Microsoft unveils ISOC, a unified security operations center in Defender

On September 23, 2026, Microsoft announced the integrated security operations center (ISOC) in Microsoft Defender, merging SIEM and threat protection on one foundation. Two days later it detailed Storm-3168, where compromised service principals ran 150+ operations in 35 minutes, including 100+ storage-account deletion attempts in about seven minutes.

• ISOC merges SIEM and threat protection into one foundation shared by people and AI agents
• Storm-3168: 150+ destructive or credential-collection operations in 35 minutes
• Over 100 storage-account deletion attempts in roughly seven minutes
• The attack relied on existing Contributor roles, not a novel exploit