SOC providers with their own platform

Alert Logic's MDR analysts investigate cloud and hybrid alerts, then escalate verified incidents with evidence and recommended actions.

You still own Containment, remediation, connected tools and approval of response workflows

Armis Managed Threat Services investigates Centrix findings, hunts for threats and tunes detection policies.

You still own Containment, remediation, connected controls and the broader SOC workflow

CGI Protective Monitoring correlates logs, validates suspicious events and sends incident tickets with containment or eradication advice.

You still own Containment and recovery, Incident-response staffing

Bits Security Analyst queries security data and investigates eligible Cloud SIEM alerts automatically, then supplies findings and suggested next steps.

You still own Reviewing findings, handling uncovered alerts, containment and recovery

Forescout Assist investigates eyeAlert detections and escalates confirmed incidents with response guidance.

You still own Platform and source health, containment, remediation and recovery

Microsoft hunters investigate emerging threats in eligible Defender telemetry and give your SOC remediation guidance.

You still own Incident response, containment, recovery and excluded telemetry

24/7 analyst investigation and response guidance using SOCSoter network telemetry and SIEM.

You still own Network feeds, remediation, infrastructure changes and recovery

Acronis TRU Advanced MDR executes permitted incident response through Cyber Protect Cloud.

You still own Deployment, critical-device approvals and recovery authorization

Arctic Wolf's Aurora MDR investigates alerts and contains threats through configured integrations, supported by a named Concierge Security Team.

You still own Connected tools, response permissions and remediation outside configured containment

Barracuda Managed XDR investigates alerts and automates containment through purchased modules and supported endpoint, email, identity and firewall integrations.

You still own Connected tools, response permissions and remediation outside automated actions

Bitdefender MDR analysts investigate GravityZone alerts and take pre-approved containment actions within your licensed endpoint and XDR coverage.

You still own Response policy, recovery and systems outside licensed GravityZone coverage

Blackpoint's CompassOne MDR investigates endpoint and cloud threats, isolating devices or disabling accounts within agreed response authority.

You still own Deployment, response policies, remediation, recovery and MSP client communication

Blumira Managed pairs its Automate platform with 24/7 analyst review of high and critical cases and approved containment in Microsoft identity and Blumira-covered endpoints.

You still own Source and agent coverage, low and medium cases, approvals, remediation and recovery

Cisco analysts investigate supported XDR components and execute containment allowed by the response playbook.

You still own Component health, response authority, remediation and recovery

Falcon Complete analysts investigate, contain and remediate threats through CrowdStrike's Falcon platform under pre-approved playbooks.

You still own Falcon deployment, response approvals, business exceptions and out-of-scope coverage

Cybereason MDR Complete investigates endpoint threats and performs specified remediation. Host isolation requires written approval.

You still own Endpoint deployment, isolation approval and wider incident response or recovery

Darktrace investigates Enhanced Monitoring alerts and applies supported containment actions within its platform.

You still own Deployment health, response rules, follow-up analysis and remediation

24/7 ESET endpoint investigation and containment, with configurable restrictions for critical devices.

You still own Software deployment, critical-device permissions and recovery

Field Effect supplies an MDR platform and SOC that investigate threats and contain them under buyer-selected response policies.

You still own Agent deployment, response policies, recovery and incident response beyond MDR scope

Standard MDR investigates FortiEDR alerts and contains endpoint threats under agreed playbooks.

You still own Agent deployment, action permissions and recovery beyond contracted response

Heimdal SOC investigation and containment with response permissions set by module.

You still own Module choices, notification-only response and broader recovery

Huntress analysts investigate endpoint, identity and SIEM alerts, then perform supported containment within enabled modules and permissions.

You still own Deployment, permissions, manual remediation, recovery and client communication

Kaseya MDR investigates endpoint, Microsoft 365 and firewall activity and performs configured containment and remediation.

You still own Onboarding, coverage, permissions, response rules and recovery

CrowdStrike-backed MDR with Kroll response operations, incident investigation and scoped remediation.

You still own Deployment access, approvals and business recovery outside scope

Eligible Lumu Defender accounts can enable Autopilot to manage incidents alongside configured blocking. Your team sets policies and handles escalated investigations and recovery.

You still own Activation, response permissions, connected controls, complex investigations and recovery

mnemonic investigates threats through Argus and provides containment through contracted response modules.

You still own Deploy agents and connect agreed sources

Guardian xMDR Core combines Cortex monitoring with human investigation and containment playbooks from a Dutch SOC.

You still own Response permissions, source connections and recovery beyond scope

Investigates covered Cortex incidents and executes scoped endpoint containment around the clock.

You still own Platform upkeep, action permissions, incident declaration and wider recovery

Rapid7 investigates through its SIEM and executes configured containment, with limited enabled remediation.

You still own Agent and source coverage, permissions, excluded detections and recovery

Wayfinder MDR investigates Singularity alerts and executes approved containment or mitigation through SentinelOne's platform.

You still own Singularity deployment, telemetry coverage, response authorization and business recovery

CrowdStrike-based endpoint investigation and initial containment delivered through SonicWall's SOC for MSPs.

You still own Agent deployment, policy upkeep, escalated investigation and recovery

T-Systems investigates endpoint threats and executes host, process and file containment through its SOC.

You still own Action permissions, business decisions and wider recovery

ThreatDown Elite endpoint investigation and containment through Nebula or OneView.

You still own Agent deployment, response permissions and broader recovery

Analysts investigate subscribed Trend sources and perform supported containment under your approval settings.

You still own Product deployment, response permissions, endpoint exceptions and wider recovery

24/7 investigation, authorized containment and endpoint remediation using Vectra and connected tools.

You still own Tool licenses, action permissions and out-of-scope recovery

Elements MDR analysts investigate and perform authorized endpoint containment. Identity MDR is an add-on.

You still own Sensors, on-call contacts, action permissions and out-of-scope recovery

Adlumin MDR by N-able investigates and contains threats through a shared XDR and SIEM platform. Your team maintains controls and handles work outside the package.

You still own Connected tools, response permissions, escalation rules and work outside the package

ITrust operates Reveelium detection and shares incident investigation and resolution with the customer's IT team.

You still own System context, assigned response actions and recovery beyond scope

plusserver operates hosted QRadar and investigates alerts, with incident handling shared through the customer's response process.

You still own Interfaces, incident ownership and response outside the management level

Sopra Steria SOC Core provides UK monitoring, investigation and ongoing SIEM work alongside the customer's incident team.

You still own Asset context, incident ownership and response tasks outside the selected tier

Todyl analysts share SIEM investigations, tune detections and coordinate response with the MSP.

You still own Tenant policy, access, client communication and recovery