The Path

to AI
Pave the way for powerful cybersecurity
AI with integrated XDR and SIEM

E-book
Contents Chapter_01 Chapter_02 Chapter_03 Chapter_04 Chapter_05

03 05 07 10 13
This is a pivotal moment Stack the odds Create a strong, Amplify your Get ready to use
in cybersecurity in your favor secure foundation with security operations Microsoft Security Copilot
integrated XDR and SIEM with generative AI
Chapter_01
This is a pivotal moment
in cybersecurity
Chapter 1

This is a pivotal moment in cybersecurity

Security operations are about to undergo a cybersecurity talent shortage, with a projected stacks to lay the foundation they’ll need to use
seismic shift. And it’s a timely one. shortfall of 3.5 million positions by 2025,1 have generative AI cybersecurity tools. Integrating
left many security teams overwhelmed extended detection and response (XDR) with
Cybersecurity professionals face tough and overworked. a security information and event management
challenges that show no signs of abating. (SIEM) system gives organizations the end-to-
Attacks such as ransomware and business email Security leaders need to empower their teams end visibility and depth of security signal
compromise are becoming more frequent, highly to combat these issues. Thankfully, new tools, and response that are the cornerstones of
targeted, and difficult to detect, and malicious innovative applications, and an integrated that foundation.
actors are continually evolving their tactics. approach to detection, investigation, response,
Meanwhile, remote and hybrid work continues and protection can help tip the balance in This guide will show you how to begin on your
in full force, causing organizations to move more
critical resources to the cloud. People, devices,
favor of defenders. A critical part of this next
generation of tools is powerful generative
path to using generative security AI, including:
With SIEM and XDR’s
and apps need to be able to access networks from
virtually anywhere, and the many endpoints and
AI, such as Microsoft Security Copilot, that
is trained to analyze threat signals and make
• How simplifying your security tools can
help security teams combat some of their technologies rolled
identities that result are tempting avenues of attack
for cybercriminals. It’s an uphill battle that’s nearly
recommendations to security teams in natural
language, giving defenders crucial context
•
biggest challenges.

What efficiencies integrated XDR and SIEM

into one platform, we
impossible to win without the right tools. help with prioritization. It speeds up detection
and response, lessening the need for complex
can add to your security operations. get a level of visibility
What makes it even more difficult to defend
against such sophisticated adversaries and
workflows and playbooks and empowering
even junior analysts to do work that previously
• How taking the step of integrating XDR and
SIEM can prepare you for the next step—
that we have never
protect sprawling attack surfaces—typically
spanning multiple clouds and platforms—is that
required years of expertise. using generative security AI.
had before.
security teams are often short-staffed and lack Generative AI is poised to revolutionize security
some of the expertise and resources they need operations, shrinking the time to respond to Manager of cybersecurity and IT infrastructure,
professional services 2
detect modern attacks. The dual problems of an threats from hours and days down to minutes.
unfavorable economic climate and a worldwide Many organizations are refining their security

1
Cybersecurity Jobs Report: 3.5 Million Unfilled Positions In 2025, Cybersecurity Ventures, 2023.
2
The Total Economic Impact™ Of Microsoft SIEM And XDR, a commissioned study conducted by Forrester Consulting, August 2022.
Chapter_02
Stack the odds
in your favor
 Chapter 2 6

“Having multiple
security tools from
Stack the odds in your favor
the same vendor For organizations to strengthen their security in if their email, endpoint, identity, cloud apps, cracks with more comprehensive, guided, and
today’s threat landscape, they need to have tools
has helped us to that simplify the complexity of their security
workload, and data protection solutions aren’t
efficiently sharing signal, delaying alerts by
automated solutions.

save detection and team’s work in protection, detection, and

response across the entire kill chain. It’s common
hours—or even days. And without tools to
prioritize alerts, security professionals can
Integrated XDR and SIEM can give your security
operations the visibility, agility, and resilience it
response time. We for security teams to work with a patchwork
of point solutions that have been added to
become overwhelmed with the challenges they
face every day. For example:
needs to combat these common challenges and
keep your organization more secure, whatever
no longer have to their security stacks to address specific needs
at the time without much forward planning— • There are an average of 4,000 password
the future may bring. And in an economic climate
that engenders competing budget priorities,
go into a bunch of and accumulated over years. It’s too complex attacks per second3 streamlining your tools and preparing your
for security teams to work this way because it systems to support generative cybersecurity AI
different screens forces them to use a plethora of siloed tools
• The median time for an attacker to access
private data after a successful phishing email
makes short-term and long-term financial sense.
with visibility gaps and manually correlate
and tools to conduct disparate alerts across them, slowing down their
attack is only 72 minutes.4

