01 ·
Defender XDR · cross-domain native
Console unique pour endpoint, e-mail, identité, cloud, SaaS. Defender Experts, validation, Microsoft Threat Intel built-in. Gartner Leader Magic Quadrant XDR 2026, intégration profonde avec Sentinel SIEM.
MDR sur Microsoft Defender XDR: native protection on M365.
The Fortgale SOC européen 24·7·365 on Defender + Sentinel. 180+ adversaires profiled against marchés européens, ~11 min median containment, native cross-domain response (endpoint · email · identity · cloud).
Fortgale × Defender
MDR · live
Sensore Defender attivoTelemetria endpoint · cloud · identità
Defender SOC italiano 24·7·365Analisti L2/L3 · interlocuzione diretta
Fortgale Tier-zero AI multidominioRumore ridotto del 94%
Fortgale Risposta nativa DefenderIsolamento host mediano ~8 s
Live Intelligence proprietaria34 000+ IOC settimanali · attori italiani
Fortgale MDR operativo — Defender + Fortgale SOC attivi
Conformità
ISO/IEC 27001
NIS2 ready
DORA aligned
GDPR · ACN
Partnership tecnologica
Microsoft Defender XDR
MITRE ATT&CK aligned
OpenCTI
Pourquoi Fortgale + Microsoft Defender
The unified Microsoft platform, operated with intelligence propriétaire européenne.
Microsoft Defender XDR + Sentinel is la stack sécurité la plus adoptée in M365 européen enterprises. Fortgale l'opère avec analystes européens qui connaissent NIS2 et appliquent la CTI sur les acteurs actifs against marchés européens.
02 ·
SOC européen 24·7·365
L2/L3 analysts with experience on identity-based attacks, BEC, M365 phishing. <15 min triage on Defender alerts. KQL custom rules and Sentinel notebooks. 34,000+ IoCs per week sur les marchés européens.
03 ·
Réponse Defender native
Confinement automatique: isolation device, AAD lockout, email quarantine, file collection. Playbooks Logic Apps orchestrés par le SOC Fortgale. Accompagnement complet à la notification CSIRT national NIS2 notification.
Comment ça marche · architecture
Quatre blocs, un cycle MDR on Defender.
De lingestion de la télémétrie M365 à la réponse native — le tout gouverné par Fortgale with analystes européens et intelligence propriétaire sur les marchés européens.
01 ·
01 · Ingestion
Defender + Sentinel actifs
Microsoft Defender for Endpoint, Office 365, Identity, Cloud — all connectés à Sentinel. Télémétrie dupliquée dans Fortgale data fabric for corrélation cross-customer.
02 ·
02 · Tier-zero
Corrélation IA + KQL
Sentinel AI + règles KQL custom tunés par Fortgale on European TTPs. Defender Experts, validation intégrée. Faux positifs réduits by 94%.
03 ·
03 · Analysts
Nos L2/L3 sur la console
European SOC spécialisés sur M365 attacks: AiTM, abus OAuth, contournement MFA, BEC. Interaction directe dans votre langue business, fuseau horaire et réglementation inclus.
04 ·
04 · Response
Defender natif + IR
~8 second isolation device, réponse complète cycle M365 (e-mail, identité, fichiers, sessions). Escalade directe to Fortgale IR for incidents critiques.
Proof · metriche del servizio
Quattro numeri che reggono l'MDR su Defender.
Metriche misurate sulla telemetria reale dei nostri clienti — Q1 2026, aggiornate trimestralmente.
~11 min
Confinement médian
depuis alerte Defender confirmée
depuis alerte Defender confirmée
94 %
Bruit réduit
par AI tier-zero + KQL
par AI tier-zero + KQL
Cross
Endpoint · e-mail · ID
· cloud détection unifiée
· cloud détection unifiée
12 days
Onboarding complet
Defender + Sentinel
Defender + Sentinel
Ce que comprend le service
MDR sur Defender, en détail.
Every component is designed to ensure continuous operational protection on the M365 environment, from endpoint to identity.
