Question

A financial services company is designing its security operations center (SOC) tooling strategy. They already use Microsoft Defender XDR for endpoint, identity, email, and cloud app signals, and they need a centralized platform to correlate these XDR alerts with logs from third-party network firewalls, on-premises Active Directory Federation Services, and custom line-of-business applications for organization-wide threat hunting and long-term retention. Based on the Microsoft Cybersecurity Reference Architecture (MCRA), which design approach best meets these requirements?

Accepted Answer

Deploy Microsoft Sentinel as the SIEM and connect Defender XDR via the unified data connector, ingesting third-party firewall, ADFS, and custom app logs alongside XDR incidents for correlation, hunting, and retention.

Answer

Rely solely on the Defender XDR unified portal and use its incident correlation to ingest firewall, ADFS, and custom app logs directly, avoiding a separate SIEM.

Answer

Forward all Defender XDR and third-party logs to a Log Analytics workspace without Sentinel, and build custom Kusto dashboards for threat hunting.

Answer

Deploy Microsoft Defender for Cloud as the central SIEM to aggregate XDR alerts and third-party logs for enterprise-wide correlation and retention.