A deployed EDR is not proof. Its coverage is.
At NHOOD, there was no shortage of security data. It was scattered: the EDR (Endpoint Detection and Response) and the asset management tool each told part of the story, with no CMDB (configuration management database) to tie them together. Microsoft Sentinel could have handled it, provided every KQL (Kusto Query Language) query was written by hand. NHOOD took another path. With OverView, integrated by OverSOC, the security team runs its metrics day to day, secured two tool migrations and keeps its compliance evidence close at hand. After a competitive review, the contract was renewed.
Sébastien Lozé, Security Operations Manager at NHOOD, told the story of this project during the webinar of 15 October 2026. The recording is at the top of the page, in French.
Context
A real estate company, an information system that has to account for itself
NHOOD designs, transforms and runs places, with a four-word promise: "des lieux en mieux", better places. Engaged in an ISO 27001 program, the company now has to show that it is in control of its information system. Saying so is no longer enough.
At the helm is Sébastien Lozé, Security Operations Manager. He builds the metrics, runs the security committees and tracks the compliance roadmap. And because he has kept a taste for the technical side, he also gets his hands dirty: sources, expressions, dashboards.
| The setting, in three numbers | ||
|---|---|---|
| 0 CMDB | Dedicated asset management tool | A purchase considered, never made. |
| ISO 27001 | Compliance evidence | One requirement: prove it, don't declare it. |
| Year 2 | With OverView | Renewed at the end of the first year. |
"Proving your maturity by saying 'I've rolled out an EDR' is fine. But if it isn't on any asset, it's worth nothing."
Challenges
Plenty of data, no single source of truth
At the start, NHOOD's request was clear: metrics to really measure its level of security. And a solid base to improve on, month after month.
Then regulation entered the picture. ISO 27001 does not ask for the list of tools you bought. The standard wants to know which assets those tools actually run on.
The problem: the data was scattered. The EDR and the asset management tool each saw their own slice of the infrastructure, and no CMDB was there to tie them together. Sentinel and Elastic could do the job, on paper. But every metric still had to be written by hand.
Limit 01: an infrastructure seen in pieces. Each tool describes its share of the assets. The assets none of them sees stay off the radar.
Limit 02: dashboards reserved for experts. In Microsoft Sentinel, every metric goes through a KQL query. The team tried, and ran into the complexity.
What the team was really after: measuring its security rather than assuming it. And having the evidence auditors ask for.
"We could build our dashboards directly in Sentinel. We've tried, and we struggle. It's far more technical."
Why OverView
A proven tool, a POC, three decision criteria
When Sébastien Lozé joined NHOOD, the conversation with OverSOC had already started. He knew the product well: he had followed OverView since its very first versions and had already rolled it out on a previous assignment. His experience confirmed the choice.
NHOOD ran a POC (proof of concept). The OverView team supported the project and took the integration in hand from A to Z. Three criteria tipped the balance.
- Metrics without code. Build a metric without a KQL query, then track it day to day.
- A layer on top, not a replacement. OverView plugs into the EDR and the MDM (Mobile Device Management) already in place. No tool to replace.
- A controlled cost. A price in line with the service, nowhere near that of a SIEM (security information and event management) or an observability platform.
| Split of roles | |
|---|---|
| NHOOD, security | States the needs, creates the metrics, runs the security committees. |
| NHOOD, workstations | Reads dashboards built for the device teams. |
| OverSOC | POC, full integration of the sources, support. |
From declaring to proving: prove it, don't declare it. The question is no longer whether a tool is deployed, but how much of the infrastructure it covers. Share of workstations protected, encrypted, up to date: maturity is shown in numbers. Every ISO 27001 audit asks the same question, and upcoming regulations will raise the bar further.
Implementation
A turnkey integration, sources under control
OverSOC handled the entire integration, and every source added is documented step by step. NHOOD's security team could keep its energy for the real question: what does it want to measure?
Once the connectors are in place, OverView warns as soon as a source has failed to sync, and lets the team rerun it. A detail? Not for a security lead: a metric is only as good as the freshness of the data behind it.
