SOC journey with Microsoft’s unified security operations platform
In this section, we focus on the investigation experience by highlighting a few key features in a scenario where an organization is utilizing both Microsoft Sentinel and Microsoft Defender XDR in its SOC operations.
Typically, when an incident is created in the Sentinel incident queue, the SOC team receives a notification about the incident. Notifications can be sent to third-party solutions such as ServiceNow or Jira depending on what ticketing system the SOC team uses.
If a third-party SOAR solution is in use (for example, Cortex XSOAR, formerly Demisto), this can be the place where the investigation process starts. In some cases, typically in smaller organizations, there may not necessarily be a ticketing system in use for handling case management in SOC; rather, a Teams channel or email notifications may be the preferred way to get notified about new incidents.