finance information.FinanceDocs contains fictional sensitive finance information.

Label

A sensitivity label marks the FinanceDocs content.Licensed labeling marks content according to configured policy.

Protect

A DLP policy covers the finance content in mail and files.DLP coverage follows the licensed workload and configured policy.

Escalate

Its data loss alert can reach the SOC.With E5 level rights, its data loss alert can reach the SOC.

4 stepsReady

  1. FinanceDocs contains fictional sensitive finance information.FinanceDocs contains fictional sensitive finance information.

  2. A sensitivity label marks the FinanceDocs content.Licensed labeling marks content according to configured policy.

  3. A DLP policy covers the finance content in mail and files.DLP coverage follows the licensed workload and configured policy.

  4. Its data loss alert can reach the SOC.With E5 level rights, its data loss alert can reach the SOC.

The steps as a diagram

Content. FinanceDocs contains fictional sensitive finance information.FinanceDocs contains fictional sensitive finance information.

Label. A sensitivity label marks the FinanceDocs content.Licensed labeling marks content according to configured policy.

Protect. A DLP policy covers the finance content in mail and files.DLP coverage follows the licensed workload and configured policy.

Escalate. Its data loss alert can reach the SOC.With E5 level rights, its data loss alert can reach the SOC.

What to rememberWhat to remember, what it takes, sources
What to remember
The finance document is labeled, and its data loss alert can reach the SOC.The finance document is labeled and checked against its data loss policy.Data loss alerts can reach ISOC; labels and policies stay in Purview.Labels and policies stay in Purview; data loss alerts reach ISOC only with E5 level rights.
What it takes
Includes automatic sensitivity labeling and the applicable cloud, Teams chat and endpoint DLP rights. Configure policies and license all in-scope users. Other Purview services may have separate terms.
Status and sources
Only the stated information-protection scope
Open Data securityInformation protection on the wheel Next: Hunting

Connect and widen

Parts 8 to 10 · Hunting, SIEM and SOC AIHunting, Sentinel and Security Copilot

Part 8 of 12 · Hunting

Connect the invoice to Atlas-04

Alex tests a lead across permitted investigation evidence.

Lit: ISOC, Hunting, Email, Endpoint, Mailboxes, Inbox, OS.Lit: Defender for Office 365 and Defender for Endpoint into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Exchange, Outlook and Windows. Incidents and hunting come with Defender XDR.Lit: Mailboxes, Inbox, OS.Context only, with no route into ISOC here: Exchange, Outlook and Windows.Lit: Hunting, Mailboxes, Inbox, OS.Lit: Incidents and hunting. Context only, with no route into ISOC here: Exchange, Outlook and Windows. Incidents and hunting come with Defender XDR.Lit: Email, Endpoint, Hunting, Mailboxes, Inbox, OS.Lit: Incidents and hunting; Defender for Office 365 and Defender for Endpoint into ISOC. Context only, with no route into ISOC here: Exchange, Outlook and Windows. Incidents and hunting come with Defender XDR.Lit: ISOC, Hunting, Email, Endpoint, Mailboxes, Inbox, OS.Lit: Defender for Office 365 and Defender for Endpoint into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: Exchange, Outlook and Windows. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Hypothesis

Alex asks whether the invoice connects to Atlas-04.Alex asks whether the invoice connects to Atlas-04.

Query

Hunting searches the relevant workloads and data routes.Hunting searches the available, permitted workloads and data routes.

Compare

Fictional results connect message and device evidence for review.Fictional results connect message and device evidence for review.

Investigate

Alex records what the evidence supports.Alex records what the evidence supports.

4 stepsReady

  1. Alex asks whether the invoice connects to Atlas-04.Alex asks whether the invoice connects to Atlas-04.

  2. Hunting searches the relevant workloads and data routes.Hunting searches the available, permitted workloads and data routes.

  3. Fictional results connect message and device evidence for review.Fictional results connect message and device evidence for review.

  4. Alex records what the evidence supports.Alex records what the evidence supports.

The steps as a diagram

Hypothesis. Alex asks whether the invoice connects to Atlas-04.Alex asks whether the invoice connects to Atlas-04.

Query. Hunting searches the relevant workloads and data routes.Hunting searches the available, permitted workloads and data routes.

Permitted action

Compare. Fictional results connect message and device evidence for review.Fictional results connect message and device evidence for review.

Query result

Investigate. Alex records what the evidence supports.Alex records what the evidence supports.

