The Fortgale European SOC 24·7·365 on Defender + Sentinel. 287 tools and actors profiled against European markets, <30 min median containment, native cross-domain response (endpoint · email · identity · cloud).
Microsoft Defender XDR + Sentinel is the most adopted security stack in European M365 enterprises. Fortgale operates it with European analysts who know NIS2 and apply CTI on actors active against European markets.
Single console for endpoint, email, identity, cloud, SaaS. Fortgale SOC validation, Microsoft Threat Intel built-in. Gartner Leader Magic Quadrant XDR 2026, deep integration with Sentinel SIEM. Fortgale delivers detection and response on the platform modules Microsoft Defender for Endpoint · Defender for Identity · Defender for Office 365 · Defender for Cloud Apps · Microsoft Sentinel.
L2/L3 analysts with experience on identity-based attacks, BEC, M365 phishing. <15 min triage on Defender alerts. KQL custom rules and Sentinel notebooks. 34,000+ IoCs per week on European markets.
Automatic containment: device isolation, AAD lockout, email quarantine, file collection. Logic Apps playbooks orchestrated by the Fortgale SOC. Full NIS2 national CSIRT notification support.
From M365 telemetry ingestion to native response, all governed by Fortgale with European analysts and proprietary intelligence on European markets.
Microsoft Defender for Endpoint, Office 365, Identity, Cloud, all connected to Sentinel. Telemetry duplicated in Fortgale data fabric for cross-customer correlation.
Sentinel AI + custom KQL rules tuned by Fortgale on European TTPs. Fortgale analyst validation integrated. False positives reduced by over 90%.
European SOC specialised on M365 attacks: AiTM, OAuth abuse, MFA bypass, BEC. Direct interaction in your business language, time zone and regulation included.
~8 second device isolation, full M365 cycle response (email, identity, files, sessions). Direct escalation to Fortgale IR for critical incidents.
Metrics measured on real customer telemetry, Q1 2026, updated quarterly.
The platform produces telemetry. What is missing is the people who read it around the clock, prioritise it and turn it into decisions.
Tier-zero AI filters, analysts decide: noise reduced >90% by day 30. Every alert that reaches you is already a qualified case.
L2/L3 analysts who operate the Defender console every day: detection tuning, MITRE-mapped runbooks, native response on your platform.
European SOC, headquartered in Milan since 2017, 24·7·365: median TTD <15 minutes, median TTC <30 minutes.
Multi-stage intrusions detected, contained and publicly documented by the research team: Operation Storming Tide, Operation MN-1224.
Proprietary CTI on 287 tracked adversary groups and attack tools: advisories, IOCs and actor profiles feed directly into detection on your platform.
Selection of identity & cloud-native threats observed on M365 tenants of Fortgale customers. Defender XDR is our front-line console for AiTM phishing, OAuth abuse and post-Entra ID lateral movement.
Vector Adversary-in-the-Middle with session cookie hijack · MFA bypass · brand-impersonation landing page
Detection · Defender Defender for Office 365 Safe Links + Entra ID risky sign-in alert · SOC correlation on geo-anomaly.
Vector Consent phishing · OAuth token exchange · persistent mailbox access via Graph API even after password reset
Detection · Defender Entra ID consent grant audit + Defender for Cloud Apps anomalous OAuth detection · nominative Fortgale runbook.
Vector Help-desk social engineering · MFA push fatigue · device registration on Entra ID · lateral via Intune
Detection · Defender Microsoft Defender for Identity (MDI) + Entra ID Conditional Access · hunting queries on DPAPI and Pass-the-Cookie patterns.
Vector Post-exploit PowerShell stager · AMSI bypass · keylogger module · token impersonation
Detection · Defender Defender for Endpoint EDR + Antimalware Scan Interface + custom IOA on <em>encoded command-line</em>.
Every component is designed to ensure continuous operational protection on the M365 environment, from endpoint to identity.
Defender XDR licensing (or existing instance). Sentinel data connectors, KQL rules, Logic Apps playbooks managed by Fortgale. Tuning, maintenance, monthly health check.
Monthly KQL hunting sessions on Defender + Sentinel. Focus on AiTM phishing, OAuth abuse, illicit consent grant, lateral movement Azure AD.
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Sentinel Threat Intelligence. Focus on European actors and ransomware specialists.
Containment via Defender + Sentinel SOAR: device isolation, AAD lockout, email quarantine, session revocation. Custom Logic Apps playbooks.
Executive reports MTTD/MTTR, technical reports per incident, NIS2/ISO 27001/GDPR audit documentation. Custom Sentinel Workbook with real-time KPIs.
Defender for Identity + AAD logs to detect Pass-the-Hash, Pass-the-Ticket, Golden Ticket, MFA fatigue, AAD compromise. Detection tuned by Fortgale.
The CISO decides on risk. The IT lead decides on the runbook. Fortgale MDR produces evidence for both.
Each month the CISO receives the profile of the 3 most likely actors against their sector, with the Fortgale MDR runbook already mapped to the Microsoft Defender XDR telemetry.
When the Defender alert is real, decision time is containment time. Our L2/L3 analysts know the Microsoft Defender XDR console and have a mandate to decide.
Combines Microsoft Defender XDR (endpoint, email, identity, cloud) with the Fortgale European SOC 24·7·365. L2/L3 analysts monitor the M365 Defender console, apply MITRE-mapped runbooks and trigger native Defender response (device isolation, AAD lockout, email purge).
No. Fortgale handles the full cycle: E5/Defender licensing, deployment, Sentinel integration, detection tuning. If you already have the licence, we integrate the SOC on your instance. Otherwise we provide it as part of the service.
Microsoft Defender for Endpoint onboarding takes minutes per device. Full MDR activation, Sentinel connectors, KQL detection rules, Logic Apps playbooks, 24·7·365 monitoring, completes in 7-12 business days.
Yes. We support NIS2 transposition requirements: continuous monitoring, IoC collection for national CSIRT notification within 24 hours, technical documentation for 72-hour notifications, audit-ready reporting.
Yes. Microsoft Defender XDR is a unified platform: endpoint (Defender for Endpoint), email (Defender for Office 365), identity (Defender for Identity, Azure AD), cloud (Defender for Cloud), SaaS (Defender for Cloud Apps). The Fortgale MDR service covers all these domains in a unified console.
We bring you the Report on your sector with the most likely actors and a concrete MDR runbook on your Microsoft Defender XDR console.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
