#soc-architecture 1 post tagged soc-architecture. One Event, Three Portals: How a Single Sysmon Line Becomes a Microsoft Defender XDR Incident Jun 3, 2026 Trace a single Sysmon ProcessCreate event through six hops -- from Windows kernel emission to a unified Microsoft Defender XDR incident -- and where the convergence stops.