My expertise is based on Microsoft products: Defender 365 (the Defender suite) and Microsoft Sentinel (SIEM/SOAR)
I would never leave the “automated response” approach (SOAR), but I also see XDR and SOAR as tools, that complement each other.
It’s actually a tough question…
It really depends on your environment
As none of us knows what Azure services you are using, it's hard to come up with hard/direct answers to your question.
In general, however, it’s always a good idea to monitor identities and the security policies around identities i.e.…