What to rememberWhat to remember, what it takes, sources
What to remember
Email and device evidence give Alex a lead to verify.A visual connection is a lead for Alex to verify.
What it takes
Onboard qualifying Defender products and assign roles. In the ISOC preview, other data arrives through an ISOC workspace; a tenant with an active Sentinel workspace stays on Sentinel for this preview phase. Evidence and actions follow deployed services, permissions and data routes.
Status and sources
Defender and Sentinel roles remain distinct
Open Hunting on the wheel Next: SIEMSentinel

Part 9 of 12 · SIEMSentinel

Make the external lead usable

A configured external source adds evidence to Alex’s investigation.

Lit: ISOC, SIEM, Hunting.Lit: connected sources into Sentinel. ISOC uses Sentinel and Incidents and hunting. Sentinel is a separate Azure plan, drawn gold dashed. Incidents and hunting come with Defender XDR. Sentinel runs on its own workspace and usage.An outside source, not yet connected.An outside source, not yet connected to Sentinel.Lit: SIEM.An outside source, not yet connected to Sentinel. Sentinel is a separate Azure plan, drawn gold dashed. Sentinel runs on its own workspace and usage.Lit: ISOC, SIEM.Lit: connected sources into Sentinel. ISOC uses Sentinel. Sentinel is a separate Azure plan, drawn gold dashed. Sentinel runs on its own workspace and usage.Lit: Hunting, ISOC, SIEM.Lit: connected sources into Sentinel. ISOC uses Sentinel and Incidents and hunting. Sentinel is a separate Azure plan, drawn gold dashed. Incidents and hunting come with Defender XDR. Sentinel runs on its own workspace and usage.

Every part this story uses

Play the story, or choose a step.

Source

The fictional endpoint tool produces a relevant event.The fictional endpoint tool produces a relevant event.

Connect

A connector is set up for the endpoint tool.Credentials and the selected dataset configure its connector.

Ingest

Selected events enter the Sentinel workspace.Selected events enter the configured workspace.

Investigate

Alex queries the events for his investigation.Alex queries data available within his workspace permissions.

4 stepsReady

  1. The fictional endpoint tool produces a relevant event.The fictional endpoint tool produces a relevant event.

  2. A connector is set up for the endpoint tool.Credentials and the selected dataset configure its connector.

  3. Selected events enter the Sentinel workspace.Selected events enter the configured workspace.

  4. Alex queries the events for his investigation.Alex queries data available within his workspace permissions.

The steps as a diagram

Source. The fictional endpoint tool produces a relevant event.The fictional endpoint tool produces a relevant event.

Connect. A connector is set up for the endpoint tool.Credentials and the selected dataset configure its connector.

Ingest. Selected events enter the Sentinel workspace.Selected events enter the configured workspace.

Configured ingestion

Investigate. Alex queries the events for his investigation.Alex queries data available within his workspace permissions.

Query result

What to rememberWhat to remember, what it takes, sources
What to remember
Selected events from the endpoint tool give Alex another investigation lead.External ingestion and retention keep their own consumption terms.
What it takes
Microsoft Sentinel is billed on Azure by data and usage, separately from Microsoft 365. Eligible seats may qualify for a limited Microsoft-data ingestion grant. In the ISOC preview, extra data goes into an ISOC workspace created from the Defender portal; a tenant with an active Sentinel workspace stays on Sentinel for this preview phase. Outside ISOC, connect a Sentinel-enabled workspace with appropriate permissions and data connectors. Third-party ingestion, retention and other consumption have separate terms. A license selection here does not activate a workspace.
Status and sources
GA in Defender; workspace and usage separate
Open SIEMSentinel on the wheel Next: SOC AISecurity Copilot

Part 10 of 12 · SOC AISecurity Copilot

Help Alex understand the evidence

Alex asks Security Copilot about permitted investigation context.

