Microsoft Defender - Building the Agentic SOC with AI-Driven Security Operations - BRK241

Explore Microsoft's vision for AI-driven security operations through this 44-minute conference talk from Microsoft Ignite 2025, featuring Rob Lefferts, Corina Feuerstein, and special guest Allie Mellen, Principal Analyst at Forrester. Discover how intelligent agents and automation are transforming Security Operations Centers (SOCs) by helping security teams prevent threats, respond faster, and stay ahead of attackers. Learn about Microsoft's mission for adaptive, autonomous defense that enables strategic work while addressing critical challenges like alert overload and false positives in SOC workflows. Examine real-world scenarios including how Defender XDR confirms account compromises when attackers federate compromised accounts into AWS environments, and witness automatic containment processes that revoke session tokens and disable compromised accounts. Gain insights into the importance of encoding runbooks, implementing guardrails, and ensuring explainability in agentic AI systems. Understand how the role of security analysts is evolving in the agentic era and why vendor transparency is crucial, including the importance of labeling generative AI capabilities and providing confidence levels. See demonstrations of new agentic capabilities transforming SOC operations and hear real-world stories of organizations strengthening their defenses through Microsoft Defender innovations.