Tools

DETECTION · REDMOND

Microsoft folds SIEM and threat protection into Defender as ISOC enters preview

REDMOND - Microsoft on September 23, 2026, announced Integrated Security Operations Center, or ISOC, in Microsoft Defender, a preview foundation that puts SIEM and native threat protection on one shared platform so analysts and agents can investigate and act without stitching separate stacks. Rob Lefferts (Microsoft Security Blog) said agent-driven attacks raise the cost of handoffs between detection and protection. ISOC is the operations layer of Microsoft's agentic stack begun in July 2026 with Project Perception; agents supply speed while people set priorities. Microsoft points to Attack Disruption as a protection loop using telemetry, exposure insights, and threat intelligence. ISOC is a Defender preview, not a vendor-neutral SIEM.

Ava Okello, Detection, London

Text desk note. No incident photograph.