Microsoft launches Integrated Security Operations Center in Defender

Microsoft has announced the Integrated Security Operations Center (ISOC) within Microsoft Defender, a move designed to unify security information and event management (SIEM) with existing extended detection and response (XDR) capabilities. The update aims to reduce complexity for security teams by combining tools and workflows that were previously separate, allowing for faster threat detection and response in an era where attackers increasingly use AI agents to automate attacks.

For Microsoft 365 E5 and E7 customers, SIEM capabilities can now be run inside Microsoft Defender without additional licensing costs. Under this model, logs from Microsoft’s own security products are available without ingestion charges. However, starting October 1, data ingested from third-party security tools will be metered at a pay-as-you-go rate of $2.40 per GB.

ISOC is not a standalone product but a capability integrated into the Defender suite. It is currently available in public preview, allowing security professionals and AI agents to operate using the same signals, context, and controls within a single system.