Who does what
Provider
- Operate Sentinel detections
- Investigate and hunt threats
- Tune rules and report incidents
Your team
- Maintain source-system access
- Give context and change decisions
- Perform remaining response
Coverage
- Endpoints
- Network
- Identity & Access
- Cloud Workloads
Details
Service scope
Best for Teams that want Sentinel operations and investigations handled externally while retaining response and change decisions
Shared operating work
Claranet operates detections. Your team owns source-system changes, context and tuning decisions.
Response authority is agreed
Advice is included. Live-system actions need an agreed scope, approval path and recovery handoff.
Check access and exit rights
Confirm administrative access and which proprietary rules can be removed from your Sentinel tenancy at exit.
Full service analysis
Claranet MDR for Microsoft Sentinel operates detections, investigates incidents and tunes the platform with your team's input. You maintain source-system access, decide tuning and response changes and carry out remediation beyond the actions agreed with Claranet.
- Your team owns
- Configure source systems and maintain access
- Provide tuning feedback and change decisions
- Perform response beyond the agreed actions
Shared operating work
Claranet handles detection configuration, investigations and continuous tuning. Your team supplies source-system changes, business context and tuning decisions. Keep those recurring responsibilities in the operating agreement.
Response authority is agreed
Investigations provide remediation advice. The current service also allows actions on live systems when their scope is agreed during onboarding. Name the actions, approvals and recovery handoff before assuming the SOC can resolve every incident.
Check access and exit rights
The Sentinel instance remains in your Azure tenancy. The service definition restricts administrative access unless agreed and permits removal of proprietary rules at exit, while customer data and unique configuration remain. Confirm the current exit terms.
Pricing & contract
- Billing
- Custom
The statement of work defines sources, storage and operating scope. Separate Microsoft consumption, onboarding, additional detections and response permissions when comparing the recurring fee.
Tradeoffs & buying questions
Strengths
-
Operates detections and investigations in the customer's Sentinel environment
-
Maintains tuning through a shared feedback process
Considerations
-
Source-system configuration remains a customer duty
-
Response execution requires explicit agreement
-
Administrative and exit rights need contract review
Ask before buying
- Which actions may the SOC take on live systems, and which containment or recovery steps stay with us?
- Who repairs each log source, and what tuning approval and administrative access will our team have?
- Which licenses, consumption, custom rules and storage are included, and what data and detections remain at exit?
Integrations
Platform / SIEM
- Microsoft Sentinel
Cloud
- Microsoft Azure
Other integrations
- Claranet Online
Common questions
Does the 15-minute P1 target mean the threat is contained?
It measures notification after classification. Triage has its own timing, and containment depends on the incident and agreed response authority.