Who does what
Provider
- Alert investigation, case evidence and recommended response
- Execution through configured response workflows
Your team
- Autonomy modes, tool access and approvals
- Escalation decisions and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
Details
Service scope
Best for A SOC or MSSP that wants automated investigation and controlled response while keeping an existing security stack.
Investigate
Correlates evidence and reconstructs the attack path.
Approve
Your policy gates consequential actions.
Execute
The response engine carries out permitted actions.
Full service analysis
AI investigation with response governed by action risk and approval
- Your team owns
- Configure tool grants, data access and response authority.
- Staff the approval and escalation chain.
- Validate outcomes and own business recovery.
Pricing & contract
- Billing
- Tiered, Custom
D3 describes an annual subscription sized to daily alert volume, with named user licensing and AI processing included. Its pricing page describes per-alert charges above the tier while another pricing guide describes moving to a larger tier. Require the signed quote to specify overflow treatment, seats and deployment costs.
Tradeoffs & buying questions
Strengths
-
One case history for investigation and action
Investigation and response history stay in the same case.
-
Policies can differ by workflow or tenant
Supports different approval policies across workflows and MSSP tenants.
Considerations
-
Required approvers must be available
High-impact actions still need an available approver when policy requires one.
-
Confirm written billing overflow terms
Billing overflow terms need reconciliation in the written quote.
Ask before buying
- Which actions need approval and who receives timeouts?
- Does overflow trigger per-alert charges or a tier increase?
- Where does data and model processing occur?
Integrations
Platform / SIEM
- Microsoft Sentinel
- Splunk
Endpoint
- Microsoft Defender
- CrowdStrike
- SentinelOne
Cloud
- Microsoft Azure
Other integrations
- Microsoft Entra ID
- Microsoft Exchange Online
- Microsoft Intune
Common questions
Can the platform run with human approval for every action?
Yes. AI-Assisted mode investigates and recommends while analysts approve state-changing actions. Other modes permit different degrees of execution within configured gates.
Is this a managed human SOC service?
This profile covers the Morpheus platform. Your team or chosen service provider remains responsible for oversight, approvals and incident decisions.