Oreta replaced the legacy SIEM with Microsoft’s Sentinel platform aligned to Costa’s Microsoft ecosystem and operational realities. The solution delivered multi-region Sentinel workspaces for centralised visibility and regional resilience, ingesting logs from Microsoft 365, Microsoft Defender for Endpoint, Azure AD, on-premises firewalls, and SCADA gateways. Detection content was tailored to agricultural operations and regional threat landscapes.
Eighteen data connectors were configured to provide comprehensive telemetry, supported by fourteen high-fidelity analytics rules and twenty-two workbooks delivering role-based dashboards and real-time insights. SOAR playbooks were implemented to automate triage, enrichment, containment, and escalation, standardising response and reducing manual effort.
The platform was integrated with ITSM workflows and aligned to Oreta’s Managed SOC operating model, with clear escalation paths, role-based access controls, and detections mapped to the MITRE ATT&CK framework. The solution was designed in line with the Azure Well-Architected Framework to ensure scalability, security, reliability, and cost optimisation.