Lit: ISOC, SOC AI, Email, Endpoint, ITDR, Mailboxes, Inbox, Hunting.Lit: Defender for Office 365, Defender for Endpoint and Defender for Identity into ISOC. ISOC uses Security Copilot and Incidents and hunting. Context only, with no route into ISOC here: Exchange and Outlook. Incidents and hunting come with Defender XDR. Security Copilot runs on its own capacity.Lit: Mailboxes, Inbox.Context only, with no route into ISOC here: Exchange and Outlook.Lit: SOC AI, Mailboxes, Inbox.Lit: Security Copilot. Context only, with no route into ISOC here: Exchange and Outlook. Security Copilot runs on its own capacity.Lit: ISOC, Email, Endpoint, ITDR, SOC AI, Mailboxes, Inbox.Lit: Defender for Office 365, Defender for Endpoint and Defender for Identity into ISOC. ISOC uses Security Copilot. Context only, with no route into ISOC here: Exchange and Outlook. Security Copilot runs on its own capacity.Lit: Hunting, ISOC, SOC AI, Email, Endpoint, ITDR, Mailboxes, Inbox.Lit: Defender for Office 365, Defender for Endpoint and Defender for Identity into ISOC. ISOC uses Security Copilot and Incidents and hunting. Context only, with no route into ISOC here: Exchange and Outlook. Incidents and hunting come with Defender XDR. Security Copilot runs on its own capacity.

Every part this story uses

Play the story, or choose a step.

Ask

Alex asks about the fictional invoice investigation.Alex asks about the fictional invoice investigation.

Access

Alex opens Security Copilot.Enabled Security Copilot needs roles and available capacity.

Context

Connected services supply evidence Alex is allowed to see.Connected services supply evidence within the permitted scope.

Review

Alex checks the answer and decides what happens next.Alex checks the answer and decides what happens next.

4 stepsReady

  1. Alex asks about the fictional invoice investigation.Alex asks about the fictional invoice investigation.

  2. Alex opens Security Copilot.Enabled Security Copilot needs roles and available capacity.

  3. Connected services supply evidence Alex is allowed to see.Connected services supply evidence within the permitted scope.

  4. Alex checks the answer and decides what happens next.Alex checks the answer and decides what happens next.

The steps as a diagram

Ask. Alex asks about the fictional invoice investigation.Alex asks about the fictional invoice investigation.

Access. Alex opens Security Copilot.Enabled Security Copilot needs roles and available capacity.

Context. Connected services supply evidence Alex is allowed to see.Connected services supply evidence within the permitted scope.

Review. Alex checks the answer and decides what happens next.Alex checks the answer and decides what happens next.

What to rememberWhat to remember, what it takes, sources
What to remember
Alex checks the answer and decides the next step.Assistance does not grant new evidence access or unrestricted actions.
What it takes
Eligible notified E5/E7 tenants receive automatic Security Copilot provisioning. Included capacity follows the documented rollout. Access roles, agent-specific prerequisites and usage remain separate checks.
Status and sources
Phased inclusion; verify tenant enablement
Open SOC AISecurity Copilot on the wheel Next: Audit logAudit

Record and preserve

Parts 11 and 12 · Audit log and Legal holdAudit and eDiscovery

Part 11 of 12 · Audit logAudit

Find the recorded activity

Alex checks recorded activity around the FinanceDocs event.

Lit: ISOC, Audit log, Intranet, Hunting.Lit: Audit into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: SharePoint. Incidents and hunting come with Defender XDR.Lit: Intranet.Context only, with no route into ISOC here: SharePoint.Lit: Audit log, Intranet.Lit: Audit. Context only, with no route into ISOC here: SharePoint.Lit: Audit log, Intranet.Lit: Audit into ISOC. Context only, with no route into ISOC here: SharePoint.Lit: ISOC, Hunting, Audit log, Intranet.Lit: Audit into ISOC. ISOC uses Incidents and hunting. Context only, with no route into ISOC here: SharePoint. Incidents and hunting come with Defender XDR.

Every part this story uses

Play the story, or choose a step.

Activity

Services record user and administrator activity around FinanceDocs.Relevant services record supported user and administrator activities.

Retain

Purview Audit keeps the activity records.Audit edition and event scope determine available records.

Search

An investigator searches activity around FinanceDocs.An authorized investigator searches the supported activity.

Review

Alex checks what the retained records establish.Alex checks what the retained records establish.

4 stepsReady

  1. Services record user and administrator activity around FinanceDocs.Relevant services record supported user and administrator activities.

  2. Purview Audit keeps the activity records.Audit edition and event scope determine available records.

  3. An investigator searches activity around FinanceDocs.An authorized investigator searches the supported activity.

  4. Alex checks what the retained records establish.Alex checks what the retained records establish.

The steps as a diagram

Activity. Services record user and administrator activity around FinanceDocs.Relevant services record supported user and administrator activities.

