Topic starter
25/06/2026 1:22 am
TL;DR: Investigation speed now depends on whether identity telemetry is usable at decision time, not just visible somewhere else, according to Semperis. It describes a Microsoft-native integration that streams Lightning Intelligence into Sentinel and Security Copilot, giving SOC teams identity context on exposure, Tier 0 paths, and posture inside existing workflows rather than in a separate console.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “Bringing Identity Context Into the Microsoft Security Workflow: Semperis’ Integration with Sentinel and Copilot”.
Key questions
Q: How can SOC teams respond faster when identity risk shows up in security investigations?
A: SOC teams respond faster when identity context is embedded directly in existing workflows, so investigators can assess access, privilege, and governance signals without leaving the SIEM.
Q: Why does identity context reduce SOC response time?
A: Because analysts lose time whenever they must switch tools to understand whether an identity alert is truly dangerous.
Q: What happens when identity posture data stays outside the SIEM?
A: The SOC sees signals without the surrounding identity picture, which slows investigation and weakens prioritisation.
Practitioner guidance
- Map identity telemetry to SOC questions Define the identity questions your analysts need answered during triage, then structure telemetry so exposure, Tier 0 paths, and posture can be queried directly in Sentinel.
- Normalize identity data into queryable tables Use a consistent table model for identity posture data so KQL searches, hunting logic, and analytics rules operate on the same governed sources.
- Set retention and deduplication rules for identity logs Align append-only identity feeds with retention tiers, duplicate handling, and review windows so historical lookbacks remain usable without bloating cost.
Bottom line: Identity telemetry only changes SOC outcomes when it is available inside the response workflow, not in a separate specialist console.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:43 am
Identity risk only becomes actionable when it is available at the point of investigation. The long-standing problem in identity security is not that defenders lack telemetry, but that the telemetry arrives outside the SOC workflow where decisions are made. When exposure and attack-path data sit in a separate console, response speed degrades and identity becomes a reporting layer rather than an operational control plane. Practitioners should treat this as a workflow design problem, not a visibility problem.
A question worth separating out:
Q: Should security teams let AI assistants query identity telemetry directly?
A: Yes, but only through governed tables and approved query paths. AI assistants are most useful when they accelerate structured evidence retrieval, not when they broaden access to raw identity data. The control point is data governance, query scope, and analyst role boundary, not the chatbot interface itself.
👉 Read our full editorial: Semperis, Sentinel and Copilot put identity risk into SOC flow