Question

A financial services company operates workloads across Azure, on-premises servers, and Microsoft 365. The security operations team wants a single solution that ingests security logs from all these sources, correlates events to detect multi-stage attacks, and automatically executes response playbooks (such as disabling compromised accounts) when specific incidents are triggered. Which solution should you recommend?

Accepted Answer

Deploy Microsoft Sentinel on a Log Analytics workspace, connect data connectors for Azure, on-premises, and Microsoft 365, and use analytics rules with automation playbooks.

Answer

Enable Microsoft Defender for Cloud with the enhanced security plans and rely on its regulatory compliance dashboard.

Answer

Configure Azure Monitor diagnostic settings to route all logs to a central Log Analytics workspace and build KQL alert rules.

Answer

Deploy Azure Monitor Workbooks with cross-resource queries and configure metric alerts with action groups.