A Leader in the market with an innovative solution for the SOC  

Microsoft Sentinel provides a unique experience for customers to help them act faster and stay safer while managing the scaling costs of security. Customers choose our SIEM in order to:  

Protect everything with a comprehensive SIEM solution. Microsoft Sentinel is a cloud-native solution that supports detection, investigation, and response across multi-cloud and multi-platform data sources with 340+ out-of-the-box connectors A strength of Microsoft’s offering is its breadth, which includes user entity and behavior analytics (UEBA), threat intelligence and security orchestration, automation, and response (SOAR) capabilities, along with native integrations into Microsoft Defender threat protection products. 

• Enhance security with a unified security operations platform. Customers get the best protection when pairing Microsoft Sentinel with Defender XDR in Microsoft’s unified security operations platform. The integration not only brings the two products together into one experience but combines functionalities across each to maximize efficiency and security. One example is the unified correlation engine which delivers 50% faster alerting between first- and third-party data, custom detections and threat intelligence.³ Customers can stay safer with a unified approach, with capabilities like automatic attack disruption—which contains attacks in progress, limiting their impact at machine speed.   

• Address any scenario. As the first cloud-native SIEM, Microsoft Sentinel helps customers observe threats across their digital estate with the flexibility required for today’s challenges. Our content hub offerings include over 200 Microsoft- created solutions and over 280 community contributions. The ability to adapt to the unique use cases of an organization is something called out in both the Forrester and Gartner reports.  

• Scale your security coverage with cloud flexibility. Compared with legacy, on-premises SIEM solutions, Microsoft Sentinel customers see up to a 234% return on investment (ROI).¹ This makes it an attractive option for customers looking for a scalable offering to meet the evolving needs of their business while managing the costs of data. We’ve recently launched a new, low-cost data tier called Auxiliary Logs to help customers increase the visibility of their digital environment, while keeping their budgets in check. In addition, Microsoft’s SOC Optimizations feature, a first of its kind offering, provides targeted recommendations to users on how to better leverage their security data to manage costs and maximize their protection, based on their specific environment and using frameworks like the MITRE attack map  

• Respond quickly to emergent threats with AI. Security Copilot is a GenAI tool that can help analysts increase the speed of their response, uplevel their skills, and improve the quality of their work. 92% of analysts reported using Copilot helped make them more productive and 93% reported an improvement in the quality of their work.²  

What’s next in Microsoft Security 

Microsoft is dedicated to continued leadership in security through ongoing investment to provide customers with the intelligence, automation, and scalability they need to protect their businesses and work efficiently. New and upcoming enhancements include more unified features across SIEM and XDR, exposure management and cloud security in the unified security operations platform, and our SIEM migration tool—which now supports conversion of Splunk detections to Microsoft Sentinel analytics rules and additional Copilot skills to help analysts do their job better.  

​​CTA​: To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

^[1] The Total Economic Impact™ Of Microsoft Sentinel (forrester.com) 

^[2] Microsoft Copilot for Security randomized controlled trial (RCT) with experienced security analysts conducted by Microsoft Office of the Chief Economist, January 2024 

³Microsoft internal data 

Gartner, Magic Quadrant for Security Information and Event Management, By Andrew Davies, Mitchell Schneider, Rustam Malik, Eric Ahlm, 8 May 2024 

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. 

The post ​​Microsoft now a Leader in three major analyst reports for SIEM appeared first on Microsoft Security Blog.

The key to fighting ransomware at scale is Microsoft’s unwavering commitment to simplifying, automating, and augmenting security analyst workstreams to meet the demands of today’s and tomorrow’s cyberthreat environment. We are excited to announce that Gartner has named Microsoft a Leader in the 2024 Gartner^® Magic Quadrant™ for Endpoint Protection Platforms for the fifth consecutive time. We believe this announcement reflects Microsoft’s continued progress in helping organizations protect their endpoints against even the most sophisticated attacks, while driving continued efficiency for security operations center (SOC) teams.

Microsoft Defender for Endpoint is an endpoint security platform that helps organizations secure their digital estate using AI-powered, industry-leading endpoint detection and response across Windows, Linux, macOS, Android, iOS, and Internet of Things (IoT) devices. It is core to Microsoft Defender XDR and built on global threat intelligence—informed by more than 78 trillion daily signals and more than 10,000 security experts—empowering security teams to fend off sophisticated threats.²

Our customers and partners have been an invaluable part of this multiyear journey, and we are grateful for both their business and their partnership. Read the complimentary report providing more details on our positioning as a Leader.

Microsoft Defender for Endpoint is built from the ground up with operational resilience in mind. It starts with our agent architecture that follows best practices for Windows by limiting its reliance on kernel mode while protecting customers in real-time. It does not load content updates from files in the kernel mode driver. As an added safeguard, we deliver updates to customers applying Microsoft’s long-established safe deployment practices (SDP) model. Customers have full control over how these updates are delivered and how controls are applied to their device estate. This model of shared control helps provide security and resiliency. 

Over the last 12 months, Microsoft has delivered significant innovations that have helped defenders gain the upper hand against cyberthreats including: improved attack disruption, Microsoft Copilot for Security, a new Linux agent, simplified settings management, the unified security operations platform and Microsoft Defender Experts for XDR.

Automatic attack disruption, unique to Microsoft, is a self-defense capability that stops in-progress cyberattacks by analyzing the attacker’s intent, identifying compromised assets, and isolating or disabling assets like users or devices at machine speed. For example, in July 2024 we discovered the CVE-2024-37085 vulnerability. Numerous ransomware operators exploited it to encrypt the entire file system and move laterally in the network. Attack disruption fends off such sophisticated ransomware attempts by blocking lateral movement and remote encryption in a decentralized way across all your device estate—in just three minutes on average.³ This is a capability that Microsoft continues to invest in to disrupt more scenarios even earlier in the cyberattack chain.  

Microsoft Copilot for Security is the industry’s first generative AI that empowers security teams to protect at the speed and scale of AI, generally available as of April 2024. Embedded within the Defender XDR experience, it assists analysts by providing enriched context for faster and smarter decisions. It accelerates investigation, containment, and remediation with prescriptive step-by-step guidance. Analysts can now easily understand attacker actions with intuitive script analysis and launch complex Kusto Query Language (KQL) queries using plain language. The results from a randomized controlled trial based on 147 security professionals showed significant efficiency gains including speed and quality improvements when using Copilot for Security. Security professionals were up to 22% faster across all tasks, and more than 93% of users wanted to use Copilot again.

A new Linux agent has been built from scratch, using eBPF sensor technology to deliver the performance and stability needed for mission-critical server workloads while providing visibility into cyberthreats. We continue prioritizing innovations across every type of endpoint from Windows, Linux, macOS, iOS, Android, and IoT to provide the holistic endpoint security that organizations need.

Simplified setup and change management help analysts configure devices correctly to minimize threat exposure. With the general availability of simplified settings management, SOC analysts can manage security policies without leaving the Defender XDR portal.

