Here's an example high-level storyboard for the Microsoft Defender Vulnerability Management of assets. In this example, the SOC requires that threats and vulnerabilities be remediated against assets via approved processes that include scanning of assets. Use case example 2: Threat and vulnerability scanningĪnother scenario where a use case could be used is for threat and vulnerability scanning. Here's an example process for an anti-phishing campaign.

Once the story board has been approved, the next step is to invoke the use case workflow. Invoke the use case workflow for example 1 Here's an example of a high-level story board for a new phishing exploit notification to a Threat Intelligence team. The first step in creating a use case is to outline the workflow using a story board. The following sections use anti-phishing and threat and vulnerability scanning scenarios as examples. Once a high-level use case standard has been defined and approved, the next step is to create and test an actual use case. To facilitate the runbook and playbook creation processes, create a use case decision tree. SOC Oversight activities related to use case development include: Priority of use cases are based on objectives, such as compliance or privacy. The SOC Oversight team should work with your business, IT, legal, HR, and other groups to prioritize use cases for the SOC that will eventually make their way into the SOC team's runbooks and playbooks. The SOC should define a high-level standard and process for developing use cases, which would be regulated by the SOC Oversight team. It creates a methodology for capturing metrics to determine if the right roles and mix of tasks are aligned to the right team with the right skill set. Use cases help define requirements and test processes for SOC operations across various teams. For this reason, Microsoft recommends that your SOC team formalize a method for defining and prioritizing use cases. Turning on one feature in a security technology or changing a process may in turn break another. Maintaining cyber hygiene across platforms can be challenging because of the vast amount of data coming from dozens if not hundreds of security sources.

The recommended methods to deploy Microsoft 365 Defender in your Security Operations Center (SOC) depends on the SOC team's current set of tools, processes, and skill set. Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender.

Use case priority matrix