Logging, Auditing, SOAR and Threat Hunting

What it is

Detection is only useful if the data is there, the team can act on it quickly, and the coverage is known. This topic covers the supporting parts of security operations: centralized logging and auditing, monitoring across hybrid and multicloud, automation (SOAR), security workflows for incidents and hunting, and checking detection coverage with the MITRE ATT&CK matrices.

How it works

Centralized logging and auditing

Design points: use Azure Policy to deploy diagnostic settings automatically so no resource is missed, send logs to a central workspace in a management subscription, protect it with RBAC, set retention to match legal and investigative needs, and protect log integrity against tampering (restricted write access, immutable storage for archives).

Microsoft Purview Audit records user and admin activity across Microsoft 365. Audit (Standard) keeps records for 180 days. Audit (Premium) extends retention (one year by default for supported licenses, up to ten years with an add-on license for selected users), adds audit retention policies to keep specific activities longer, and records high value events such as MailItemsAccessed, which helps investigate mailbox compromise. Search the audit log in Purview or with PowerShell, or stream it into Sentinel with the Microsoft 365 connector.

Monitoring hybrid and multicloud

Prefer one pane of glass: a single SIEM that sees all of these, with consistent entity names, time zones and retention.

Security orchestration, automation and response (SOAR)

SOAR automates the repeatable parts of response.

For playbooks to act, Sentinel needs permission, granted through the Microsoft Sentinel Automation Contributor role on the resource group that holds them, and the playbook's own managed identity needs rights on the target systems. Apply least privilege to each playbook, because it is an identity that can change things.

Automate first the high volume, low risk tasks: enrichment, ticket creation, user notification, closing known benign alerts. Keep a human approval step for disruptive actions such as disabling an executive's account.

Security workflows

Incident response follows a life cycle (such as the NIST model): preparation, detection and analysis, containment, eradication and recovery, and post incident activity (lessons learned). In Sentinel and Defender, incident management uses severity, status, owner, tasks, comments, and entity pages. Define roles and runbooks in advance and rehearse them.

Threat hunting is proactive, hypothesis driven searching for threats that rules missed.

1. Form a hypothesis (for example, "an attacker is using a scheduled task for persistence").
2. Query data with advanced hunting in Defender XDR or hunting queries in Sentinel, using KQL.
3. Pivot with entities, bookmark evidence and turn good queries into analytics rules.
4. Document findings and improve detections.

Use threat intelligence (Microsoft Defender Threat Intelligence and imported indicators) to guide hunts.

Detection coverage with MITRE ATT&CK

MITRE ATT&CK catalogs attacker tactics and techniques. Three matrices matter here: Enterprise (Windows, Linux, cloud, identity), Mobile and Industrial control systems (ICS).

• Sentinel's MITRE ATT&CK page maps your analytics rules and hunting queries to techniques and shows active and available coverage, so you can see gaps.
• Tag rules with tactics and techniques so coverage reports are accurate.
• For ICS and operational technology, Defender for IoT detections map to the ICS matrix.
• Use coverage gaps to prioritize new detections, content hub solutions or hunting.

A worked scenario

A SOC is overwhelmed by phishing incidents. The architect adds an automation rule that, on a phishing incident, runs a playbook to enrich URLs with threat intelligence, check whether other users received the mail, and open a ticket, with a human approval before disabling an account. The team reviews the MITRE ATT&CK coverage page, finds weak coverage for credential access, and runs a hunt for password spray patterns, turning the best query into a scheduled analytics rule.