Unified security operations platform brings the foundational tools a SOC needs into a single experience, with a consistent data model, unified capabilities, and broad protection. This unification helps SOCs close critical security gaps and streamline their operations, delivering better overall protection, reducing their response time, and improving overall efficiency. Defender for Endpoint is core to this platform, which combines “the power of leading solutions in security information and event management (SIEM), extended detection and response (XDR), and generative AI for security.” By working seamlessly across Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Copilot for Security, security analysts need only a single set of automation rules and playbooks. Plus, they can use plain language to execute complex tasks in an instant with Copilot for Security embedded in the platform.

Microsoft Defender Experts for XDR gives your security team coverage with around-the-clock access to Microsoft expertise. Recognizing that sophisticated cyberthreats go beyond the endpoint, Microsoft offers Microsoft Defender Experts for XDR. This managed service is available 24 hours a day, 7 days a week, helping organizations extend their SOC team to fully triage events and respond to incidents across domains.

Thank you to all our customers. You inspire us as together we work to create a safer world.

Learn more

If you’re not yet taking advantage of Microsoft’s leading endpoint security solution, visit Microsoft Defender for Endpoint and start a free trial today to evaluate our leading endpoint protection platform. 

Are you a regular user of Microsoft Defender for Endpoint? Review your experience on Gartner Peer Insights™ and get a $25 gift card.    

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹2024 Microsoft Digital Defense Report. Publishing October 15, 2024.

²Microsoft Digital Defense Report, Microsoft. 2023.

³Get end-to-end protection with Microsoft’s unified security operations platform, now in public preview, Rob Lefferts. April 3, 2024.

Gartner, Magic Quadrant for Endpoint Protection Platforms, Evgeny Mirolyubov, Franz Hinner, Deepak Mishra, Satarupa Patnaik, Chris Silva, September 23, 2024. 

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, MAGIC QUADRANT and PEER INSIGHTS are registered trademarks of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. 

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Microsoft. 

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 

The post ​​Microsoft is named a Leader in the 2024 Gartner® Magic Quadrant™ for Endpoint Protection Platforms appeared first on Microsoft Security Blog.

We are excited to share that Microsoft has again been ranked number one in market share in the IDC Worldwide Modern Endpoint Security Market Shares, 2023: Evolving to Address New Work Modalities (doc #US52341924, June 2024).

And with more than 25.8% of the market share, Microsoft has the endpoint security solution more customers use to defend their multiplatform devices than any other vendor. As depicted in Figure 1, that’s a 40.7% increase in share over the previous year. Thanks to the invaluable partnership with organizations of all sizes around the globe, this distinction comes in addition to Microsoft being recognized as a Leader in the 2024 IDC MarketScape reports for Worldwide Modern Endpoint Security across all three segments—enterprise², midsize³, and small businesses⁴—the only vendor positioned in the “Leaders” category in all three reports. 

Microsoft Defender for Endpoint

Help secure endpoints with industry-leading, multiplatform detection and response.

Learn more

Disrupt ransomware on any platform

For enterprises, Microsoft Defender for Endpoint delivers AI-powered endpoint security with industry-leading, multiplatform threat detection and response across all devices—spanning client, mobile, Internet of Things (IoT), and servers. It is purpose-built to protect against the unique threat profiles per platform including Windows, macOS, Linux, Android, and iOS. It’s a comprehensive endpoint security platform that helps fend off known and emerging cyberattacks, with capabilities that include:

• Vulnerability management.
• Protections tailored to each operating system.
• Next-generation antivirus.
• Built-in, auto-deployed deception techniques.
• Endpoint detection and response.
• Automatic attack disruption of ransomware.

And with more than 78 trillion daily signals and insights from more than 10,000 world-class experts, you can quickly detect, protect, respond to, and proactively hunt for cyberthreats to keep intruders at bay.⁵ Plus, its automatic attack disruption capabilities stop sophisticated attacks with high confidence, so you can disrupt cyberthreats early in the cyberattack chain and block lateral movement of bad actors across your devices.

For small and medium-sized businesses (SMBs), Microsoft Defender for Business goes beyond traditional antivirus protection. Defender for Business delivers many of the enterprise-grade security features from Defender for Endpoint in a way that is easy for SMBs to use without requiring security expertise. 70% of organizations encountering human-operated ransomware attacks have fewer than 500 employees, so choosing the right endpoint protection is imperative.¹ Defender for Business is designed to help you save money by consolidating multiple products into one security solution that’s optimized for your business—and includes out-of-the-box policies that streamline onboarding, simplified management controls for security operations, and monthly security summary reports to help you understand your security posture.

Stay one step ahead of the evolving threat landscape

Defender for Endpoint is core to Microsoft Defender XDR, making it seamless to extend the scope of your organization’s cyberthreat detection to include other layers of your security stack with incident-level visibility across the cyberattack chain. Disrupt advanced cyberattacks and accelerate response—across endpoints, IoT, hybrid identities, email and collaboration tools, software as a service (SaaS) apps, cloud workloads, and data insights.

Built-in, security-specific generative AI with Microsoft Copilot for Security makes it easy for security analysts to rapidly investigate and respond to incidents and help them learn new skills such as quickly reverse-engineering malicious scripts, getting guided response actions, using natural language to do advanced hunting, and more. Copilot is now embedded in Microsoft Defender XDR for Copilot customers.

Learn more

If you are not yet using Microsoft Defender for Endpoint, learn more on our website. If you a regular user of Microsoft Defender for Endpoint, please review your experience on Gartner Peer Insights™ and get a $25 gift card.

If your organization has less than 300 users, we also encourage you to explore Microsoft 365 Business Premium and Defender for Business.  

Learn how to supercharge your security operations with Microsoft Defender XDR.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Microsoft Digital Defense Report 2023.

²IDC MarketScape: Worldwide Modern Endpoint Security for Enterprises 2024 Vendor Assessment (doc #US50521223, January 2024).

³IDC MarketScape: Worldwide Modern Endpoint Security for Midsize Businesses 2024 Vendor Assessment (doc #US50521323, February 2024).

⁴IDC MarketScape: Worldwide Modern Endpoint Security for Small Businesses 2024 Vendor Assessment (doc #US50521424, March 2024).

⁵Microsoft Threat Intelligence.

The post Microsoft again ranked number one in modern endpoint security market share appeared first on Microsoft Security Blog.

Today, we are excited to announce that Microsoft has been named a leader in The Forrester Wave: Extended Detection and Response (XDR) platforms, Q2, 2024, with the highest scores in the strategy, current offering, and market presence categories. Microsoft Defender XDR was rated the highest possible in 15 out of 22 evaluation criteria, including Endpoint Native Detection, Surface Investigation, Threat Hunting, Analyst Experience, Vision, and Innovation.

Forrester states that “Microsoft is refining the most complete XDR offering in the market today,” and called out “its dedication to innovation is demonstrated by its percentage of the R&D budget by revenue, which rivals the most innovative vendors in security.”