Retain. Purview Audit keeps the activity records.Audit edition and event scope determine available records.

Search. An investigator searches activity around FinanceDocs.An authorized investigator searches the supported activity.

Permitted action

Review. Alex checks what the retained records establish.Alex checks what the retained records establish.

Query result

What to rememberWhat to remember, what it takes, sources
What to remember
Recorded activity shows what happened around FinanceDocs.Audit roles and retention are separate from SOC incident access.
What it takes
Assign eligible licenses and audit roles. Premium retention applies to eligible users and events; ten-year retention is a separate add-on.
Status and sources
Service and event coverage vary
Open Audit logAudit on the wheel Next: Legal holdeDiscovery

Part 12 of 12 · Legal holdeDiscovery

Preserve the case material

The authorized case team preserves relevant FinanceDocs material.

Lit: Legal hold, Intranet, Mailboxes, Files.Context only, with no route into ISOC here: eDiscovery, SharePoint, Exchange and OneDrive.Lit: Intranet.Context only, with no route into ISOC here: SharePoint.Lit: Legal hold, Intranet.Context only, with no route into ISOC here: eDiscovery and SharePoint.Lit: Mailboxes, Files, Legal hold, Intranet.Context only, with no route into ISOC here: eDiscovery, SharePoint, Exchange and OneDrive.Lit: Legal hold, Intranet, Mailboxes, Files.Context only, with no route into ISOC here: eDiscovery, SharePoint, Exchange and OneDrive.

Every part this story uses

Play the story, or choose a step.

Identify

The case team identifies relevant content locations.The case team identifies relevant content locations.

Authorize

The case team works in a Purview case.Purview case permissions define who can work the case.

Preserve

A hold preserves the case material where it is kept.Configured holds preserve supported content within licensed scope.

Review

The case team reviews the preserved material.The case team uses its licensed review capabilities.

4 stepsReady

  1. The case team identifies relevant content locations.The case team identifies relevant content locations.

  2. The case team works in a Purview case.Purview case permissions define who can work the case.

  3. A hold preserves the case material where it is kept.Configured holds preserve supported content within licensed scope.

  4. The case team reviews the preserved material.The case team uses its licensed review capabilities.

The steps as a diagram

Identify. The case team identifies relevant content locations.The case team identifies relevant content locations.

Authorize. The case team works in a Purview case.Purview case permissions define who can work the case.

Preserve. A hold preserves the case material where it is kept.Configured holds preserve supported content within licensed scope.

Permitted action

Review. The case team reviews the preserved material.The case team uses its licensed review capabilities.

What to rememberWhat to remember, what it takes, sources
What to remember
The case team preserves and reviews the FinanceDocs material.A Purview case is distinct from a SOC incident.
What it takes
Configure case roles, content access and holds. Premium use requires qualifying licensing; new data sources and AI features may have separate terms.
Status and sources
Purview case workflow; not a SOC incident
Open Legal holdeDiscovery on the wheel

After part 12

The case act by actWhat the case teaches

  1. MessageEmailDefender for Office 365: Plan 2 adds the investigation and XDR integration this story uses.
  2. PersonITDR and IAMDefender for Identity: Identity protection depends on deployed sensors and supported systems. Entra ID: Conditional Access requires P1; risk capabilities require P2.Defender for Identity: Identity protection depends on deployed sensors and supported systems. Entra ID: Conditional Access requires P1; risk capabilities require P2.
  3. DeviceEndpoint and MDMDefender for Endpoint: Full endpoint investigation requires P2, onboarding and permissions. Intune: Enrollment and policy setup remain separate from license selection.
  4. AppCASBDefender for Cloud Apps: SaaS subscriptions and Cloud Apps protection are separate.
  5. DataData securityInformation protection: Data loss alerts can reach ISOC; labels and policies stay in Purview.Information protection: Labels and policies stay in Purview; data loss alerts reach ISOC only with E5 level rights.
  6. Connect and widenHunting, SIEM and SOC AIHunting: A visual connection is a lead for Alex to verify. Sentinel: External ingestion and retention keep their own consumption terms. Security Copilot: Assistance does not grant new evidence access or unrestricted actions.
  7. Record and preserveAudit log and Legal holdAudit: Audit roles and retention are separate from SOC incident access. eDiscovery: A Purview case is distinct from a SOC incident.

Next: automate a response like this one

Want to see which of these products your license includes? Pick a license on the wheel and select any slice for details.

Open the wheel