TOP3 blog posts about Microsoft ISOC

ByThomas Verheyden

On September 23, Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender, now in public preview.

There is already a LOT of content out there about ISOC. Announcements, docs, partner posts, hot takes… its easy to get lost. So I picked the 3 blogs that helped me most to really understand the new capabilities:

Ing. Derk van der Woude 🥷
🔗 https://blue16.nl/isoc-explainer.html

Joe S.
🔗 https://www.patriotconsulting.com/blogs/2026/09/23/isoc-in-microsoft-defender-e5-e7-benefit

Nicola Suter
🔗 https://nicolasuter.ch/microsoft-defender-isoc/

💡 Good to know: the preview is currently for eligible Microsoft Defender Suite, Microsoft 365 E5 or E7 customers without an active Sentinel workspace.

#MicrosoftSecurity #MicrosoftDefender #ISOC #SOC #AgenticSOC #MicrosoftSentinel #CyberSecurity #XDR #SIEM

Similar Posts

Tool: MDE-Troubleshooter is born !

ByThomas Verheyden

Background story During my consultancy work, I have received feedback from numerous clients indicating that they consistently encountered difficulties when attempting to troubleshoot issues with Defender for Endpoint on their local endpoints. They often found it a struggle to navigate through various locations, such as PowerShell for security configuration, the event viewer for log files,…

Microsoft Defender Unified Role based access mapper

ByThomas Verheyden

I created a web based interactive Microsoft Defender Unified RBAC permissions mapper which will make your life easier when you need to exactly find which permissions you need for Defender. It consist out of key capabilities and applicable workloads based on the docs. You can find this mapper at my website : RBAC XDR –…

Your isolated device stuck in Defender for Endpoint Isolation mode , not anymore !

ByThomas Verheyden

Intro When you want to investigate a endpoint that has indication of being comprised you might want to put the endpoint in Defender for Endpoint isolation mode. Isolation will disconnected the potential comprised endpoint from the network and will only allow connection to Defender for Endpoint Service. Depending on your OS level you can also…

Defender Unified Role-Based Access Control (RBAC) support for Microsoft Sentinel is here

ByThomas Verheyden

Intro During my latest engagements with different customers I frequently received the question why you still have to configure Azure permissions if you want to use the unified portal experience in Defender to access log analytics workspace log data. I can finally say this isn’t the case anymore, Microsoft recently announced that Unified RBAC supports…

| |

Defender for Endpoint Migration: Troubleshooting Persistent Third-Party AV Registration

ByThomas Verheyden

Intro I recently assisted a costumer with migrating to Defender for Endpoint. They had some windows 10/11 endpoints where the 3rd party Antivirus (AV) kept registered as primary Antivirus which by default put Defender for Endpoint in disable state on Windows 10/11: Together with the Internal system engineers we tested multiple uninstall packages/scripts provided by…

Tutorial: The fastest way to report a False negative in Defender for Endpoint!

ByThomas Verheyden

Intro Encountering a false negative during a customer engagement can be a critical issue. Recently, I faced a similar situation where a particular exploit went undetected. While I won’t delve into the specifics of the exploit, I want to highlight an efficient method to report false negatives promptly for resolution. In my recent experience, the…

Leave a Reply