Let´s talk

Case studies

Replacing a Legacy SIEM Solution with Actionable Threat Response Using Microsoft Sentinel

Costa Group is a global primary producer operating across Australia, New Zealand, South East Asia, and South America. Its hybrid environment spans farms, production facilities, logistics depots, and cloud-based ERP and SCADA systems, supporting complex supply chains and strict export controls. 

To modernise security operations and better integrate with its Microsoft 365 and Defender investments, Costa partnered with Oreta to implement a Microsoft Sentinel-driven SIEM and SOC capability tailored to both IT and operational technology environments. 

Challenges

Costa’s legacy SIEM identified unusual activity but lacked actionable insight, contextual correlation, and response automation. Alerts generated significant noise, overwhelming a lean IT team, while the absence of centralised log ingestion limited visibility across cloud, on-premises, and SCADA systems. Integration with Microsoft 365 Defender was minimal, and there was no formal SOC capability to triage, contain, or escalate threats. 

At the same time, Costa faced increasing regulatory requirements under ISO 27001, the ASD Essential Eight, and export security controls. Without unified visibility, auditable processes, and scalable operations, meeting these obligations consistently was becoming increasingly difficult. 

Solution

Oreta replaced the legacy SIEM with Microsoft’s Sentinel platform aligned to Costa’s Microsoft ecosystem and operational realities. The solution delivered multi-region Sentinel workspaces for centralised visibility and regional resilience, ingesting logs from Microsoft 365, Microsoft Defender for Endpoint, Azure AD, on-premises firewalls, and SCADA gateways. Detection content was tailored to agricultural operations and regional threat landscapes. 

Eighteen data connectors were configured to provide comprehensive telemetry, supported by fourteen high-fidelity analytics rules and twenty-two workbooks delivering role-based dashboards and real-time insights. SOAR playbooks were implemented to automate triage, enrichment, containment, and escalation, standardising response and reducing manual effort. 

The platform was integrated with ITSM workflows and aligned to Oreta’s Managed SOC operating model, with clear escalation paths, role-based access controls, and detections mapped to the MITRE ATT&CK framework. The solution was designed in line with the Azure Well-Architected Framework to ensure scalability, security, reliability, and cost optimisation.

Outcome

  • 85 percent reduction in time to action on real-world threats 
  • Automated SOAR workflows significantly reduced alert fatigue and dwell time 
  • Improved compliance alignment with ISO 27001 and the ASD Essential Eight 
  • Reduced costs through tool consolidation and optimisation across Sentinel and Microsoft Defender 

Other Case Studies

Overcoming Legacy Challenges with Azure: NCI Builds a Scalable, Secure and Cost-Optimised Platform

National Can Industries (NCI) is a leading Australian metal packaging manufacturer with nationwide sites, delivering food and industrial solutions powered by robust, compliant IT systems.

Beyond Alerts and Incidents: Empowering a Mid-Sized Organisation with End-to-End Managed Security

Oreta empowered a 1,500-employee construction firm with a managed security service that simplified operations, enhanced visibility, and strengthened protection across its digital infrastructure.

Achieving Zero Interruptions and Greater Visibility with Unified Network Security

Costa Group, Australia’s top fresh produce grower, upgraded its global network infrastructure to enhance secure, reliable, and scalable connectivity across its international operations.

We empower businesses to thrive by delivering tailored cloud, security, network, and telco solutions. Through advisory, delivery, and managed services, we partner with our customers to innovate, connect, and achieve lasting impact.

Melbourne Office

Level 7, Tower 2
727 Collins Street
Melbourne, VIC 3000

Dubai Office

The Offices 5, Level 3,
Office 303,
One Central Dubai
World Trade Centre
Dubai, United Arab Emirates

Sydney Office

Level 11, 14 Martin Place
Sydney NSW 2000

India Office

11th floor, Plot No. I-56, IT City, Sector 83A, Mohali, Punjab – 140308

Enquiries

Follow us:

Privacy policy
Conrade Pty Ltd, trading as Oreta. All Rights Reserved.
2026

Let's talk