The architectural decisions a CISO and SOC architect actually litigate — unified telemetry strategy, detection engineering posture, automated response model, and identity threat detection placement.
Design the unified telemetry plane — Sentinel as the SIEM anchor, Defender XDR as the cross-domain correlation, ingest tier discipline upfront.
~ 8 weeks
Search any SKU, capability, risk, or source on this map.
The modern SOC architecture has four load-bearing decisions: telemetry plane, detection engineering, identity threat detection, automated response. This map names each and the SKUs that anchor them. The architectural answer is Microsoft-native by default (Sentinel + Defender XDR + Entra ID P2), with the question being how much non-Microsoft signal to pull into the Sentinel plane.
Telemetry tier discipline drives cost; detection engineering rigour drives signal quality; automation drives MTTR. All three need to land together for the architecture to compound.