We believe Forrester’s recognition showcases that Microsoft Defender XDR is the broadest native XDR solution on the market and that our most recent additions of Microsoft Defender for Cloud data and Microsoft Purview Insider Risk Management data are critical to give the SOC access to end-to-end data. Its incident-level visibility, automatic attack disruption of advanced attacks, and accelerated detection and response now work across endpoints, Internet of Things (IoT), operational technology (OT), on-premises and cloud identities, email and collaboration tools, software as a service (SaaS) apps, cloud workloads, and data insights.

Microsoft Defender XDR

Elevate your security with unified visibility, investigation, and response.

Learn more

Get end-to-end protection with Microsoft’s unified security operations platform

Native breadth is critical to an industry-leading XDR solution, and with Microsoft Defender XDR coverage, organizations get free data ingestion for more workloads than any other can provide. But we understand that customers need to be able to bring together security signals from many sources. This is why we built the security operations platform—by combining the full capabilities of XDR, security information and event management (SIEM), exposure management, generative AI, and threat intelligence. Having these critical capability sets in a single place and operating across all relevant data defeats security tools silos while empowering security teams with unified, comprehensive features that apply to multiple use cases.

A unified platform. The unified security operations platform enables customers to reap the benefits of both SIEM and XDR through incident level response, flexible reporting, automated workflows, and hunting across both first- and third-party data sources. In the private preview, customers saw up to an 80% reduction in incidents, leveraging the powerful correlation across both XDR and SIEM data.² With attack disruption for SAP, the platform will automatically disable access to both the SAP and Microsoft accounts during a financial fraud attack—providing critical protection for a platform that houses extremely sensitive data.

Generative AI embedded. Microsoft Copilot for Security is an industry-first generative AI solution that enables security teams to simplify processes like incident remediation and guided response, reverse engineer malware code, and even uplevel junior analysts by generating Kusto Query Language (KQL) queries using natural language. Embedded directly into the investigation experience, Copilot for Security enables the SOC to automate repetitive tasks and facilitate more informed decision-making during complex security incidents.

Disrupts advanced attacks faster than any other platform. In a world where AI can be used for both good and evil, the importance of using it to fortify organizational defenses becomes more critical than ever. In the last year, 75% of security professionals witnessed an increase in attacks with 85% attributing this rise to bad actors using generative AI.³ This is why Microsoft Security continues to invest in AI. Automatic attack disruption in Defender XDR uses the power of AI and machine learning to detect and disrupt in-progress attacks like ransomware, business email compromise, attacker in the middle, and more with high confidence to limit the impact to an organization. By correlating trillions of signals from the workloads, Defender XDR can recognize the intent of an attacker and disrupts ransomware attacks in just three minutes.⁴

With cyberattackers using AI for their own means, XDR and unified security operations platforms are becoming increasingly critical to modern cybersecurity strategies. We are excited that Forrester recognized Microsoft’s leadership in this space, and we will continue to focus on innovation and AI-capabilities to help organizations future-proof their defenses.

Learn more about Microsoft Defender XDR.

Cybersecurity and AI news

Discover the latest trends and best practices in cyberthreat protection and AI for cybersecurity.

Get the latest resources

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹The Fundamentals of Cloud Security, The Hacker News. May 8, 2024.

²Microsoft internal data, May 2024.

³Study finds increase in cybersecurity attacks fueled by generative AI, Security Magazine. August 29, 2023.

⁴Get end-to-end protection with Microsoft’s unified security operations platform, now in public preview, Rob Lefferts. April 3, 2024.

The Forrester Wave™: Extended Detection And Response Platforms, Q2 2024, Allie Mellen, Joseph, Blankenship, Sarah Morana, and Michael Belden. June 3, 2024.

The Forrester Wave™ is copyrighted by Forrester Research, Inc. Forrester and Forrester Wave™ are trademarks of Forrester Research, Inc. The Forrester Wave™ is a graphical representation of Forrester’s call on a market and is plotted using a detailed spreadsheet with exposed scores, weightings, and comments. Forrester does not endorse any vendor, product, or service depicted in the Forrester Wave™. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change.

The post Microsoft is named a leader in the Forrester Wave for XDR appeared first on Microsoft Security Blog.

Are you a regular user of Microsoft Sentinel? Review your experience on Gartner Peer Insights™ and get a $25 gift card. 

Microsoft Sentinel is enriched by AI, automation, and Microsoft’s deep understanding of the threat landscape, empowering defenders to hunt and resolve critical threats at machine speed. Our comprehensive solution works seamlessly across multiple clouds, platforms, and security stacks offering many out-of-the-box connectors and customizable content to effectively protect the entire digital estate at scale. Leveraging our capabilities, customers have seen up to 234% return on investment (ROI) over a three-year period and have reduced costs as much as 44% by discontinuing legacy SIEM solutions.² 

Microsoft is on a mission to modernize security operations, enabling analysts to act swiftly and more efficiently with a robust, cost-optimized, and intuitive solution.

Microsoft Sentinel

Build next-generation security operations powered by the cloud and AI.

Try for free

Transforming Security Operations 

Tens of thousands of customers trust Microsoft Sentinel to accelerate protection of their organizations with a simplified, scalable, and comprehensive approach. Over the last year, our engineering team has been hard at work delivering new innovations in several key areas, including:    

• A comprehensive and unified security operations platform: The platform blends the best of SIEM, XDR, AI, Threat Intelligence, and extended posture management into a single experience offering end-to-end protection by consolidating various security operations tools into a single, coherent experience, powered by generative AI. In the unified security operations platform, features are unified across Microsoft Sentinel and Microsoft Defender XDR, with embedded Copilot for Security, to deliver more comprehensive protection, speeding up time to respond and reducing the workload on analysts. 

• Robust out-of-the-box content: To effectively protect all clouds and platforms, Microsoft Sentinel offers pre-built content and solution packages that can be customized enabling detection, response, and defensive capabilities in the SOC. Over the last few months, we have enhanced our multicloud data collection (AWS and GCP), updated codeless connectors, expanded data coverage to more third-party sources, and extended protection to various critical business applications (SAP, Microsoft Dynamics 365, and Power Platform) among many more innovations. 

• Splunk SIEM migration tool: We announced the general availability of the new SIEM Migration tool to simplify and accelerate SIEM migrations to Microsoft with automated assistance. Today, the experience supports conversion of Splunk detections to Microsoft Sentinel analytics rules with more capabilities coming in the months ahead. 

• SOC efficiency: SOC optimization capability enables security teams to customize and manage their SIEM more efficiently for specific business and security requirements. With dynamic, research backed recommendations to optimize data usage, costs, and coverage against relevant threats, analysts can confidently identify opportunities to reduce costs, improve security posture, and see value more quickly. 

