Question

A financial services company is completing a Well-Architected Framework review of a mission-critical Azure workload. The security team reports that their incident responders spend hours manually triaging Defender for Cloud alerts, correlating signals, and executing containment steps, which delays response and introduces inconsistency during high-pressure incidents. Leadership wants a design recommendation that improves response consistency and reduces mean time to respond (MTTR) while remaining aligned to WAF principles. Which approach should the cybersecurity architect recommend?

Accepted Answer

Implement Microsoft Sentinel automation rules and SOAR playbooks that trigger on high-severity incidents to orchestrate enrichment and containment as codified, repeatable runbooks.

Answer

Increase the log retention period in the Log Analytics workspace to 730 days so responders have more historical context during investigations.

Answer

Add a second SOC shift so that more analysts are available to manually triage the alert backlog around the clock.

Answer

Route all Defender for Cloud alerts directly to an email distribution list monitored by the on-call responder to speed up notification.