by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Sep 24th, 2026
For years, a proper SOC has been something for large organisations. You needed a SIEM, people around the clock, detection engineers and a lot of integration work. Smaller organisations bought a service, or did without. This month Microsoft made an integrated SOC experience in Defender available to eligible Microsoft 365 E5 and E7 customers who […]
Posted in Security Architecture, Technology on Aug 5th, 2026
On the 3rd of August Project Perception entered preview. It is a limited public preview, so only a selected group of customers have access for now. Here is how it actually works. It lives in the Defender portal, with sections for an overview, chat, sessions, agents and playbooks. Playbooks are reusable templates that describe how […]
Posted in Security Architecture, Technology on Mar 11th, 2026
Microsoft has announced that Sentinel is moving fully into the Defender portal, and that the Azure portal experience will be retired. For many SOCs, that is a bigger change than it sounds. For years, many SOC teams have worked in two places. Defender for the endpoint, identity, email and cloud app incidents, and Sentinel in […]
Posted in Security Architecture, Technology on Aug 20th, 2022
Some personal news. This month I started a new role as Technical Specialist at Microsoft. I´ll still be involved in incidents, but more as an advisor, helping customers get the most out of the security tools they already have, and helping them set them up so the next incident hurts less. That means I´ll be […]