How are you integrating Microsoft Defender for Endpoints into your SOAR platform?

Just curious what others are doing with regards to SOAR and MDE integrations. It's tricky to figure out what is the best flow when dealing with incidents from MDE and how to handle the automation and orchestration within a SOAR platform.

Do most of you folks try and sync incidents into SOAR and work them there?

Or do you work with alerts and execute playbooks based on those?

Do you have analysts that still work within the MDE platform as …

automation automation and orchestration cybersecurity defender doing endpoints flow incidents integrations microsoft microsoft defender orchestration platform soar soar platform try what is