01Introduction
Building a SOC from Scratch for a 2,000-Seat Enterprise
02Problem Statement
- Manufacturing firm: no SIEM, no EDR, multiple ransomware near-misses in 18 months
- 2,000 Windows endpoints, 50 Linux servers, OT/IT convergence at factory floor
- Challenge: deploy XDR + SIEM in 90 days; achieve MITRE ATT&CK coverage baseline
- Compliance driver: cyber insurance renewal requiring EDR and SIEM evidence
- Internal IT team of 3; needed detection capabilities without large SOC headcount
03Proposed Solution
Phase 1
CrowdStrike Falcon + Microsoft Sentinel Unified XDR
- CrowdStrike Falcon Prevent + Insight deployed on all 2,000 endpoints via GPO
- CrowdStrike alerts forwarded to Microsoft Sentinel via Data Connector
- Sentinel connected to: Entra ID, Defender for Office 365, Palo Alto firewall logs
- MITRE ATT&CK coverage mapped using Sentinel Workbooks
- Logic Apps SOAR: auto-isolate endpoint on CrowdStrike critical detection
Phase 2
Detection Engineering & Incident Response Playbooks
- Deployed 50 custom KQL detection rules targeting top 20 MITRE techniques
- Threat Intel: MISP feeds integrated into Sentinel; IOC blocking via CrowdStrike
- OT/IT boundary: Claroty sensors feeding Sentinel for factory network visibility
- IR playbooks: Logic Apps automate containment (isolate, disable account, block IP)
- Tabletop exercise conducted after deployment; 4 gaps identified and remediated
04Technologies
- EDR/XDR
- CrowdStrike Falcon PreventFalcon InsightOverwatch
- SIEM
- Microsoft Sentinel (KQL, Analytics Rules, Workbooks, Watchlists)
- SOAR
- Azure Logic Apps automated playbooks
- Threat Intel
- MISPCrowdStrike ThreatGraph
- Compliance
- MITRE ATT&CK Navigator coverage mapping