NHOOD's stack connected to OverView: SentinelOne (EDR), CrowdStrike (EDR), Intune (MDM), LANDesk (asset management).
| Project steps | |
|---|---|
| 01 · POC | Validated on NHOOD's sources |
| 02 · Integration | Done by OverSOC, end to end |
| 03 · Security metrics | Created and run by the security team |
| 04 · Renewal | Second year signed |
| Before OverView | Now, with OverView | What it enables |
|---|---|---|
| One dataset per tool, no overall view | A unified, deduplicated inventory | A cyber CMDB without a dedicated tool |
| Dashboards to write in KQL | Metrics built within a day | Security committees prepared faster |
| Syncs nobody could see | An alert for each source that fails to sync, with a rerun | Numbers based on up-to-date data |
"I found the integrations with the tools very simple. Everything is well documented when you add a data source."
Results
Three uses, two of them unplanned
NHOOD came for security metrics. The teams found a little more. Along the way, OverView made up for the missing CMDB, then secured two major tool migrations. Two benefits that appeared in no specification.
Planned use: security metrics, day to day. Created and run continuously. They feed the security committees and the audit evidence.
Bonus 01: a cyber CMDB, without a CMDB. OverView aggregates and unifies the data. NHOOD knows its assets.
Bonus 02: migrations with no loss of coverage. Old and new tool connected side by side. Coverage stays at least the same.
The use case to remember: switching EDR without losing sight of coverage. CrowdStrike → SentinelOne. During the switch, the old and the new EDR were connected side by side in OverView. The team tracked the rollout asset by asset, checking that the new tool covered at least the scope of the old one. The tools change; the inventory stays. Same method for asset management: LANDesk → Microsoft Intune.
Against Sentinel and Elastic, simplicity made the difference
At NHOOD, no tool is renewed out of habit. Before renewing, the team put OverView up against the solutions already in-house: Microsoft Sentinel, the company's SIEM, and Elastic, used for observability.
Sentinel had a serious advantage: it was already paid for. On paper, it offered the same dashboards. In practice, every metric is coded in KQL. Elastic demands the same gymnastics, with a storage bill on top. The verdict: OverView stays.
| OverView | Microsoft Sentinel | Elastic | |
|---|---|---|---|
| Building a metric | Within a day, no code | A week, in KQL | Dashboards to write |
| History | The life of the contract (Enterprise plan) | 90 days | Retention billed on top |
| Profile required | Governance or technical | 100% technical | Technical |
| Cost | In line with the service | Already owned, costly in time | More expensive |
Source: NHOOD's own experience, on its own scope.
"With OverView, I build a KPI or a dashboard within a day. With Microsoft Sentinel, it takes me the week. And even then, I wouldn't get the result."
What NHOOD's story teaches
Beyond the tool, NHOOD's experience sketches a method. Four lessons for any security team that wants to move from gut feeling to evidence.
Start from the tools you have. With no CMDB, NHOOD built a reference inventory from what it already ran: EDR and MDM. No new asset management tool was needed.
Tell two audiences apart. The CISO or the GRC (governance, risk and compliance) team states the need; the technical profile turns it into metrics. A tool that speaks to only one of them ends up underused.
Don't start from a blank page. Faced with an empty dashboard, adoption stalls. A base of standard metrics changes that: EDR coverage, patches, encryption.
Track a migration through the data. Connecting the outgoing and the incoming tool side by side shows, asset by asset, that no coverage was lost.
What NHOOD expects next
AI: from a need to a metric. State a need in plain language, for instance EDR coverage of workstations and Macs, and get the metric. This is now possible directly in OverView with Workbench.
Permissions: role-based views. Give each team access to its own dashboards only. A prerequisite for large organizations.
To place your own infrastructure: the metrics simulator lists, from the tools you already run, what OverView could compute by cross-referencing them.
Sources: NHOOD × OverSOC interview with Sébastien Lozé, Security Operations Manager at NHOOD, 15 July 2026, and the webinar of 15 October 2026. OverSOC, OverView: www.oversoc.com/en/. NHOOD: www.nhood.com.