• Copilot for Security: Copilot empowers security teams to make informed decisions in the SOC to protect at the speed and scale of AI. It offers skills to translate natural language to Kusto Query Language (KQL), accelerate incident investigation and response by automating manual tasks with customizable promptbooks, summarizes incidents with full context, helps prevent breaches with dynamic insights from Microsoft Threat Intelligence, and more. 

• Enhanced incident experience: The new incidents page experience provides more context for SOC analysts to efficiently triage, investigate, and respond quickly to incidents. Many new investigation, response, and incident management features offer the analysts the information and tools necessary to understand the incident and full scope of the breach while making navigation easy and context switching less frequent. New features include top insights, a new activity log for incident audits, a Log Analytics query window to investigate logs and more. 

Download the complimentary report to get more details on our positioning as a Leader. Our customers and partners have been an invaluable part of this multiyear journey. We owe our immense gratitude to you. 

Microsoft is here to help customers who may be re-evaluating their SIEM due to vendor acquisition and are looking to move to a market leader with an ongoing commitment to innovation.

Looking forward 

In 2024 we’ll continue to listen to customer needs and further enhance Microsoft Sentinel’s advanced threat-protection capabilities to empower defenders and drive efficiencies for SOC teams.  

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity

¹Gartner® Magic Quadrant™ for Security Information and Event Management, Andrew Davies, Mitchell Schneider, Rustam Malik, Eric Ahlm, May 8 2024.

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 

Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences with the vendors listed on the platform, should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose. 

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Microsoft. 

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved. 

²The Total Economic Impact™ of Microsoft Sentinel, a commissioned study conducted by Forrester Consulting on behalf of Microsoft. Results are for a composite organization based on interviewed customers. 

The post Microsoft is again named a Leader in the 2024 Gartner® Magic Quadrant™ for Security Information and Event Management​​ appeared first on Microsoft Security Blog.

And last month at Microsoft Secure, we added unified exposure management capabilities that provide continuous, proactive end-to-end visibility of assets and cyberattack paths. Together, these fully integrated, comprehensive capabilities give security leaders and SOC teams what they need to manage cyberthreats across their organization—from prevention to detection and response.

After gaining insights from the initial customer feedback, we are excited to expand the platform’s availability to public preview. Customers with a single Microsoft Sentinel workspace and at least one Defender XDR workload deployed can start enjoying the benefits of a unified experience, in a production environment, now. Onboarding a Microsoft Sentinel workspace only takes a few minutes, and customers can continue to use their Microsoft Sentinel in Azure. Need another reason to get started today? Microsoft Sentinel customers using Microsoft Copilot for Security can now leverage the embedded experience in the Defender portal, helping them to level up their security practice further.

Unified security operations platform

The new platform brings together the capabilities of XDR and SIEM. Learn how to onboard your Microsoft Sentinel workspace to the Microsoft Defender portal.

Get started today

Knock down security silos and drive better security outcomes

SOCs are buried under mountains of alerts, security signals, and initiatives. Analysts are spending too much time sifting through low-level alerts, jumping between portals, and navigating complex workflows to understand what happened, how to resolve it, and how to prevent it from happening again. This leaves little time for analysts to focus on high-value tasks—like remediating multistage incidents fully or even decreasing the likelihood of future attacks by reducing the attack surface. With an ever-growing gap in supply and demand of talent—in fact, there are only enough cybersecurity professionals to meet 82% of the United States demand—something must change.¹ 

At the heart of this challenge is siloed data—SOCs have too much security data stored in too many places and most SOC teams lack the tools to effectively bring it all together, normalize it, apply advanced analytics, enrich with threat intelligence, and act on the insights across the entire digital estate. This is why we built the security operations platform—by bringing together the full capabilities of SIEM, XDR, exposure management, generative AI, and threat intelligence together, security teams will be empowered with unified, comprehensive features that work across use cases, not security tool siloes.

The new analyst experience is built to create a more intuitive workflow for the SOC, with unified views of incidents, exposure, threat intelligence, assets, and security reporting. This is a true single pane of glass for security across your entire digital estate. Beyond delivering a single experience, unifying these features all on one platform delivers more robust capabilities across the entire cyberattack lifecycle.

“Security teams need a single pane of glass to manage today’s IT environments. Long gone are the days when teams could operate in silos and protect their environments. With today’s announcement Microsoft is moving another step forward in helping businesses protect their systems, customers and reputations,” said Chris Kissel, IDC Research Vice President, Security and Trust. “Microsoft combining the full capabilities of an industry-leading cloud-native SIEM and XDR with the first generative AI built specifically for cybersecurity is a game changer for the industry.”  

Capabilities across Microsoft Sentinel and Microsoft Defender XDR products are now extending, making both Microsoft Sentinel and Defender XDR more valuable. XDR customers can now enjoy more flexibility in their reporting, their ability to deploy automations, and greater insight across data sources. With the new ability to run custom security orchestration, automation, and response (SOAR) playbooks on an incident provided by Microsoft Sentinel, Defender XDR customers can reduce repetitive processes and further optimize the SOC. They can also now hunt across their XDR and SIEM data in one place. Further, XDR detection and incident creation will now open to data from SIEM. SIEM customers can now get more out of the box value, improving their ability to focus on the tasks at hand and gain more proactive protection against threats, freeing them to spend more time on novel threats and the unique needs of their environment.

Prevent breaches with end-to-end visibility of your attack surface

During the past 10 years, the enterprise attack surfaces have expanded exponentially with the adoption of cloud services, bring-your-own device, increasingly complex supply chains, Internet of Things (IoT), and more. Approximately 98% of attacks can be prevented with basic cybersecurity hygiene, highlighting the importance of hardening all systems.² Security silos make it more difficult and time-consuming to uncover, prioritize, and eliminate exposures.

Fortunately, the Microsoft Security Exposure Management solution, built right into the new unified platform experience, consolidates silos into a contextual and risk-based view. Within the unified platform, security teams gain comprehensive visibility across a myriad of exposures, including software vulnerabilities, control misconfigurations, overprivileged access, and evolving threats leading to sensitive data exposure. Organizations can leverage a single source of truth with unified exposure insights to proactively manage their asset risk across the entire digital estate. In addition, attack path modeling helps security professionals of all skill levels predict the potential steps adversaries may take to infiltrate your critical assets and reach your sensitive data.

Shut down in-progress attacks with automatic attack disruption

In today’s threat landscape, where multistage attacks are the new normal, automation is no longer optional, but a necessity. We’ve seen entire ransomware campaigns that only needed two hours to complete, with attackers moving laterally in as little as five minutes after initial compromise—the median time for attackers to access sensitive data is only 72 minutes.³ This capability is essential to counter the rapid, persistent attack methods like an AKIRA ransomware attack. Even the best security teams need to take breaks and with mere seconds separating thousands versus millions of dollars spent on an attack, the speed of response becomes critical.

