Summary

In this chapter, we discussed the areas of design and evaluation that go into the overall security operations strategy. This included the tools and teams that are assembled for a security operations center (SOC) and the tools that are available from Microsoft to monitor, manage, and respond to threats within the security operations process.

The use of stem, SOAR, and XDR tools for automating responses to threats and hunting for potential threats are the foundation of security operations. Utilizing these tools with a strong security operations workflow for incident response becomes the gauge to evaluate an effective and efficient security operations and incident response team. The cybersecurity architect will work closely with security operations to design and evaluate the tools, techniques, processes, and procedures for incident response, effective tools, and automation.

In the next chapter, you will learn about the design and architecture of an effective identity security...