SIEM - SOAR - MDR - EDR

SIEM, SOAR, MDR, and EDR are cyber security tools enhancing threat detection, response, and automation. SIEM and SOAR analyse and automate data; MDR and EDR monitor, detect and respond to incidents.

Examples

SIEM (Security Information and Event Management)

Collects and aggregates log data from multiple sources (networks, servers, applications).
Correlates events in real time to identify security incidents.
Provides centralised visibility and alerting for security teams.
Supports forensic analysis and compliance reporting.
Primarily focused on monitoring and alerting rather than automated response.

SOAR (Security Orchestration, Automation, and Response)

Automates repetitive tasks to reduce manual workload on security teams.
Orchestrates security tools and workflows to respond to incidents.
Integrates with SIEM, EDR, and other tools for coordinated response.
Includes playbooks to standardise and expedite incident responses.
Helps improve response time and reduce incident impact through automation.

MDR (Managed Detection and Response)

A managed service that provides continuous threat monitoring and response.
Operated by a team of security experts, offering outsourced 24/7 monitoring.
Focuses on threat detection, investigation, and proactive response.
Includes capabilities of both SIEM and EDR with added human expertise.
Ideal for organisations lacking in-house security resources.

EDR (Endpoint Detection and Response)

Monitors and analyses endpoint activity for signs of suspicious behaviour.
Provides threat detection, investigation, and response at the endpoint level.
Enables containment and remediation directly on compromised devices.
Often includes behavioural analysis and machine learning for threat detection.

Primarily focused on securing individual endpoints rather than network-wide events.

Microsoft Sentinel is a cloud-native platform that integrates both SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) functionalities. It offers comprehensive security analytics and threat intelligence across an organisation's entire digital estate.

Microsoft

Key Features of Microsoft Sentinel:

Data Collection at Scale: Aggregates data from all users, devices, applications, and infrastructure, both on-premises and across multiple clouds.

Microsoft Learn

Threat Detection: Utilises advanced analytics and Microsoft's extensive threat intelligence to identify previously undetected threats and minimise false positives.

Microsoft Learn

Investigation and Hunting: Employs artificial intelligence to investigate threats and proactively hunt for suspicious activities, leveraging Microsoft's extensive cybersecurity expertise.

Microsoft Learn

Automated Response: Provides built-in orchestration and automation of common tasks, enabling rapid response to incidents.

Microsoft Learn

By combining SIEM and SOAR capabilities, Microsoft Sentinel delivers a unified solution for security operations, enhancing visibility, detection, and response across an organisation's digital environment.

A Security Operations Centre (SOC)