SOC, SIEM and MDR in plain language. What does your organisation really need?

Anyone looking into the security of their organisation soon faces a row of abbreviations: EDR, XDR, SIEM, SOC, MDR. Providers use them interchangeably, which makes comparing hard. This article explains what they mean, what Microsoft already does for you and where you need a specialist.

Four terms, one building

Compare digital security with securing your building. Sensors and an alarm report that something is happening. Cameras record what happened. In a control room people judge whether it is real. And a guard takes action.

The key insight: a SOC is a function, not a product. It is people and agreements that assess and follow up alerts. A SIEM is one of the tools such a control room can use, but not the only one. For most organisations running on Microsoft 365, a SIEM is not needed at the start.

Why one attack story says more than four alerts

An attack rarely consists of a single step. A phishing email leads to a stolen password, the attacker signs in with it, and then something happens on a laptop. With separate security products you get four alerts from four systems, and someone has to piece them together. Defender XDR does that automatically.

That saves more than time. Because Microsoft sees the whole story, it can also step in itself when it is confident enough: the account is contained and the laptop isolated, within minutes. After that a person is needed to judge how serious it is and what has to be fixed.

What does the technology do, and what do people do?

Good security analysts are scarce and expensive. A traditional control room grows with the number of alerts: more alerts, more people. We turn that around. The technology does the routine work, our specialists do the thinking.

For you that means three things. Known attacks are contained faster, at night too. You do not pay for analysts clicking away alerts. And our specialist has time for what matters: your situation, the fix and the advice. New Microsoft capabilities, such as AI assistants for security, we build in as soon as they are available for your licence. That is an ambition, not a promise.

How far back can you look?

To intervene now, Defender sees enough. For investigation afterwards something else counts: how long the data is kept.

If an incident is only discovered after two months, you will still see the alert, but the details are gone: which processes ran and where the sign-ins came from. That requires extra log retention. It can be targeted, for the most important data only, without a full SIEM.

When do you actually need a SIEM?

Both options below are a full control-room function on the same Microsoft foundation. The SIEM layer with Microsoft Sentinel adds sources outside Microsoft, automated playbooks and a longer history.

What do you need to get started?

The foundation is Microsoft 365 Business Premium with the Defender Suite, an add-on of € 8.70 per user per month (Microsoft list price for an annual subscription, excluding VAT). Business Premium on its own is not enough: protection for identities and cloud apps and the extended detection on devices and email are in the Defender Suite. If you work with Microsoft 365 E5, you already have it.

On top of that you need someone who watches and steps in. That is our Managed Detection & Response: contained automatically day and night, reviewed and fixed on working days by a dedicated specialist, alongside your current IT provider. Curious what that would look like for you? Book twenty minutes with Martijn or Remy.

← All articles