Your firewall is watching network traffic. Your endpoint agent is watching computers. Microsoft 365 records account and file activity. But who connects the information—and who responds when something looks wrong?
Cybersecurity monitoring involves several different jobs: recording activity, detecting threats, preventing harmful actions, investigating alerts, and coordinating a response. Understanding those jobs helps a business choose useful coverage and avoid assuming that one subscription handles everything.
This guide explains IDS, IPS, EDR, MDR, SIEM, identity monitoring, and Microsoft Purview in practical terms for small businesses in Austin and Houston.
First, separate recording, detection, prevention, and response
- Recording: preserve an event, such as a sign-in, permission change, or file download.
- Detection: identify activity that may indicate a threat.
- Prevention: attempt to stop an action through a configured security control.
- Response: investigate, contain the incident, remove attacker access, and coordinate recovery.
A searchable record does not automatically create an alert. An alert does not automatically mean someone investigated it. A blocked process does not establish that every affected account and system is safe.
Cybersecurity monitoring tools at a glance
| Tool or service | Main job | Question to ask |
|---|---|---|
| IDS: Intrusion Detection System | Detect suspicious activity in the traffic or systems it observes. | Who receives and investigates its alerts? |
| IPS: Intrusion Prevention System | Detect and attempt to block suspicious activity. | Is prevention enabled, correctly placed, and tuned? |
| EDR: Endpoint Detection and Response | Monitor endpoint behavior and support investigation and containment. | Are all supported endpoints enrolled and reporting? |
| MDR: Managed Detection and Response | Provide people and processes to investigate and respond using agreed tools and data. | What does the service cover, and what actions can it take? |
| SIEM: Security Information and Event Management | Collect and analyze connected event sources for investigation and detection. | Which sources, detection rules, and retention periods are active? |
| Identity monitoring / ITDR | Identify suspicious use of accounts, credentials, privileges, and identity systems. | Are cloud identities, administrators, and service accounts covered? |
| Purview Audit | Provide searchable records of supported Microsoft 365 user and administrator activities. | Can we retrieve the events we need for the required time period? |
| DLP: Data Loss Prevention | Apply policies to sensitive-data use and sharing in supported locations. | Is the policy auditing, warning, or blocking? |
IDS vs. IPS: detection and prevention
The usual term for IPS is Intrusion Prevention System, sometimes loosely called intrusion protection. IDS identifies possible incidents; IPS adds the ability to attempt to stop them. These capabilities can be network-based or host-based. See NIST’s guide to intrusion detection and prevention systems.
On a network, placement matters. A sensor cannot inspect traffic it never receives, and encrypted traffic can limit inspection. A feature listed on a firewall’s specification sheet is not proof it is licensed, enabled, or operating effectively.
Ask whether the system is alerting only or actively blocking, what traffic it sees, and how exceptions are reviewed.
EDR: what is happening on the computer?
EDR provides endpoint visibility into activity such as processes, files, and connections. Depending on the product, operating system, and policy, response capabilities can include terminating malicious processes, quarantining files, and isolating a device.
For example, an investigation might connect a document-opening event to a suspicious script and an outbound connection. Endpoint context helps explain the sequence rather than showing only a destination IP address.
Coverage needs verification. A laptop missing its agent, an unsupported device, or an unhealthy sensor can create a blind spot. An endpoint agent also should not be assumed to provide complete visibility into cloud mailbox activity performed from an attacker’s computer.
MDR: who investigates and responds?
MDR is a managed service, rather than another name for an endpoint agent. Providers combine analysts, procedures, and security technology to investigate and respond within an agreed scope.
For a small business, the practical value may be having help when the local IT administrator is asleep or occupied. But compare service agreements carefully: hours, monitored sources, escalation procedures, response permissions, and recovery assistance can differ.
A Security Operations Center (SOC) is the team or function carrying out security operations. MDR may be delivered through a SOC. This use of SOC is different from a SOC 2 attestation report.
