{"id":112794,"date":"2022-05-03T09:00:00","date_gmt":"2022-05-03T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=112794"},"modified":"2023-05-15T22:58:34","modified_gmt":"2023-05-16T05:58:34","slug":"automating-your-microsoft-security-suite-with-d3-smart-soar","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/","title":{"rendered":"Automating your Microsoft security suite with D3 Smart SOAR   \u00a0"},"content":{"rendered":"\n<p><em><strong>Updated 3\/31\/2023<\/strong>: Since this blog was originally published, D3 Security changed the name of XGEN SOAR to Smart SOAR. This blog has been updated to reflect the new product name.<\/em><\/p>\n\n\n\n<p><em>This blog post is part of the Microsoft Intelligent Security Association <\/em><a href=\"https:\/\/aka.ms\/MISAguestblog\"><em>guest blog series<\/em><\/a><em>. <\/em><a href=\"https:\/\/aka.ms\/MISA\"><em>Learn more about MISA<\/em><\/a><em>.<\/em><\/p>\n\n\n\n<p>There are certain pain points in the average security operations center (SOC) that, no matter what else changes in the security landscape, stay among the most entrenched problems. You can probably name them off the top of your head: an overwhelming amount of security alerts; the ongoing shortage of skilled cybersecurity professionals; the inability to detect and respond to increasingly sophisticated attacks; and the proliferation of tools (76 in the average enterprise SOC) that do not always work well together.<sup>1<\/sup>&nbsp;But these challenges have something else in common other than being the primary causes of headaches among security pros: they are all alleviated by security orchestration, automation, and response\u2014better known as SOAR.<sup>2<\/sup>&nbsp;Learn how D3 Security&#8217;s Smart SOAR integrates with <a href=\"https:\/\/azure.microsoft.com\/services\/microsoft-sentinel\/\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Sentinel<\/a> and hundreds of other tools to help customers overcome SOC Analyst fatigue and disparate toolsets in this blog post.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is SOAR?&nbsp;<\/h2>\n\n\n\n<p>Let\u2019s start with the basics. <a href=\"https:\/\/www.microsoft.com\/security\/business\/security-101\/what-is-soar\">SOAR<\/a> is a category of powerful tools that integrate with other security systems, such as <a href=\"https:\/\/www.microsoft.com\/security\/business\/security-101\/what-is-siem\">security information and event management (SIEM)<\/a>, endpoint detection and response (EDR), and firewalls, to ingest alerts, enrich them with contextual intelligence, and orchestrate remediation actions across the environment. SOAR tools use playbooks to automate and codify workflows to accelerate mean time to respond (MTTR) and standardize responses to common incident types.&nbsp;<\/p>\n\n\n\n<p>D3 Smart SOAR is a fully vendor-agnostic SOAR solution, which means it can maintain dozens of deep integrations with Microsoft tools\u2014including Sentinel\u2014and bring automation to security workflows in any environment.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Microsoft Sentinel customers use D3\u2019s Event Pipeline to stay focused on real threats&nbsp;<\/h2>\n\n\n\n<p>What does integrating D3 Smart SOAR with Microsoft tools mean for customers? Let\u2019s take one narrow example and look at how D3\u2019s Event Pipeline\u2014a unique offering among SOAR platforms\u2014acts on Microsoft Sentinel events to make the lives of security analysts much easier.<sup>3<\/sup>&nbsp;<\/p>\n\n\n\n<p>D3 ingests Microsoft Sentinel events for investigation and response. But as any SIEM operator knows, it is a delicate balance to configure your SIEM, and other alert-generating tools, so that you are capturing all the important incidents without an overwhelming amount of noise. That\u2019s where D3\u2019s Event Pipeline comes in.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"364\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture1-626992ce7767c-1024x364.png\" alt=\"The path of alerts through D3 XGEN SOAR, from the alert source to the incident response phase. D3's Event Pipeline covers the normalization, triage, and dismissal and escalation phases.\" class=\"wp-image-112824\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture1-626992ce7767c-1024x364.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture1-626992ce7767c-300x107.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture1-626992ce7767c-768x273.