Who does what
Provider
- Triage findings and review high and critical cases
- Investigate cases and document the evidence and actions
- Execute approved containment on supported identity and Blumira Agent surfaces
Your team
- Maintain integrations, agents and emergency contacts
- Handle low and medium cases and approve restricted actions
- Remediate, restore service and coordinate deeper incident response
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for IT teams or MSPs needing analyst response across connected identity, cloud, network and Blumira Agent signals
Managed package
Managed is an additional per-user service for Automate customers. Direct enrollment starts at 50 users.
Response surface
Microsoft identity and Blumira Agent response follow the agreed plan. Confirm when analysts may act after attempted contact and which firewall actions apply.
Case ownership
Blumira handles high and critical cases. Your team handles low and medium cases, keeps integrations working and owns eradication and recovery.
Full service analysis
Blumira Managed is a 24/7 MDR add-on for Automate customers. After its Kindling system triages a finding, Blumira analysts review high and critical cases and execute approved Microsoft 365, Entra ID and Blumira Agent containment. The buyer or MSP maintains source coverage, handles low and medium cases and owns remediation and recovery.
- Your team owns
- Maintaining log connections, Blumira Agent coverage and emergency contacts
- Handling low and medium severity cases and resolving blockers to analyst action
- Approving restricted endpoint actions and defining critical hosts before enrollment
- Resetting credentials, removing malware and persistence and restoring systems
- Coordinating deep forensics, breach notification and any incident response partner
Why contain threats
Managed analysts execute preapproved account containment and can isolate Blumira Agent endpoints with approval or after attempted contact under the agreed plan. The platform editions alone do not establish analyst-owned response.
Response boundary
Blumira covers high and critical cases. The buyer handles low and medium cases, unsupported third-party EDR and cloud actions, eradication and recovery.
Confirm the written plan
Blumira's Managed page and responsibility matrix differ on response timing and firewall blocklist execution. Confirm the governing SLA and action list in the contract.
Pricing & contract
- Billing
- Per-user, Custom
Blumira Managed uses per-user pricing and requires Automate. Direct enrollment starts at 50 covered users; partner terms differ. Request a combined platform and Managed service quote.
Tradeoffs & buying questions
Strengths
-
Analyst review and documented response for high and critical cases around the clock
-
Preapproved identity containment and a defined endpoint contact procedure
-
Case records support handoff to your incident response partner
Considerations
-
Requires Automate and a quote for Managed coverage
-
Direct customers need at least 50 covered users
-
No Blumira execution in third-party EDR or non-Microsoft cloud infrastructure
-
Buyer owns low and medium cases, integration maintenance and recovery
Ask before buying
- What is the combined Automate and Managed price for our covered users, and what is the contract term?
- Which connected tenants, agents and actions will our approved response plan cover?
- Which case-response SLA and firewall actions will the contract and responsibility matrix govern?
Integrations
Platform / SIEM
- Blumira Cloud SIEM
Endpoint
- Blumira Agent
- CrowdStrike Falcon
- SentinelOne
1 more integrations
- Microsoft Defender
Cloud
- Azure
- AWS
- Google Cloud
Other integrations
- Microsoft Entra ID
- Microsoft 365
Common questions
Does Blumira Managed run every SOC case for us?
Managed adds 24/7 analyst review and approved containment to Automate for high and critical cases. Your team still handles low and medium cases, source and agent coverage, eradication and recovery.
Which response actions will Blumira analysts take?
Analysts can disable connected Microsoft accounts and revoke sessions under a preapproved plan. For Blumira Agent endpoint actions, the matrix allows approval or an attempt to contact the customer first. Confirm critical-host exclusions and firewall permissions; third-party EDR and cloud infrastructure actions stay with your team.
How is Blumira Managed priced?
Managed is a quoted per-user add-on to Automate. Direct customers need at least 50 covered users. Ask for the combined platform and service price and confirm partner terms where applicable.
Company details
- Headquarters
- Ann Arbor, Michigan
- Founded
- 2018