Ask: can the provider isolate a device or contain an account immediately, or must it contact us first? Who is the backup contact? Who restores business operations afterward? Explore BCS MDR services.
SIEM: connect events from different systems
A SIEM can bring together logs from firewalls, identity systems, servers, endpoints, and cloud applications. Its value depends on connected sources, useful detections, and investigation workflows. Microsoft Sentinel is one example.
An analyst might correlate a suspicious sign-in with a privilege change and subsequent activity on a server. Each event has more meaning when reviewed in context.
A SIEM does not automatically see every device or generate every needed alert. Someone must configure collection, verify ingestion, tune rules, manage cost and retention, and own the resulting incidents. Learn more about SIEM support from BCS.
Identity monitoring: what if the attacker simply signs in?
An attacker may use a stolen password or session rather than install malware on a company computer. Identity monitoring examines accounts, authentication, privileges, and access patterns. ITDR means Identity Threat Detection and Response.
How Microsoft 365 and Microsoft Entra fit together
Microsoft Entra ID provides the identity foundation for Microsoft 365. Its sign-in and audit logs support investigation of authentication and directory activity.
Entra ID Protection adds risk detections, including signals associated with password spraying and leaked credentials. Risk information can inform Conditional Access decisions, such as requiring stronger authentication or blocking access under configured policies.
Defender for Identity adds identity threat investigation across supported on-premises, cloud, and hybrid identity sources. Deployment and connections determine the signals available.
Licensing matters: Microsoft 365 Business Premium includes Entra ID P1. Full ID Protection capabilities, including risk-based policies, require P2 or another qualifying entitlement. A Microsoft 365 subscription should not be assumed to include every Defender, identity, or SIEM capability. Confirm the features and users covered by your actual licenses.
How does SentinelOne do it?
SentinelOne is a platform with multiple capabilities. Specify which products and services are deployed before deciding what it monitors.
- Endpoint protection and EDR: Singularity Complete provides endpoint detection, investigation context, and automated or manual response capabilities. Available actions depend on platform support and configuration.
- Identity security: Singularity Identity describes protection across supported identity environments, including Active Directory and Entra ID, with identity exposure assessment and correlation with endpoint activity.
- SIEM: Singularity AI SIEM provides another layer for bringing together and analyzing security data. Required integrations and ingestion must be configured.
- Managed response: SentinelOne offers Wayfinder MDR with round-the-clock expert detection, investigation, and response. Confirm the purchased service scope.
Installing a SentinelOne endpoint agent does not establish that all four capabilities are licensed, deployed, or monitored. Microsoft Sentinel and SentinelOne are also different products from different companies.
Audit records and Microsoft Purview: what happened to the data?
Microsoft Purview Audit records supported user and administrator operations across Microsoft services. It helps investigators search activity and build a timeline.
Depending on the workload, event type, and licensing, records may show file access, downloads, sharing changes, deletions, or administrative operations. The audited activities catalog explains available events. A file-access event does not, by itself, prove a person read or understood its contents.
Purview audit records and Entra sign-in logs answer related questions, but they are different sources with different coverage and retention rules. Use the sources needed for the investigation.
Recording an event is different from monitoring it
Purview Audit supports searching and investigation. Keeping records alone does not establish that suspicious behavior triggers an alert or that an analyst reviews it. Detection policies, integrations, and response ownership must be configured separately as appropriate.
Retention, permissions, and reliable evidence
Microsoft documents a default 180-day retention for Audit Standard. Qualifying Premium licensing provides one-year default retention for specified workloads and licensed users; longer retention may require additional entitlements and policies. Confirm the particular users, events, and policies rather than assuming every record has the same lifetime. See Microsoft’s audit search and retention guidance.
Document who can search or export records. Test that expected events are being collected and can be retrieved. For an investigation, preserve original exports, the query and time range, time-zone details, and how evidence was handled. Review access and tamper protections across the logging workflow.