This platform harnesses the power of XDR and AI to disrupt advanced attacks like ransomware, business email compromise, and adversary-in-the-middle attacks at machine speed with automatic attack disruption, a game-changing technology for the SOC that remains exclusive to Microsoft Security. Attack disruption is a powerful, out-of-the-box capability that automatically stops the progression and limits the impact of the most sophisticated attacks in near real-time. By stopping the attack progression, precious time is given back to the SOC to triage and resolve the incident.

Attack disruption works by taking a wide breadth of signals across endpoints and IoT, hybrid identities, email and collaboration tools, software as a service (SaaS) apps, data, and cloud workloads and applying AI-driven, researcher-backed analytics to detect and disrupt in-progress attacks with 99% confidence.³ With more than 78 trillion signals fueling our AI and machine learning models, we can rapidly detect and disrupt prominent attacks like ransomware in only three minutes, saving thousands of devices from encryption and recovery costs. Using our unique ability to recognize the intention of the attacker, meaning accurately predict their next move, Microsoft Defender XDR takes an automated response such as disabling a user account or isolating a device from connecting to any other resource in the network. 

Built on the attack disruption technology in our Defender XDR solution, our unified platform now extends this dynamic protection to new solutions through Microsoft Sentinel—starting with SAP. When an SAP account attack is detected, our platform will automatically respond to cut off access in SAP. This means unprecedented protection for a platform that houses incredibly sensitive data, making it a prime target for attackers.

Investigate and respond faster

Multiple dashboards and siloed hunting experiences can really slow down the meantime to acknowledge and respond. The effectiveness of the SOC is measured by these critical metrics. Microsoft delivers a single incident queue, equipped with robust out-of-the-box rules, that saves time, reduces alert noise, and improves alert correlation, ultimately delivering a full view of an attack. During our private preview, customers saw up to an 80% reduction in incidents, with improved correlation of alerts to incidents across Microsoft Sentinel data sources, accelerating triage and response.⁴ Further, unified hunting helps customers to reduce investigation time by eliminating the need to know where data is stored or to run multiple queries on different tables.

We’re not stopping at automatic attack disruption and unified incident queues—we’re on a mission to uplevel analysts of all experience levels. Microsoft Copilot for Security helps security analysts accelerate their triage with comprehensive incident summaries that map to the MITRE framework, reverse-engineer malware, translate complex code to native language insights, and even complete multistage attack remediation actions with a single click.

Copilot for Security is embedded in the analyst experience, providing analysts with an intuitive, intelligent assistant than can guide response and even create incident reports automatically—saving analysts significant time. Early adopters are seeing their analysts move an average of 22% faster and accelerate time to resolution.⁵ Copilot for Security is more than a chatbot—it’s a true intelligent assistant built right into their workflow, helping them use their tools better, level up their skills, and get recommendations relevant to their work at hand.

If you’d like to join the public preview, view the prerequisites and how to connect your Microsoft Sentinel workplace.

Learn more

Learn more about Microsoft SIEM and XDR solutions.

Cybersecurity and AI news

Discover the latest trends and best practices in cyberthreat protection and AI for cybersecurity.

Get the latest resources

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Cybersecurity Supply and Demand Heat Map, CyberSeek. 2024.

²Microsoft Digital Defense Report, Microsoft. 2023.

³Microsoft Digital Defense Report, Microsoft. 2022.

⁴Microsoft Internal Research.

⁵Microsoft Copilot for Security randomized controlled trial (RCT) with experienced security analysts conducted by Microsoft Office of the Chief Economist, January 2024. 

The post Get end-to-end protection with Microsoft’s unified security operations platform, now in public preview appeared first on Microsoft Security Blog.

To protect your entire multicloud, multiplatform digital estate, consider Microsoft Sentinel, a modern, comprehensive SIEM solution built on the cloud and enriched by AI to rapidly uncover sophisticated cyberthreats and respond at machine speed. Microsoft Sentinel offers a complete security operations solution that is powerful, highly efficient and economic than other SIEM solutions.

To evaluate the benefits of Microsoft Sentinel, Microsoft commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study. Using the methodology of the TEI framework, Forrester consultants evaluated the cost, benefits, and flexibility of Microsoft Sentinel and developed a framework that organizations can use to evaluate the potential financial impact on their organizations.

In this study, Forrester found that interviewees achieved some notable advantages from their investment in Microsoft Sentinel, including increasing the productivity of their security teams, simplifying operations, decreasing their total cost of ownership, and realizing a return on investment (ROI) of 234%. Here are some other major findings for a composite organization based on what interviewed organizations reported.

1. Reducing time-to-value compared to other SIEM solutions 

Deploying Microsoft Sentinel—and finessing it after implementation—is faster because of the solution’s prebuilt playbooks, automation, and other SIEM tools. Microsoft Sentinel reduced the time to configure and deploy new connections by 93%, with time saved in configuration valued at $618,000 during the three-year period Forrester analyzed.  

“It took us about five years to get to be a six terabyte on-prem customer [with out previous solution]. It took us two months to set up Microsoft Sentinel and another two months to be at data-ingestion parity. It was insane.”

—CISO, financial services

This out-of-the-box functionality also includes simplified data connections and integrations that make it easier and faster to connect Microsoft Sentinel with your non-Microsoft systems, saving the time that employees might otherwise spend doing integration work. Valuable connections can be made across users, devices, apps, and infrastructure. Find even more integrations with Copilot for Security. 

2. Increasing the efficiency of the SOC 

Microsoft Sentinel makes it easier for security practitioners at all levels of expertise to detect, investigate, and respond effectively to cyberthreats. The solution harnesses an AI-driven correlation engine and offers a unified set of tools to more easily monitor, manage, and respond to incidents. Those interviewed praised Microsoft Sentinel’s interface for being easy to use (no specialized security expertise necessary). Because of Sentinel’s process automation, security professionals with less IT knowledge can effectively use the platform to detect and respond to cyberthreats.  

The total value of efficiency improvements to the security operations center of a composite organization was $1.5 million over three years. The solution is intuitive enough to use that junior analysts can tackle investigation basics while senior analytics tackle higher-priority tasks, according to Forrester findings. A prebuilt playbook helps further.  

Microsoft Sentinel capabilities, including its behavior-based analytics, enable you to boost the mean time to respond (MTTR) as you decrease false positives and minimize the work required of advanced investigations. In fact, Forrester found that Microsoft Sentinel helped to reduce false positives by up to 79% and decrease the work required for advanced, multitouch investigations by 85%. These are critical metrics when every second counts in triage and response.

“The reason we have Microsoft Sentinel is because of its proactive predictive abilities. It is able to respond to threats faster than a human can. We actually were able to stop significant threats that hit other organizations and keep our organization running. Microsoft Sentinel was one of the tools in our Microsoft tool bag that really kept us running as an organization. It kept our operations running.”

—CISO, healthcare

3. Reduce total cost of operation 

Implementing Microsoft Sentinel offers several cost savings opportunities, according to interviewees. One quantified benefit from the study found that the composite organization’s potential cost savings gained by discounting their current legacy SIEM solution and switching to Microsoft Sentinel could account for realized savings of up to $5.1 million over three years. This is attributed to Microsoft Sentinel’s lower per-GB data ingestion and licensing costs that enables customers to avoid the capital investments necessary to store logs on-premises. 

