Design security operations, identity, and compliance capabilities

Add Microsoft Sentinel in the Defender portal, ingest the acquired systems' events into the data lake tier, and run detection rules across them and the Defender XDR data.

Onboard the acquired servers to Microsoft Defender for Endpoint, add the firewalls through authenticated network scans, and run detection rules across the resulting Defender XDR data.

Add Microsoft Sentinel in the Defender portal, ingest the acquired systems' events into the analytics tier, and run detection rules across them and the Defender XDR data.

Send the acquired systems' logs to Microsoft Defender for Cloud Apps through a log collector, and run detection rules across the discovered activity and the rest of the Defender XDR data.