Retention of business documents or email is a separate decision from retention of audit records. Increasing retention later generally cannot recover records that have already expired.
Purview DLP and Insider Risk Management
Purview DLP can identify sensitive information and apply configured policies in supported locations. Depending on the scenario and policy, it may record, warn about, or restrict activity. Audit-only settings should not be mistaken for blocking.
Insider Risk Management correlates configured indicators to help investigate potentially risky activity. An alert is a lead for review, not a finding of employee misconduct. Apply appropriate permissions, privacy controls, and investigation procedures.
These capabilities complement endpoint and identity security. They address data activity and policy questions that malware detection alone may not answer. Explore our Microsoft Purview setup, support, and licensing guide.
Example: a stolen account, no malware on the company laptop
Consider this illustrative scenario: an attacker uses a stolen session to access a cloud account, changes a sharing setting, and downloads business files.
- Identity signals may help identify suspicious authentication or account behavior.
- Audit records may help reconstruct supported sharing and file operations.
- DLP or insider-risk policies may identify relevant data activity where the necessary coverage is configured.
- A SIEM or XDR platform may correlate the available signals into an investigation.
- The response team investigates scope, contains access, reviews persistence and data exposure, and coordinates corrective work.
This scenario illustrates why healthy endpoint software alone does not establish complete cloud-account coverage. No layer guarantees detection of every attack.
More monitoring capabilities to consider
- XDR: Extended Detection and Response. Connect supported endpoint, identity, email, and application signals. Microsoft Defender XDR is one example. Coverage depends on the connected products.
- SOAR: Security Orchestration, Automation, and Response. Use approved playbooks to coordinate actions across integrated tools. Define permissions, exceptions, and human approval where needed. Read our SOAR explainer.
- Network Detection and Response (NDR). Evaluate visibility into network behavior, including relevant internal traffic and devices that cannot run an endpoint agent.
- Email and SaaS monitoring. Include suspicious forwarding, application permissions, sharing changes, and other relevant cloud activity in the monitoring plan.
- Vulnerability and configuration monitoring. Track missing updates, exposed services, excessive privileges, and configuration changes before they become incidents.
- Monitoring the monitoring tools. Alert on missing agents, stopped log collection, failed connectors, disabled policies, and unreviewed exceptions.
- Backup and recovery monitoring. Review failures and perform recovery exercises; a successful backup job is only part of recovery readiness.
Uptime monitoring and cybersecurity monitoring have different jobs
Remote Monitoring and Management (RMM) tools and Network Operations Center (NOC) services often focus on operational health: disk capacity, service availability, updates, and device status. Some platforms include security features, but an uptime dashboard does not establish that a security team is investigating account compromise or data theft.
A server can be online and healthy from an availability perspective while an attacker abuses a valid account.
Before buying another tool, verify your coverage
Start with an inventory of critical systems, identities, and data. For each, document what is recorded, which detections are enabled, what can be blocked, how long evidence remains available, and who responds after hours.
Then test the workflow with an authorized, controlled exercise. Confirm that the expected event reaches the right system, produces the expected notification, and reaches someone who knows what to do. Close uncovered gaps and reassess after significant changes.
For compliance projects, connect the monitoring plan to your applicable requirements and evidence needs. A dashboard or product subscription alone does not establish SOC 2 readiness or CMMC compliance.
Cybersecurity monitoring support in Austin and Houston
Business Communication Solutions helps businesses review security coverage, configure agreed tools, organize evidence, and clarify responsibilities across internal IT staff and service providers. Start with the systems and information that matter most to your business.
Explore our cybersecurity services, SOC 2 readiness support, and CMMC consulting.
Austin: 512-257-1433 Houston: 281-815-8784
Contact BCS to discuss your monitoring coverage.
What do you think?
Could your team explain what happens after a suspicious sign-in, endpoint alert, or unusual file download? Which area needs the most attention: visibility, evidence, or response?