How to tell whether you have this
Ask two questions. How long are security logs kept, and who looks at them.
If the answer is that your provider handles it, ask them for last month’s. The response to that request tells you what you need to know, and it costs you nothing to make.
Why it happens
Defender licensing comes bundled with the subscription. Nobody is assigned to configure it properly, it is not obviously broken, and nothing forces the question until something forces it very hard indeed.
The asymmetry is what makes this urgent before it looks urgent. The routine question is retention and review. The other one arrives after an incident, from a client or an insurer, and it is some version of when did this start and what else did they touch. If nothing was collecting at the time, that question has no answer and no amount of later effort produces one.
How I would approach it
- Establish what your licensing already entitles you to. In most small firms a substantial part of the answer is bought and switched off, so this is configuration and architecture rather than procurement.
- Decide retention by purpose rather than uniformly. Investigation and reporting want different things from the same data, and paying to keep everything at investigative fidelity is how monitoring gets declined on cost.
- Build the pipeline. Telemetry into a queryable store, with a separate write-once archive for anything that has to survive as evidence.
- Split alerting in two. Urgent, event-driven alerts that arrive in seconds and do not depend on the dashboard being healthy, kept apart from a pattern and threshold tier on a daily digest.
- Put the tuning behind regression tests. Noise reduction that can silently drop coverage is not noise reduction, and that is the failure mode this work has.
- Build for two audiences. An operational view for whoever runs it, and an at-a-glance view for whoever has to answer the question.
What you end up with
Something that can answer a question about last March. That sounds modest until the month somebody asks.
On the engagement below it runs at roughly A$160 a month for the full monitored estate, which is the figure that matters most at this size, because monitoring is usually declined on price rather than on principle.
Seven resilience guards sit underneath it. One of them, an end-to-end delivery canary, paid for itself by detecting a live alerting outage caused by a credential rotation and driving the fix. Without it the first sign of failure would have been a quiet gap in the record found months later.