Microsoft Sentinel offers smoother deployment because of its prebuilt playbooks, queries, data connections, and free ingestion for certain Microsoft logs including Office 365 audit logs, Azure activity logs, and Microsoft Threat Protection alerts. The more intuitive nature of Microsoft Sentinel makes it easier to onboard employees to the technology.  

“Compared to [our on-premises solution] when we were paying for infrastructure, the savings are significant. Essentially one year of [legacy solution] costs are three years of Microsoft Sentinel costs.”

—CISO, financial services

Interviewees also shared that Microsoft Sentinel helped them decrease compliance costs. They did this by streamlining compliance reporting through the automation capabilities of Sentinel for security data collection and analysis. The alternative option would likely have been to bring in external consultants.  

4. Minimizing management effort 

In interviews with management teams at the organizations, they reported saving time on planning and maintenance, allowing for more time on other critical projects. That’s due to the way the solution decreased the size and complexity of their on-premises infrastructure. The value of this reduced management amounts to $1.1 million for a composite organization over three years and enabled the redeployment of 50% of infrastructure services professionals and 16% of legacy SIEM specialists. Automatic updates and the platform’s intuitive and centralized nature contribute to lessening the demand for labor.  

“In the raw maintenance of the SIEM, it’s pretty hands off. When there is an issue, we open up a case with Microsoft and they assume the burden of trying to fix the issue. I don’t have to maintain staff for that anymore.”

—CISO, financial services

The advantages of Microsoft Sentinel 

With its modern, cloud-native features and innovations, Microsoft Sentinel has helped organizations like yours deploy faster, increase the efficiency of their threat investigations, save on deployment and training, and gain efficiency in security management. Explore the Total Economic Impact™ Of Microsoft Sentinel Study for more analyst findings as well as to read the perspectives of Sentinel users interviewed in the study.

And to learn more about Microsoft Security, see:

• Unified security operations center platform.
• Microsoft Secure announcements.
• Microsoft Sentinel innovations.

Microsoft Sentinel

See and stop cyberthreats across your entire enterprise with intelligent security analytics.

Learn more

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders. 

The post Microsoft Sentinel delivered 234% ROI, according to new Forrester study appeared first on Microsoft Security Blog.

IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of ICT suppliers in a given market. The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each vendor’s position within a given market. The Capabilities score measures vendor product, go-to-market and business execution in the short-term. The Strategy score measures alignment of vendor strategies with customer requirements in a 3-5-year timeframe. Vendor market share is represented by the size of the icons. 

Microsoft Defender for Endpoint is a comprehensive enterprise endpoint security platform that helps organizations secure their digital estate across Linux, macOS, Windows, iOS, Android, and Internet of Things (IoT). It provides AI-powered, industry-leading endpoint detection and response that is core to Microsoft Defender XDR that enables organizations to build a holistic approach with full visibility and signal correlation across security domains. Built on the industry’s broadest threat intelligence informed by more than 65 trillion daily signals and over 10,000 security experts, Defender for Endpoint empowers security teams to fend off sophisticated threats. With the scale and sophistication of enterprise device security in mind, these are some of the ways Defender for Endpoint uniquely empowers analysts:  

• Automatically disrupt ransomware: Terminate sophisticated cyberthreat campaigns like ransomware, business email compromise and adversary-in-the-middle early in the kill chain with automatic attack disruption — an industry-first, Microsoft-patented capability that helps you outmaneuver attackers.  
• Move at machine speed with Security Copilot: Use the industry’s first generative AI security product, embedded in Defender for Endpoint, that enables analysts to use natural language to speed up daily tasks such as investigating and responding to incidents, prioritizing alerts, and upskilling. 
• Put security posture into action: Your best offense is a secure defense, made possible with built-in vulnerability management capabilities like Microsoft Secure Score. Improve the collective security configuration state of your devices with in-console, prioritized recommendations optimized to reinforce best practices across the application, operating system, network, accounts, and controls. Validate your ideal configuration levels against benchmarks collected from vendors, security feeds, and Microsoft Security’s research teams. 
• Catch adversaries early on: Create early-stage, high-fidelity signals that force adversaries to be correct 100% of the time with built-in deception techniques and automatically generate and disperse decoys and lures at scale that resemble real users and assets in your organization. 

Small and medium businesses (SMBs) face an even more challenging landscape—with increasing cyberthreats, coupled with even more limited security staff or expertise. Built on the principle that SMBs need a similar level of protection as enterprises, Microsoft Defender for Business brings many enterprise-grade capabilities from Defender for Endpoint in a simplified and affordable package for organizations with 1-300 employees. Key capabilities for Defender for Business include endpoint detection and response (EDR) with industry first attack disruption, vulnerability management, attack surface reduction (ASR), next-generation antivirus, and automated investigation and response. It supports platforms such as Windows, MacOS, Android, iOS, and Linux. Many features have been optimized for SMBs and include: 

• Quickly and easily onboard your devices: Wizard-based onboarding gets you up and running quickly with out-of-the-box security policies that are “on by default” and a simplified management experience makes it easy for even non-technical users to manage security operations.  
• Get peace of mind with automatic attack disruption: AI-powered attack disruption helps automatically contain ransomware attacks by limiting lateral movement from compromised users or devices. This capability is on-by default, so it is easy for SMBs to stay protected. 
• Protect mobile devices from one solution: You can onboard iOS and Android onto Defender for Business without requiring additional device management solutions or costly add-ons. 
• Share security insights in a simple format: Monthly security summary reports help you better understand the security status of your identity, devices, data, and applications by seeing threats prevented and detected and recommendations to strengthen your security posture. 

Defender for Business is available as a standalone and as part of the Microsoft 365 Business Premium suite. Microsoft 365 Business Premium brings together Office apps, Microsoft 365 services and Teams, with comprehensive security. In addition to ransomware protection with Defender for Business, other key security capabilities include identity and access protection with Microsoft Entra ID Plan 1, safeguarding against phishing attacks and malware in email, OneDrive and Teams with Defender for Office 365, data protection with Microsoft Purview Information Protection, and device management with Microsoft Intune.  

Many SMB customers also rely on Managed Service Provider (MSP) partners to secure their environments. In recognition of the key role that partners play in serving SMB customers, Microsoft has made product investments to help enable partners to deliver security services at scale:

• Manage multiple customers in one place with Microsoft 365 Lighthouse: View security incidents and alerts, create and apply security baselines across all customers, and configure customized email alerts for delivery to users, groups, or third-party ticketing systems such as Professional Services Automation (PSA) systems. 
• Build out your security services: Use streaming APIs to stream device events for advanced hunting and attack disruption.  
• Integrate with 3rd party Managed Detection and Response services: Many MSPs do not have the in-house security resources to build their own security operations center (SOC). Integrate with leading Managed Detection and Response (MDR) services such as Blackpoint Cyber and ConnectWise.   

