SOC Providers.com Security Operations Center providers
Last reviewed: 3 Oct 2026

Deepwatch Guardian MDR Platform

Deepwatch investigates alerts, tunes detections and hunts threats, with opt-in endpoint and identity response. You maintain connected tools, define permissions and complete remediation and recovery.

Platform
Your stack
Price
$245,198 / 12 months · 50 GB/day

Who does what

Provider

  • Monitor and investigate supported telemetry
  • Hunt threats and tune detections
  • Execute configured response actions within agreed scope

Your team

  • Maintain connected tools and telemetry quality
  • Grant access and define response approvals
  • Own IT remediation and business recovery

Coverage

  • Endpoints
  • Cloud Workloads
  • Identity & Access
  • Network

Details

Service scope

Best for Teams keeping a supported SIEM and adding analysts, detection engineers and threat hunters

  • Opt-in response

    The Response Intent Matrix defines eligible detections, conditions and actions. Execution can be automatic, analyst-approved or monitor-only; nothing is enabled by default.

  • SIEM fit

    Deepwatch supports Splunk, Microsoft Sentinel, Google Security Operations and Securonix. Confirm managed detection coverage for each connected source.

  • Additional services

    Managed EDR, firewall and vulnerability services have separate marketplace dimensions. Their licenses and duties are not automatically part of the MDR scope.

Full service analysis

Deepwatch monitors and investigates alerts, tunes detections and hunts threats across supported SIEM and security tools. Its opt-in Active Response executes agreed endpoint and identity actions. You maintain telemetry, define response permissions and complete IT remediation and recovery.

Your team owns
  • Maintain the connected SIEM, tools, telemetry and permissions
  • Define eligible response actions, conditions and approval modes
  • Complete remaining IT remediation, recovery and business decisions
  • Confirm separate services and whether licenses are supplied or retained

Response authority

Active Response is opt-in and part of the Guardian MDR platform. Supported actions include session revocation, password reset, account control, process termination and host isolation. The configured matrix governs action and approval; examples on the product page are not default policy.

Service boundaries

A SIEM connection does not establish equal detection coverage for every source. The statement of work should define source onboarding, tuning, case routing and response duties. Managed EDR, firewall and vulnerability services have separate scopes.

Pricing & contract

$245,198 / 12 months
50 GB/day

AWS Marketplace MDR contract with Splunk licensing at 50 GB/day

Billing
Custom
AWS Marketplace MDR contract ↗

Tradeoffs & buying questions

Strengths

  • Works across supported existing SIEMs

  • Combines investigations, hunting and detection engineering

  • Documents opt-in endpoint and identity response controls

Considerations

  • Coverage depends on supported sources, permissions and the agreed service scope

  • Response actions must be enabled and assigned execution conditions

  • Managed EDR, firewall and vulnerability services need separate scoping

Ask before buying

  • Which detections and response actions will be enabled in our Response Intent Matrix?
  • Which data sources and detection engineering duties are covered by our SIEM service?
  • