Who does what
Provider
- Detection service operation
- Alert investigation
- Incident coordination
Your team
- Azure subscriptions and access
- Detection priorities
- Approvals and remaining recovery
Coverage
- Cloud Workloads
Details
Service scope
Best for Shared SOC work on Microsoft Sentinel
Offer
CWATCH managed SOC for Microsoft Sentinel, with deployment and recurring services.
Workflow
Collected logs support detection and investigation, followed by coordinated incident handling.
Boundary
24/7 coverage and major-incident CERT work must be agreed for this package.
Full service analysis
Almond CWATCH for Sentinel operates log collection and detection in the customer's Azure environment, investigates alerts and supports incident handling. The buyer retains the Azure subscription, response approvals and recovery work outside the agreed SOC and CERT scope.
- Your team owns
- Azure subscriptions, source access and agreed detection priorities.
- Response approvals and operational recovery outside the contracted SOC or CERT work.
Pricing & contract
- Billing
- Custom
Request a CWATCH for Sentinel quote separating deployment, recurring SOC work, Microsoft consumption and licenses. Confirm 24/7 analyst coverage, log retention, CERT activation and recovery charges.
Tradeoffs & buying questions
Strengths
-
Logs remain in the customer's Azure subscriptions.
Considerations
-
Routine SOC handling and major-incident CERT intervention need separate scope and coverage checks.
Ask before buying
- Which incident actions can CWATCH execute automatically, and when must an analyst or our team approve them?
- Does our Sentinel package include staffed 24/7 investigation, and when does a major incident activate additional CERT work?
- Who pays Azure ingestion and retention charges, and which detection rules and investigation records can we keep at exit?
Integrations
Platform / SIEM
- Microsoft Sentinel
Other integrations
- Microsoft Defender
- Azure Log Analytics
- Qevlar AI
Common questions
Does this include the whole Almond ROC portfolio?
The wider ROC also includes IT operations, vulnerability work and recovery. Confirm which services are in the Sentinel contract and which require an additional engagement.