Microsoft Sentinel: detects, correlates and responds at two in the morning.

Arcetec is a Microsoft Partner and deploys Microsoft Sentinel, the SIEM for the agentic era: it correlates signals from across the operation (identity, endpoints, cloud and network) and runs playbooks on its own: isolating a device, revoking a session, enforcing the second authentication factor, opening a ticket and notifying the owner in Teams, in seconds and with a log of every action. Today's Sentinel includes the data lake in general availability, a security graph that correlates across domains, Security Copilot agents working in the SOC and playbooks generated from natural language; it also exposes its own MCP server for agents, and security operations are unified with Defender in a single portal. Arcetec's job is to deploy it to fit: first designing which signals are worth ingesting (paying to ingest everything without criteria is the classic mistake), writing detection rules for the client's specific operation, having the playbooks in place before the incident and running the tuning so there are fewer false positives every month. You don't need your own SOC to get started: the approach is sized to each company. Engagements begin with a conversation and a scoped assessment, with fixed scope and price. We operate from Cajicá, Cundinamarca.

Sentinel correlates signals from across your operation and runs playbooks on its own: isolating a device, revoking a session, notifying the owner. The SIEM for the agentic era, deployed to fit your needs.

The response is written before the incident
You ingest what's worth it, not everything
Every automated action is logged

Panel de Microsoft Sentinel con los incidentes de seguridad del día, cada uno con su severidad, y un playbook de respuesta automática ya en ejecución: la sesión se revoca y el segundo factor se exige sin que nadie tenga que despertarse.

See the pillar page

Today's Sentinel

If you evaluated it two years ago, you evaluated a different product. Four new pieces, all of them serious.

Data lake in general availability — Years of signals you can query without paying for a classic SIEM's hot storage: retrospective investigation stops being a luxury.
Security graph to correlate across domains — The suspicious session, the odd endpoint and the unusual access stop being three separate alerts: the graph joins them into a single incident with a history.
Security Copilot agents in the SOC — First-line triage is handled by agents: they classify, filter out noise and escalate with context. The human analyst gets to what actually needs them.
Playbooks generated from natural language — “If this happens, isolate the device and notify the owner” is written just like that, in words — and it becomes the playbook that carries it out.

What Arcetec does.

Turning on Sentinel takes an afternoon; a Sentinel that detects what matters in your operation has to be built. Four fronts.

Deployment and signal connection — Identity, endpoints, cloud and network flowing into the same place — with judgment: first we design which signals are worth it, because ingestion is paid for.
Detection rules tailored to you — Your operation is like no one else's: what is noise at another company may be the signal at yours. Rules are written for your context, not copied from a template.
SOAR playbooks — The response written before the incident: isolate the device, revoke the session, notify the owner — decided calmly on a Tuesday, not improvised at two in the morning.
Operations and tuning — Fewer false positives every month: the rule that fires too often is adjusted, the one that stays too quiet is tightened, and the dashboard shows the trend.

The platform, by the numbers

Sentinel for the agentic era, in what is already generally available.

GA — Sentinel data lake
SOAR — playbooks in natural language
MCP — Sentinel exposes its own server for agents
1 — portal: unified SecOps with Defender

Questions we get before getting started

Do we need our own SOC?

Not to get started: the playbooks cover the immediate response (isolate, revoke, notify) and the operating model is sized to your company. A twelve-person SOC is the solution for a different scale; yours can start with automated response and monthly tuning.

How much does ingestion cost?

First we design which signals are worth it: paying to ingest everything without criteria is the classic mistake in SIEM projects. With the data lake, cheap historical data and limited hot data, cost is decided by design — and the assessment gives you an actual number.

What exactly does a playbook do?

Whatever we define: isolate a device, revoke sessions, enforce MFA, open a ticket, send an alert in Teams — in seconds and with a log of every action. The rule is that the response is decided calmly before the incident, not improvised during one.

Does it integrate with what we already have?

Sentinel has connectors for the usual signals (identity, endpoints, clouds, firewalls) and, for anything built in-house, there's our MCP: your own system can also report what it sees and take orders from a playbook.

Incidents don't wait for office hours.

We'll show you what automated response would look like for your operation: which signal comes in, which playbook runs and who gets notified — before a real incident puts it to the test.

Schedule the session

Artículos sobre cybersecurity

Topic:Cybersecurity