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture1-626992ce7767c.png 1430w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When a Microsoft Sentinel event comes into D3, it goes through the Event Pipeline, a global automated playbook that acts on every incoming event or alert from a detection tool. The Event Pipeline works in three stages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>First, the data from the incoming event is normalized. The artifacts, such as IP addresses, user IDs, and URLs, are extracted, and metadata tagging is performed.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Next is the triage stage. The event is deduplicated and correlated against other events. The artifacts are checked against integrated threat intelligence sources to determine risk, and MITRE ATT&amp;CK tactic, technique, and procedure (TTP) labels are applied.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the final stage, the Microsoft Sentinel event is either dismissed as a false positive or escalated and assigned to an analyst. Dismissal and escalation rules are set by the user, based on criteria such as the risk scores from threat intelligence enrichment or the presence of key assets in the artifacts.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>The result of adding D3\u2019s Event Pipeline to Microsoft Sentinel incident investigations is that 90 percent or more of Microsoft Sentinel events can be safely filtered out before they reach a human analyst, allowing the genuine threats to be properly investigated.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Microsoft integrations&nbsp;<\/h2>\n\n\n\n<p>D3\u2019s integration with Microsoft Sentinel is just one of 33 integrations between D3 Smart SOAR and Microsoft tools. Twenty-two of those integrations are from the Azure suite. Some of the key integrations for common security operations use cases include <a href=\"https:\/\/www.microsoft.com\/security\/business\/threat-protection\/endpoint-defender\">Microsoft Defender for Endpoint<\/a>, <a href=\"https:\/\/www.microsoft.com\/microsoft-365\">Microsoft 365<\/a>, and <a href=\"https:\/\/www.microsoft.com\/security\/business\/identity-access-management\/azure-active-directory\">Azure Active Directory<\/a> (Azure AD).&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Microsoft Defender for Endpoint&nbsp;<\/h3>\n\n\n\n<p>Microsoft Defender users can orchestrate 26 different actions from D3, including fetching events, enriching incidents with endpoint data, and quarantining infected hosts. This creates an automation-powered process for any endpoint security incident that acts quickly and conclusively before threats get out of control.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Microsoft 365&nbsp;<\/h3>\n\n\n\n<p>Phishing is still the entry point for most cyberattacks, which makes email a critical part of cybersecurity incident response. When a potential <a href=\"https:\/\/www.microsoft.com\/security\/business\/security-101\/what-is-phishing\">phishing email<\/a> is detected, D3 can retrieve the email and attachments, parse out the artifacts, check the reputations of the artifacts against threat intelligence and past incidents, and determine if the email is a genuine threat. If it is, D3 can then find other instances of the email across the company\u2019s inboxes and delete them.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Azure Active Directory&nbsp;<\/h3>\n\n\n\n<p>You may have heard it said that \u201cidentity is the new perimeter,\u201d which underscores the importance of being able to act quickly in Azure AD during a security incident. Companies using Azure AD (and on-premises AD) can enrich D3 incidents with user and group information, manage users and groups from D3, and quickly orchestrate remediation actions like forcing a password reset or revoking a sign-in session.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security orchestration for MSSPs&nbsp;<\/h2>\n\n\n\n<p>Managed security service providers (MSSPs) get similar benefits from D3 and Microsoft\u2019s joint solutions as <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/business\/security-101\/what-is-a-security-operations-center-soc\">SOCs<\/a> do, but at a greater scale.<sup>4<\/sup> At D3, they have found that MSSPs are not always given direct access to all their clients\u2019 tools, or they may not want to become experts in every single tool their clients use if all they\u2019re doing with those tools is managing alerts. Instead, clients give their MSSP access to D3, from which they can manage the alerts from all their detection tools from a single interface.&nbsp;&nbsp;<\/p>\n\n\n\n<p>This makes D3 a useful operations hub for MSSPs with clients that rely on Azure systems or other Microsoft tools. The MSSP can leverage D3\u2019s integrations with Microsoft Sentinel, Microsoft Defender for Endpoint, Microsoft 365, and others, to handle alerts and even orchestrate response actions\u2014without needing full access to their clients\u2019 tools.<sup>5<\/sup> The Event Pipeline is also a valuable tool in this scenario, allowing MSSPs to handle a much higher volume of alerts, without adding resources.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Better together: Use cases for Microsoft and D3 Smart SOAR&nbsp;<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Use case 1: Investigation and orchestration across hybrid environments&nbsp;<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"448\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture2-626993c6d466e-1024x448.png\" alt=\"A diagram of how D3 ingests alerts from cloud or on-premise sources, and orchestrates codeless playbooks across cloud or on-premise tools.\" class=\"wp-image-112827\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture2-626993c6d466e-1024x448.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture2-626993c6d466e-300x131.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture2-626993c6d466e-768x336.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture2-626993c6d466e.png 1430w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>More companies are moving their systems and servers to cloud services like Microsoft Azure, but many retain a hybrid environment, with some systems still hosted on-premises. This hybrid model creates an issue around security because the company is left managing two sets of security tools\u2014one in the cloud and one on-premises.&nbsp;<\/p>\n\n\n\n<p>D3 can integrate with Microsoft Sentinel, 21 other tools in the Azure stack, and hundreds of on-premise tools to create a single security operations (SecOps) interface for the entire hybrid environment. Joint users of Microsoft Sentinel and D3 can enrich alerts with threat intelligence, identify MITRE ATT&amp;CK techniques, run automation-powered playbooks to respond to incidents, and much more\u2014across cloud and on-premise systems simultaneously.&nbsp;<\/p>\n\n\n\n<p>For example, in a phishing attack that resulted in a potentially infected endpoint, an analyst using D3 could disable the user\u2019s access in Azure AD, query Microsoft Sentinel for additional data, search across Microsoft 365 mailboxes for more instances of the phishing email and quarantine the affected endpoint using Microsoft Defender for Endpoint.<sup>6<\/sup>&nbsp;<\/p>\n\n\n\n<p>Having D3 SOAR integrated with both your Azure tools and your on-premise tools can reduce your work\u2014and your risk\u2014by half. Because of the ability to monitor and act across your entire hybrid environment, you will not lose sight of incidents that move between environments, and you will always be able to execute your entire response without having to switch between tools.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Use case 2: Compromised credentials&nbsp;<\/h3>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"405\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture3-626993e89e9fd-1024x405.jpg\" alt=\"A diagram of how D3 ingests leaked credential reports, checks them against Active Directory, and orchestrates the appropriate response.\" class=\"wp-image-112830\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture3-626993e89e9fd-1024x405.jpg 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture3-626993e89e9fd-300x119.jpg 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture3-626993e89e9fd-768x304.jpg 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture3-626993e89e9fd-1536x607.jpg 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/04\/Picture3-626993e89e9fd.jpg 1586w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When an employee\u2019s credentials are compromised, hacked, or leaked, they can turn up on lists provided by threat intelligence platforms. Security teams need ways to streamline their ability to learn of compromised credentials, match the credentials to the employee\u2019s other information, determine which machines the credentials could be used on, and take action to prevent unauthorized access. D3 integrates with AD (Azure or on-premise), threat intelligence platforms, and other tools, to orchestrate this process.&nbsp;<\/p>\n\n\n\n<p>D3 can ingest lists of leaked credentials from integrated threat intelligence platforms. When an employee\u2019s credentials are included in a list, D3 can query Active Directory to match the credentials to other information related to the employee, including the list of machines to which they have access. D3 can get the user\u2019s login history from Active Directory to look for unusual activity, temporarily deactivate the user if necessary, and orchestrate a password change.