Learn More

Read more about our comprehensive set of security solutions for enterprise, midsize, and small business.  

• Microsoft Defender for Endpoint, Microsoft’s industry-leading, cloud-powered endpoint security solution offering vulnerability management, endpoint protection, EDR, and mobile threat defense. Sign up for a free trial today. 
• Microsoft Security solutions for SMBs, including Microsoft Defender for Business and Microsoft 365 Business Premium, offering enterprise-grade endpoint protection powered by AI—designed especially for businesses with up to 300 employees.  
• Partners can learn more about building managed services with Microsoft Defender for Business and Microsoft 365 Business Premium through our MDB Partner Kit and BP Partner Playbook. 
• Watch to see how Defender for Business and Microsoft 365 Business Premium can protect your business. 

You can also download the excerpts of the following reports for more details: 

[2]- IDC MarketScape: Worldwide Modern Endpoint Security for Enterprises 2024 Vendor Assessment (doc #US50521223, January 2024) 

[3]- IDC MarketScape: Worldwide Modern Endpoint Security for Midsize Businesses 2024 Vendor Assessment (doc #US50521323, February 2024) 

[4]- IDC MarketScape: Worldwide Modern Endpoint Security for Small Businesses 2024 Vendor Assessment (doc #US50521424, March 2024)  

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

Reference 

[1]- Microsoft Digital Defense Report, Microsoft. 2023. 

2 Likes

 Like

The post ​​Microsoft named as a Leader in three IDC MarketScapes for Modern Endpoint Security 2024 appeared first on Microsoft Security Blog.

At Microsoft Ignite 2023, we announced that we’re bringing Microsoft Sentinel, which delivers intelligent security analytics and threat intelligence, and Microsoft Defender XDR, our extended detection and response (XDR) solution, into a unified security operations platform—providing more comprehensive features, automation, guided experiences, and curated threat intelligence.

• During the session “Microsoft Sentinel: A modern approach to security operations,” we explored the SOC capabilities of Microsoft Sentinel, our scalable, cloud-native solution that provides both security information and event management (SIEM) and security orchestration, automation, and response (SOAR).
• And during the session “Unifying XDR + SIEM: A new era in SecOps,” we discussed the latest technology around Microsoft’s integrated SIEM and XDR solution and how it can protect your environment and protect you from adversaries.
• In both sessions, we shared that Microsoft Security Copilot is an embedded experience in the platform, benefiting organizations with its generative AI capabilities.

But what does it mean to combine multiple cybersecurity tools in one unified security operations platform, and how can it benefit your modern SOC? Throw our generative AI solution Microsoft Security Copilot into the mix and the platform is truly transformative. In this blog post, you’ll learn three ways that a unified security platform—like how we combine Microsoft Sentinel, Security Copilot, and Defender XDR—can strengthen your cybersecurity and support your security team in their important work.

Microsoft Sentinel

See and stop cyberthreats across your entire enterprise with intelligent security analytics.

Learn more

What is a unified SOC platform?

A unified SOC platform is a fully integrated toolset for security teams to prevent, detect, investigate, and respond to threats across their entire environment. For Microsoft, this means delivering the best of SIEM, XDR, posture management, and threat intelligence with advanced generative AI as a single platform. Our objective is to empower security teams to protect more, easily, because we recognize the numerous challenges you face as security teams.

This empowers you to better protect your organization and all its components—including hybrid identities, endpoints, cloud apps, business apps, email and docs, Internet of Things (IoT), network, business applications, operational technology (OT), infrastructure, and cloud workloads—with the capabilities of a unified security platform. And this enables you to protect all that more efficiently. Ours is the only unified security operations platform that delivers full SIEM and XDR capabilities.

1. Unify your insights

A major challenge of a non-unified approach to cybersecurity is that your data is scattered across multiple security tools and logs. This presents a stumbling block when trying to extract insights from data in a timely enough manner to better anticipate cyberthreats and defend against them. Another hurdle of not having a unified solution is that it’s almost impossible to view how a cyberattacker moves across vectors. Since cyberattackers can move laterally, it’s imperative to detect them quickly.¹

By unifying hunting, incidents, data models, and other threat protection capabilities across SIEM and XDR, you can search everything in one place—no need to remember where data is stored, run two different search queries, or normalize data across tools. Unified incidents give you a holistic view of all threats since all your information is in one place, meaning more threat intelligence. The result of gaining this insight into what is happening in your organization is saved analyst time and higher confidence in your protection.

Keep your organization safe while your analysts benefit by maintaining their focus on risk signs, spending less time correlating alerts, and speeding the mean time to repair. Time is of the essence when you are keeping your organization safe, and a unified solution equips analysts to stay in front of cyberattacks. 

2. Gain more out-of-the-box protection

With a unified approach, you get the best of both worlds. Gain all the flexibility of a SIEM with the depth of protection and out-of-the-box value of an XDR. This flexibility aspect begins with your choice of how you implement a unified platform, doing so in a way that works for your needs, priorities, and budget. When your available security capabilities expand across multiple solutions in a platform, your organization stays safer as you gain storage flexibility and automatic attack disruption. 

Plus, SOC optimization is a new feature that provides recommendations to ensure you are maximizing the security value; for instance, storing data at the most affordable log tier, getting detections on all your data, and maintaining strong posture.

Once you implement a unified platform, look for one that offers flexibility in data storage and security features. With Microsoft Sentinel data storage, you have flexibility in data retention, with a default of 90 days when data is ingested here. Expanding Microsoft Defender XDR’s unique attack disruption to data being introduced through Microsoft Sentinel, starting with SAP®, increases your immunity to cyberattacks, “freezing” cyberattacks before they can move across your organization.  

3. Empower and uplevel threat investigation with generative AI

With the number and complexity of cyberattacks increasing, security teams can feel overwhelmed. That’s where AI assistance can come into play, detecting the threats that might be missed by security teams. A unified platform that includes generative AI can help your security team achieve better security outcomes. For example, generative AI can assist with guided investigations, hunting with natural language, and easy summaries.  

Microsoft Security Copilot, our generative AI-powered security solution, is available for additional purchase to further strengthen the unified SOC platform. Security Copilot harnesses AI to support analysts with complex and time-consuming daily workflows, including:

• End-to-end incident investigation and response with clearly described cyberattack stories.
• Step-by-step actionable remediation guidance.
• Incident activity summarized reports, natural language Kusto Query Language (KQL) hunting, and expert code analysis—optimizing on SOC efficiency across Microsoft Sentinel and Defender XDR data. 

Security Copilot makes it easier than ever for seasoned professionals to take every necessary security step, speed up tasks like writing KQL and decoding scripts, and helps uplevel new employees with intuitive, step-by-step guidance.