01
Managed Defender XDR + Sentinel
Defender XDR licensing (or existing instance). Sentinel data connectors, KQL rules, Playbooks Logic Apps managed by Fortgale. Tuning, maintenance, monthly health check.
02
Proactive M365 threat hunting
Monthly KQL hunting sessions on Defender + Sentinel. Focus on AiTM phishing, OAuth abuse, illicit consent grant, lateral movement Azure AD.
03
Proprietary CTI in Sentinel
34,000+ IoCs per week from Fortgale OpenCTI auto-imported into Sentinel Threat Intelligence. Focus on European actors and ransomware specialists.
04
Native cross-domain response
Containment via Defender + Sentinel SOAR: isolation device, AAD lockout, email quarantine, session revocation. Custom Playbooks Logic Apps.
05
Reporting & governance
Executive reports MTTD/MTTR, technical reports per incident, NIS2/ISO 27001/GDPR audit documentation. Custom Sentinel Workbook with temps réel KPIs.
06
Identity Threat Detection
Defender for Identity + AAD logs to detect Pass-the-Hash, Pass-the-Ticket, Golden Ticket, MFA fatigue, AAD compromise. Detection tunés par Fortgale.
Per chi · due angolazioni
Stesso MDR su Defender, due angolazioni.
Il CISO decide sul rischio. Il responsabile IT decide sul runbook. MDR Fortgale produce evidenze per entrambi.
Per il CISO
Un runbook nominativo per attore, su stack Defender.
Il CISO riceve ogni mese il profilo dei 3 attori più probabili contro il proprio settore, con il runbook MDR Fortgale già mappato sulla telemetria Microsoft Defender XDR.
- Threat briefing mensileAttori, TTP osservate, campagne in corso sul vostro settore.
- Runbook su DefenderPlaybook vivi mappati MITRE, eseguibili sulla console Microsoft Defender XDR.
- Reporting board-readyRischio · impatto · decisione. Niente tecnologia da slide.
Per il responsabile IT
Zero handover traduttore. Analisti italiani sulla vostra console Defender.
Quando l'alert Defender è reale, il tempo di decisione è il tempo di contenimento. I nostri analisti L2/L3 conoscono la console Microsoft Defender XDR e hanno mandato di decidere.
- Contenimento mediano ~11 minDall'alert confermato alla remediation in produzione.
- Risposta nativa DefenderKill processi, isolamento host, network containment via API Microsoft Defender XDR.
- Integrazione end-to-endTelemetria Defender ingerita nella nostra data fabric multidominio.
FAQ · frequently asked
Everything to know before talking to our analysts.
What is the Fortgale MDR service on Microsoft Defender XDR?
Combines Microsoft Defender XDR (endpoint, email, identity, cloud) with the Fortgale SOC européen 24·7·365. L2/L3 analysts monitor the M365 Defender console, apply MITRE-mapped runbooks and trigger native Defender response (isolation device, AAD lockout, email purge).
Do I need to already have Microsoft Defender XDR?
No. Fortgale handles the full cycle: E5/Defender licensing, deployment, Sentinel integration, detection tuning. If you already have the licence, we integrate the SOC on your instance. Otherwise we provide it as part of the service.
How long does activation take?
Microsoft Defender for Endpoint onboarding prend minutes per device. Full MDR activation — Sentinel connectors, KQL detection rules, Playbooks Logic Apps, 24·7·365 monitoring — completes in 7-12 jour ouvrés.
Is the service NIS2-compliant?
Yes. We support NIS2 transposition requirements: monitoring continu, IoC collection for national CSIRT notification sous 24 heures, technical documentation for 72-hour notifications, audit-ready reporting.
Does Defender XDR also cover email and identity?
Yes. Microsoft Defender XDR is a unified platform: endpoint (Defender for Endpoint), email (Defender for Office 365), identity (Defender for Identity, Azure AD), cloud (Defender for Cloud), SaaS (Defender for Cloud Apps). The Fortgale MDR service covers all these domains in a unified console.
Parla con il presidio
Un incontro. Un NDA. Un runbook reale su Defender.
Ti portiamo il Report sul tuo settore con gli attori più probabili e un runbook MDR concreto sulla tua console Microsoft Defender XDR.