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The sky\u2019s the limit&nbsp;<\/h2>\n\n\n\n<p>These are just a couple of the use cases that D3 users can orchestrate across their Microsoft tools and systems. With more than 30 integrations and hundreds of commands, there is an extremely high ceiling on what sophisticated users can accomplish with D3 and Microsoft\u2019s combined capabilities. Don\u2019t let that intimidate you though. With codeless, out-of-the-box playbooks for common incident types, even less technical users can immediately realize the benefits of the joint solutions.&nbsp;&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About D3 Security&nbsp;<\/h2>\n\n\n\n<p>D3 Security\u2019s Smart SOAR platform combines automation and orchestration across more than 500 integrated tools with an automated event pipeline that reduces event volume by 90 percent or more.<sup>2<\/sup> D3\u2019s codeless playbooks automate enrichment and remediation tasks while making it easy for anyone to build, modify, and scale workflows for security operations, incident response, and threat hunting.&nbsp;<\/p>\n\n\n\n<p>With more than 30 Microsoft integrations, D3 Security has been a Microsoft Intelligent Security Association (MISA) member since 2020. <a href=\"https:\/\/azuremarketplace.microsoft.com\/marketplace\/apps\/d3securitymanagementsystemsinc1599258630765.d3_next_gen_soar?tab=Overview\" target=\"_blank\" rel=\"noreferrer noopener\">Visit the Azure Marketplace page here.<\/a> You can learn more about how D3 works with Microsoft on D3\u2019s technology partners page.<sup>5<\/sup>&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Learn more<\/h2>\n\n\n\n<p>To learn more about MISA, visit&nbsp;<a href=\"https:\/\/www.microsoft.com\/security\/business\/intelligent-security-association\">our MISA website<\/a>&nbsp;where you can learn about the MISA program, product integrations, and find MISA members. Visit the&nbsp;<a href=\"https:\/\/www.youtube.com\/playlist?list=PLXPr7gfUMmKzygOBpqjb8iGavqDnopoXx\" target=\"_blank\" rel=\"noreferrer noopener\">video playlist<\/a>&nbsp;to learn about the strength of member&nbsp;integrations&nbsp;with Microsoft products.&nbsp;<\/p>\n\n\n\n<p>To learn more about Microsoft Security solutions,&nbsp;<a href=\"https:\/\/www.microsoft.com\/security\/business\/solutions\">visit our&nbsp;website<\/a>.&nbsp;Bookmark the&nbsp;<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\">Security blog<\/a>&nbsp;to keep up with our expert coverage on security matters. Also, follow us at&nbsp;<a href=\"https:\/\/twitter.com\/@MSFTSecurity\" target=\"_blank\" rel=\"noreferrer noopener\">@MSFTSecurity<\/a>&nbsp;for the latest news and updates on cybersecurity.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<p><sup>1<\/sup> <a href=\"https:\/\/panaseer.com\/reports-papers\/report\/2022-security-leaders-peer-report\/\" target=\"_blank\" rel=\"noreferrer noopener\">Security leaders are still in the dark with asset visibility while\u202fa lack of insight is driving control failures<\/a>, Panaseer. 2022.<\/p>\n\n\n\n<p><sup>2<\/sup> <a href=\"https:\/\/d3security.com\/platform\/soar-platform-overview\/\" target=\"_blank\" rel=\"noreferrer noopener\">Smart SOAR platform<\/a>, D3 Security.<\/p>\n\n\n\n<p><sup>3<\/sup> <a href=\"https:\/\/d3security.com\/resources\/xgen-soar-event-pipeline\/\">Smart SOAR Event Pipeline<\/a>, D3 Security.<\/p>\n\n\n\n<p><sup>4<\/sup> <a href=\"https:\/\/d3security.com\/solutions\/mssp-soar\/\" target=\"_blank\" rel=\"noreferrer noopener\">Security Automation and Orchestration for MSSPs<\/a>, D3 Security.<\/p>\n\n\n\n<p><sup>5<\/sup> <a href=\"https:\/\/d3security.com\/partners\/technology\/microsoft-azure-sentinel-soar-integration\/\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Azure Sentinel Integration<\/a>, D3 Security. <\/p>\n\n\n\n<p><sup>6<\/sup> <a href=\"https:\/\/d3security.com\/solutions\/by-use-case\/phishing-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">D3 Smart SOAR for Phishing Attacks<\/a>, D3 Security. <\/p>\n\n\n\n<p><\/p>\n\n\n\n<p> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how D3 Security and Microsoft help customers overcome common security operations center pain points with D3 XGEN SOAR and Microsoft Sentinel.