Email detections need to enter the SOC workflow without becoming another disconnected console.
The design partner wants usable Microsoft Sentinel cases while the platform owner needs a narrow first version that can be reused.
Who you’d be doing this for
“I copied the sender and remediation details into Sentinel six times before lunch.”
Nuria Iglesias · SOC Analyst
She investigates phishing and business email compromise cases in Microsoft Sentinel at a large Microsoft 365 enterprise.
What is at stake
A design partner’s analysts manually copied case details across 40 sampled investigations. You must weigh a reusable first version against the risk of forcing a new workflow on an already busy SOC.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- SOC familiarity vs connected investigation context
- first-version speed vs reusable architecture
- analyst adoption vs integration scope
- customer specificity vs repeatable deployment
Why Abnormal AI
The Abnormal AI platform already operates alongside Microsoft 365, and a reusable Microsoft Sentinel pattern makes its remediation evidence usable in the customer’s existing SOC workflow.
Written with these in mind
Not your kind of problem? 17 more at Abnormal AI, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.