A major UK retailer known for its quality clothing, home products, and premium food offerings recently migrated their SIEM platform to Microsoft Sentinel, which was integrated with other Microsoft security tools, including Defender.
Over the months, multiple configurations had been built up, creating complexity within the system.
The alert overload problem
After the migration, the SOC (Security Operations Center) team became overwhelmed by a flood of alerts—many of which were false positives.
This not only drained their resources but also weakened their security posture, as the team couldn’t thoroughly investigate the flood of alerts.
RiverSafe’s solution: Optimising configurations
RiverSafe was brought in to address this issue and guide the leading UK retailer on reviewing Microsoft Defender configurations and fine-tuning the Microsoft Sentinel queries.
The consultant conducted a thorough review of the existing configurations and provided actionable recommendations to the SOC team.
Some changes were straightforward and implemented quickly, while others required collaboration with multiple teams across the organisation—something the SOC team had issues in getting implemented over a few months.
Facilitating communication for effective implementation
The consultant facilitated communication between the SOC team and other departments, providing detailed documentation and clear explanations of why these changes were necessary.
By bridging this gap, they ensured the required changes were finally actioned and documented with high standards.
Key impacts
- Within a few weeks, they achieved the changes the SOC team had been pushing for over the few months, fostering better collaboration between the networking and security teams.
- Alerts were reduced by 62%, significantly improving team efficiency by cutting out noisy, recurring alerts.
- The improved configurations enhanced the company’s overall security posture, allowing the SOC team to focus on real threats and respond more effectively.