Define the concepts of SIEM, SOAR, and XDR

Let's start by explaining Microsoft Sentinel and what Security Information Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solutions are.

SIEM is a solution within a security operations center that gathers logs and events from various appliances and software within an information technology infrastructure. These SIEM solutions then review the logs and events for potential threats by searching for behavior that is not typical of best practices or may be seen as anomalous or atypical. The benefit of having and utilizing SIEM is that without it, security operations personnel would need to review each of these log and event files manually. Since there are thousands of log and event files within companies, this option has the potential for mistakes, as fatigue becomes an issue when scrolling through these files. SIEM picks out the logs and events that could be a threat, and security personnel can then investigate...