Try Microsoft’s unified SOC platform for yourself

Protect yourself without significant setup or additional work required. You can gain the out-of-the-box integration of SIEM and XDR, expanded attack disruption onto your SAP data, and the breadth of Microsoft Sentinel’s out-of-the-box, customizable content (more than 300 pieces of content!).

The pricing of Microsoft Defender XDR and Microsoft Sentinel and business model will remain the same; if you use both, you’ll continue to enjoy your benefits. A recently announced SIEM migration tool will simplify and accelerate migrations to Microsoft Sentinel.

If a unified platform approach to modern SecOps sounds intriguing, make sure you have Microsoft Sentinel, Defender XDR, and Security Copilot and can benefit from a comprehensive security approach. Contact us for more information.

Learn more

Learn more about Microsoft Sentinel and Microsoft Defender XDR.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹The SOC’s Future Is a Security Platform, Darkreading. December 4, 2023.

The post Unified security operations with Microsoft Sentinel and Microsoft Defender XDR appeared first on Microsoft Security Blog.

Today we are excited to announce that Gartner has named Microsoft a Leader in the 2023 Gartner^® Magic Quadrant™ for Endpoint Protection Platforms. We believe this recognition showcases Microsoft’s continued progress and excellence in helping organizations protect their endpoints against even the most sophisticated attacks and driving continued efficiency for SOC teams.

Microsoft Defender for Endpoint is an endpoint security platform that helps organizations secure their digital estate using AI-powered, industry-leading endpoint detection and response across all platforms, devices, and Internet of Things (IoT). It is core to Microsoft Defender XDR. Built on the industry’s broadest threat intelligence informed by more than 65 trillion daily signals and over 10,000 security experts, it empowers security teams to fend off sophisticated threats.¹

Figure 1. Gartner^® Magic Quadrant^TM for Endpoint Protection Platforms. Source: Gartner (December 2023).

Microsoft’s leadership in endpoint security reflects the close partnership forged with customers that has shaped our product development and innovation. Recent highlights include:

• Elevate your security posture: An organization’s best offense is a secure defense. Key to minimizing threat exposure is a combination of simplified security settings management to curtail misconfigurations (generally available as of November 2023), proactive vulnerability management to harden your defenses, and next-generation antivirus to neutralize malware at the perimeter. Defender for Endpoint is unique in providing built-in posture assessments and vulnerability management capabilities that continually evaluate an organization’s security posture and prioritizes remediation suggestions. Other security vendors treat these capabilities as a separate product that must be integrated, further burdening organizations that require such protections up front. Additionally, Defender for Endpoint’s next-generation antivirus, which has been tested and recognized in various industry tests, such as the 2023 MITRE Engenuity ATT&CK® Evaluations, fortifies the strong prevention stack to protect against endpoint-based threats.

• Protect against the most sophisticated threats: Drawing on vast threat intelligence informed by 65 trillion daily signals and more than 10,000 security experts around the globe, Microsoft possesses a unique vantage point on the emerging threat landscape.¹ Microsoft Defender XDR’s industry-first automatic attack disruption capability reflects this distinctive position, harnessing the seamless integration across the workloads (identities, endpoints, email, and software as a service [SaaS] apps) to disrupt advanced cyberthreats such as ransomware, business email compromise, and attacker-in-the-middle with high confidence. Attack disruption has rapidly evolved to now stopping human-operated attacks, on average within 3 minutes, with just Defender for Endpoint. Coupled with the new deception capabilities introduced in November 2023, automatic attack disruption can disrupt threat campaigns even earlier with the high-fidelity signal.

• Secure all devices across the enterprise: Defender for Endpoint continued to expand its coverage with network detection and enterprise IoT devices included at no added cost as a part of Microsoft 365 E5 and E5 Security plans. Cross-platform enhancements across macOS, Linux, and Windows regularly roll out, keeping customers at the forefront of available protections.

Endpoint security is at the core of the Microsoft Defender suite. The following recent innovations reinforce Microsoft’s leadership in helping SOCs scale protection and efficiency on a platform level.

• See and act on a complete view of the digital threat landscape with an AI-powered, unified security operations platform: In November 2023, we announced the industry’s first unified platform that will help close the talent gap for security and data professionals and accelerate SOC efficiency. Defender for Endpoint is core to this platform. It combines “the power of leading solutions in security information and event management (SIEM), extended detection and response (XDR), and generative AI for security.” By working seamlessly across Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Security Copilot, security analysts only need to work with a single set of automation rules and playbooks. Plus, they only need to use plain language to execute complex tasks in an instant with Security Copilot embedded in the platform.

• Give your security team coverage with around-the-clock access to Microsoft expertise: Recognizing that sophisticated threats go beyond the endpoint, Microsoft introduced Microsoft Defender Experts for XDR. This managed service is available 24 hours a day, 7 days a week, helping organizations extend their SOC team to fully triage events and respond to incidents across domains.

Download the complimentary report to get more details on our positioning as a Leader. Our customers and partners have been an invaluable part of this multiyear journey. We owe our immense gratitude to you.

Unmatched customer impact defending against ransomware

With capabilities unique to Microsoft Defender such as automatic attack disruption, the odds are starting to tilt in favor of defenders. For example, in August 2023, hackers compromised the devices of a medical research lab. With lives and millions of dollars in research at stake, the potential reward for hackers to encrypt the devices and demand a ransom was high. Automatic attack disruption immediately shut them out from accessing any of the lab’s devices. And the security analysts didn’t even have to lift a finger.

Thanks to the invaluable partnership and insights from organizations of all sizes around the globe, Microsoft has been named a Leader in every Gartner^® Magic Quadrant^TM for Endpoint Protection Platforms report since 2019. In 2024 customers will continue to see leading innovation as we further build on a strong foundation of AI-enabled capabilities to empower defenders and drive efficiencies for SOC teams with more automated disruption of advanced threats, Microsoft Security Copilot supported tasks, and more.

Are you a regular user of Microsoft Defender for Endpoint? Review your experience on Gartner Peer Insights™ and get a $25 gift card. 

Microsoft Defender for Endpoint

Protect every layer of your environment with a unified security operations platform embedded with Microsoft Security Copilot.

Learn more

Learn more

We know that diving deep into how a solution really works is key to making any investment. If you are not yet taking advantage of Microsoft’s leading endpoint security solution, visit Microsoft Defender for Endpoint and start a free trial today to start evaluating the leading endpoint protection platform.

Cybersecurity and AI news

Discover the latest trends and best practices in cyberthreat protection and AI for cybersecurity.

Get the latest resources

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Microsoft Digital Defense Report, Microsoft. 2023.

Gartner, Magic Quadrant for Endpoint Protection Platforms, Evgeny Mirolyubov, Max Taggett, Franz Hinner, Nikul Patel, 31 December 2023.

Gartner is a registered trademark and service mark and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Microsoft.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The post Microsoft is named a Leader in the 2023 Gartner® Magic Quadrant™ for Endpoint Protection Platforms appeared first on Microsoft Security Blog.