<\/p>\n","protected":false},"author":162,"featured_media":112860,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3662],"topic":[3677,3684,3685],"products":[3726],"threat-intelligence":[],"tags":[3742],"coauthors":[3138],"class_list":["post-112794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-news","topic-misa","topic-security-operations","topic-siem-and-xdr","products-microsoft-sentinel","tag-azure"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Automating your Microsoft security suite with D3 Smart SOAR  \u00a0 | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Automating your Microsoft security suite with D3 Smart SOAR  \u00a0 | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"Learn how D3 Security and Microsoft help customers overcome common security operations center pain points with D3 XGEN SOAR and Microsoft Sentinel.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-05-03T16:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-16T05:58:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Walker Banerd\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Walker Banerd\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/walker-banerd\/\",\"@type\":\"Person\",\"@name\":\"Walker Banerd\"}],\"headline\":\"Automating your Microsoft security suite with D3 Smart SOAR \u00a0\",\"datePublished\":\"2022-05-03T16:00:00+00:00\",\"dateModified\":\"2023-05-16T05:58:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\"},\"wordCount\":1803,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg\",\"keywords\":[\"Azure\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\",\"name\":\"Automating your Microsoft security suite with D3 Smart SOAR \u00a0 | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg\",\"datePublished\":\"2022-05-03T16:00:00+00:00\",\"dateModified\":\"2023-05-16T05:58:34+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg\",\"width\":1200,\"height\":800,\"caption\":\"Security practitioners at work in a security operations center.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Automating your Microsoft security suite with D3 Smart SOAR \u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Automating your Microsoft security suite with D3 Smart SOAR  \u00a0 | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/","og_locale":"en_US","og_type":"article","og_title":"Automating your Microsoft security suite with D3 Smart SOAR  \u00a0 | Microsoft Security Blog","og_description":"Learn how D3 Security and Microsoft help customers overcome common security operations center pain points with D3 XGEN SOAR and Microsoft Sentinel.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/","og_site_name":"Microsoft Security Blog","article_published_time":"2022-05-03T16:00:00+00:00","article_modified_time":"2023-05-16T05:58:34+00:00","og_image":[{"width":1200,"height":800,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg","type":"image\/jpeg"}],"author":"Walker Banerd","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg","twitter_misc":{"Written by":"Walker Banerd","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/walker-banerd\/","@type":"Person","@name":"Walker Banerd"}],"headline":"Automating your Microsoft security suite with D3 Smart SOAR \u00a0","datePublished":"2022-05-03T16:00:00+00:00","dateModified":"2023-05-16T05:58:34+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/"},"wordCount":1803,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg","keywords":["Azure"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/","name":"Automating your Microsoft security suite with D3 Smart SOAR \u00a0 | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg","datePublished":"2022-05-03T16:00:00+00:00","dateModified":"2023-05-16T05:58:34+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2022\/05\/CLO22_SecOps_016.jpg","width":1200,"height":800,"caption":"Security practitioners at work in a security operations center."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/05\/03\/automating-your-microsoft-security-suite-with-d3-smart-soar\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Automating your Microsoft security suite with D3 Smart SOAR \u00a0"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/112794"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/162"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=112794"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/112794\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/112860"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=112794"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=112794"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=112794"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=112794"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=112794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=112794"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=112794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}