Security operations posture
Check that security alerts reach the assigned response owner.
You have Defender or Sentinel but need to know which systems send usable logs and who receives the alerts. We configure and test the agreed sources and alert routing, then hand them to a named owner. Ongoing monitoring and 24/7 response are not included.
What the evidence looks like
Illustrative sample · constructed example
Trace a controlled event to its assigned reviewer.
Safe test event · alert routing
Selected check
Did the named reviewer receive the test notification?
Safe test event · alert routing
| Dependency | What has to be established | Sample review |
|---|---|---|
| Test event | Use a safe test agreed with the technical owner. | Test generated |
| Alert route | Confirm the alert reaches the intended destination. | Delivery unconfirmed |
| Recipient | Ask the nominated reviewer to acknowledge the sample. | Acknowledgement pending |
| Ongoing response | Agree who will investigate alerts after handover. | Operating responsibility |
A tested alert route is distinct from a staffed monitoring and response service.
- Evidence
- Test event ingested; reviewer acknowledgment has not been recorded.
- Decision
- Routing test incomplete
- Next action
- Check the notification rule and destination with the assigned reviewer.
Setup establishes tested routing and ownership. Ongoing monitoring, staffing and future response are separate responsibilities.
The relevant scope
Start with a defined piece of work
The scope, the price, and how you will know it is finished are agreed in writing before anyone is given access. Review the engagement below for its deliverables, responsibilities and acceptance criteria.
The engagement
Microsoft Defender XDR Alert Setup
The in-scope Defender data sources connected and verified, alert policies configured with routing to a named reviewer, retention set deliberately, and expected test events traced end to end before the runbook is handed to its owner. It is deployment and validation; it is not monitoring, incident response, or a staffed SOC.
Not sure this is the one?
Describe what happened, in a paragraph. We’ll review your request and follow up about scope and next steps.
Discuss the scope and quoteWhat happens next
- 1Describe what happenedA few short fields: company size, environment, and what is going wrong.
- 2We’ll review your request and follow up about scope and next steps.The most direct next step, or a clear answer that AZ Innovations is not the right fit.
- 3A fixed-fee proposalNamed scope, price, and how you will know it is finished. No obligation.