Who does what
Provider
- Operate security tools and detections
- Investigate and manage cases
- Contain and coordinate response
Your team
- Provide access and source configuration
- Maintain contacts and make decisions
- Apply assigned remediation
Coverage
- Endpoints
- Identity & Access
- Cloud Workloads
Details
Service scope
Best for Organisations outsourcing recurring Microsoft security operations while retaining business oversight and wider IT support
Daily operations have a boundary
24/7 detection and response cover named systems. Routine tooling management runs during business hours.
Containment can precede approval
Enable containment access and source logs. ANS may contain significant incidents before formal approval. You retain decisions and assigned remediation.
Hunting and forensics differ
Hunting requires a contract inclusion. Digital forensic analysis and onsite support are separate.
Full service analysis
ANS Managed Detection and Response runs daily operations for the Microsoft security tools in scope, maintaining detections, investigating alerts and coordinating incident handling. You provide access and log-source configuration, make timely incident decisions and carry out remediation assigned to your team.
- Your team owns
- Provide access, response permissions and log-source configuration unless separately managed
- Maintain emergency contacts and make timely decisions
- Apply assigned remediation and arrange work beyond contracted support
Daily operations have a boundary
ANS manages detection rules, data flow, tool availability, investigations and incident coordination. Monitoring and response run 24/7, while routine tooling management is during business hours. Only the products and systems named in the agreement are covered.
Containment can precede approval
Customers must enable containment access and configure source logs unless separately managed. During a significant or destructive incident, ANS may apply short-term containment before formal approval. Your team supplies timely decisions and applies remediation recommendations assigned to it.
Hunting and forensics differ
Threat hunting is delivered when contracted. Digital forensic analysis is excluded from routine incident management, and onsite support carries additional charges. Agree the resolver and recovery handoff alongside the monitoring service.
Pricing & contract
- Billing
- Custom
Quote the supported Microsoft tools, data consumption and service scope together. Threat hunting must be contracted, and onsite work, extra integrations and specialist forensics can require separate services.
Tradeoffs & buying questions
Strengths
-
Combines tooling operation with incident ownership
-
Defines customer access and decision responsibilities
Considerations
-
Routine tooling administration has business-hour coverage
-
Threat hunting must be included in the contract
-
Digital forensics and wider infrastructure work are separate
Ask before buying
- Which tools and response actions are in scope, and when can ANS contain a threat before our approval?
- Which resolver team owns eradication and recovery for each system, and when does specialist forensics require a separate engagement?
- What Microsoft consumption, hunting, integration work and export rights are included in the service fee?
Integrations
Platform / SIEM
- Microsoft Sentinel
Endpoint
- Microsoft Defender XDR
Cloud
- Microsoft Azure
Other integrations
- ANS SOAR platform
- ANS Glass
Common questions
Does the response SLA mean a human has contained the threat?
The definition measures acknowledgment and investigation and allows automated response to satisfy the response measure. All alerts and incidents still receive analyst review.