investigations and investigation and response and causing alert

fatigue. This opens the door for attackers.
• Attackers are increasingly well resourced,
and social engineering, ransomware, and

respond to threats. AI-enabled fraud are becoming more Gartner predicts that by
Without a holistic and consistent view of threats sophisticated by the day.
2025, a lack of security staff
The integration is and their digital estates, organizations lack
visibility into the entire kill chain and the full Gartner predicts that by 2025, a lack of security or human failure will be
seamless.” scope of an attack, leading to valuable time lost staff or human failure will be responsible for responsible for over half of
during investigation. Even mature security teams
with strong security solutions can struggle to
over half of cybersecurity incidents.5 The latest
innovations in security aim to reverse that trend
cybersecurity incidents.5
Head of cyber and technology
procurement, logistics6 detect sophisticated attacks such as ransomware by keeping attacks from slipping through the

3
Microsoft Entra expands into Security Service Edge and Azure AD becomes Microsoft Entra ID | Microsoft Security Blog, Joy Chik, July 11, 2023.
4
Anatomy of a Modern Attack Surface, Microsoft Security, 2023.
5
Gartner Predicts Nearly Half of Cybersecurity Leaders Will Change Jobs by 2025, Gartner, February 22, 2023.
6
The Total Economic Impact™ Of Microsoft SIEM And XDR, a commissioned study conducted by Forrester Consulting, August 2022.
Chapter_03
Create a strong, secure
foundation with integrated
XDR and SIEM
 Chapter 3 8

Use automation to perform routine processes.

Triage is streamlined because the system’s machine-learning-based

Create a strong, secure detection surfaces the most pressing security alerts, prioritizes
incidents, and automatically remediates most threats. Your valuable

foundation with integrated

team members have greater freedom to focus on what’s important.

XDR and SIEM

Move from reactive response to automatic attack disruption.
High-confidence signals collected by XDR help identify in-progress
attacks early so built-in automation can stop the progress of the attack
in real time, isolate affected devices, and suspend compromised users.
Unified XDR and SIEM as the foundation of investigation, remediation, and response to
your organization’s security strategy can attacks across all your identities, endpoints,
modernize your security operations and applications, email, Internet of Things (IoT) Reduce alert fatigue with prioritized incidents.
keep your organization protected as threats devices, and infrastructure, and even An integrated XDR and SIEM solution uses machine learning and depth of
continue to evolve. Having an integrated multiple clouds. signal to correlate alerts into incidents, giving analysts a prioritized, more
tool stack gives security operations centers complete, end-to-end view of active threats across the digital landscape
(SOCs) end-to-end visibility into the entire When security teams have comprehensive that eliminates time-consuming alert correlation and triage.
kill chain of an attack, even across multiple visibility plus the efficiency and accuracy
clouds and platforms. of integrated XDR and SIEM, it gives them a Maximize available threat intelligence.
critical edge: speed. The richness of available An XDR powered by robust, global threat intelligence can help
While your SIEM enables you to collect, data gives SOCs the accuracy and insights protect you from ever-evolving threats such as ransomware. The more
analyze, and hunt for alerts in huge volumes they need to surface attacks and strike intelligence your security team has access to, the more resilient your
of data from activity across your enterprise, back quickly. organization will be.
XDR enhances threat data to make it more
granular, not just with data from endpoints The advantages of integrated XDR and SIEM
but from email, identities, apps, cloud play out across the entire cyberattack chain. Reduce overhead costs.
workloads, and more. Together, XDR and Consolidating vendors and tools allows you to create a
SIEM give you comprehensive detection, positive ROI quickly, saving money that’s better spent on
human ingenuity and innovation.
 Chapter 3 9

Together, XDR and SIEM provide distinct • Saving almost $1.6 million annually
advantages for organizations. One study from vendor consolidation.7
revealed that for a composite organization
For organizations seeking to harden their
using an integrated solution, the operational
defenses with best-in-class security, make
and business benefits included:
their security operations more efficient,
and keep up with the latest security
• Reducing time to investigate threats
innovations, integrated XDR and SIEM
by 65% and reducing time to respond
provides a considerable ROI on all fronts.
to threats by 88%.
Plus, approaching security tools with a long-
• Reducing the time to create a new term mindset provides the solid foundation
workbook by 90% and the time to onboard organizations need to take the next
new security professionals by 91%. technological leap: generative AI–powered
security tools.
• Reducing the risk of a material breach
by 60%.

