Defender XDR ISOC Announcement Signals a Changing of the Guard

Microsoft continues to bring key features of its Sentinel service into Defender XDR, announcing plans to add integrated security operations center (ISOC) capabilities from Sentinel to the Defender XDR portal. With feature integration nearing completion, Microsoft is expected to soon announce plans to gradually retire Sentinel.

Almost two years ago, Microsoft began integrating key features of the stand-alone Microsoft Sentinel service into the Defender XDR portal, gradually increasing the parity between the two. The key differentiator up to this point was Sentinel’s full range of security information and event management (SIEM) capabilities, and Sentinel’s ability to incorporate external log data into its dataset. Defender XDR, on the other hand, at first focused exclusively on incident data from Microsoft Defender security services; later it added support for Entra ID and Purview data as well as Office 365 activity and logs.