“We’ve seen about a 90% improvement in our risk of

security breach after deploying SIEM and XDR. It’s been
a game changer for us.”
CTO, government8

7
The Total Economic Impact™ Of Microsoft SIEM And XDR, a commissioned study conducted by Forrester Consulting, August 2022.
8
The Total Economic Impact™ Of Microsoft SIEM And XDR, a commissioned study conducted by Forrester Consulting, August 2022.
Chapter_04
Amplify your
security operations
with generative AI
 Chapter 4 11

Supporting and upskilling security talent.

Amplify your security

Top security strategies and best practices delivered through simple,
natural language make advanced remediation techniques available to
every member of the security team, from junior to senior.

operations with generative AI Detecting patterns and behaviors that are not obvious to the human eye.
Security Copilot uses the end-to-end visibility in your XDR and SIEM solution
and applies security-specific skills to huge amounts of data—helping teams
OpenAI’s ChatGPT4 signified a considerable A foundation of integrated XDR and SIEM
surface threats in real time so they can take proactive measures.
leap forward in the science of large language is integral to this new technology. It gives
modeling, and it has people in many security-trained AI the high-quality signals
industries considering how big of a role AI it needs to learn from trillions of pieces Turning huge amounts of data into clear, actionable insights.
can play in streamlining the way they work. of telemetry data and turn them into The security-trained generative AI transforms threat data into insights
Cybersecurity professionals have a more customized insights and recommendations. delivered in natural language, saving teams precious time when every
urgent need for simplified workflows It also provides the platform and framework minute counts.
than most, and you might be wondering needed to coordinate response actions
what natural language prompts and across security layers.
deep learning would look like in your own
Giving security analysts immediate, critical guidance and context.
security operations. Microsoft became a pioneer in generative
Security teams can accelerate their investigations with step-by-step
AI cybersecurity when it launched Microsoft
guidance and deep context relating to any security event.
Generative AI–powered security tools will Security Copilot. Security Copilot helps
shift the paradigm for threat detection and security teams outmaneuver attackers and
remediation in favor of defenders. Not only respond to threats in minutes rather than
Providing streamlined, natural-language workflows.
will it enable threat detection to evolve hours or days using intuitive workflows
Empowered with technology that can quickly summarize events and
from proactive to predictive, but it will also and the ability to submit natural language
automatically recommend corrective actions, teams can focus their efforts to
support analysts throughout the entire prompts. When used in combination with
act together quickly and easily prepare reports in a ready-to-share format.
cyberattack chain with reports and guidance XDR and SIEM, Security Copilot adds
using time-saving natural language prompts. exponential gains for security teams.
Predicting an attacker’s next move.
AI constantly applies its learning to the data in your integrated XDR and
SIEM and predicts what a malicious actor might do next—so your team
can outmaneuver them.
Detection is way better with SIEM and XDR. Prevention is
never 100%, so I would rather have the best detection in the
world than have the best protection without the visibility.
Manager of cybersecurity and IT infrastructure, professional services 9

9
The Total Economic Impact™ Of Microsoft SIEM And XDR, a commissioned study conducted by Forrester Consulting, August 2022.
Chapter_05
Get ready to use Microsoft
Security Copilot
 Chapter 5 14

Both Microsoft 365 Defender and Microsoft to continuously reason over 65 trillion
Defender for Cloud are powerful XDR global threat intelligence signals daily to
solutions. They work seamlessly with the provide superior threat protection for your
Microsoft Sentinel cloud-based SIEM organization. It learns from built-in feedback
solution to provide the unity, efficiency, tools to adapt to your organization’s
and broad visibility that your security team preferences and to continuously improve
needs to keep your organization protected how it works alongside your team.
as criminals’ tactics continue to evolve.
Consolidating tools with Defender and Attackers now have AI in their hands, and
Sentinel is the first step to take on your your defenders can too. It’s safe to assume
path to adopting generative AI as a that the enormous numbers of threat
cybersecurity tool. signals security teams must triage daily
will not decrease in the coming years, and
Security Copilot is the first generative AI that your team will need to combat that
security analysis tool. It magnifies your challenge with simpler, comprehensive

Get ready to use

SOC’s ability to keep your data, people, and security solutions that work together. End-
operations safe in today’s digital landscape. to-end threat visibility and the ability to ask
The generative AI that Security Copilot questions about your security posture and

Microsoft Security Copilot uses is responsibly developed and ready environment in natural language can prepare
your operations for long-term resilience
against cybercrime.

Explore your deployment options

SIEM and XDR Solutions | Microsoft Security
©2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information and views expressed in this document, including URL and other Internet website
references, may change without notice. You bear the risk of using it. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You Microsoft Security Copilot | Microsoft Security
may copy and use this document for your internal, reference purposes.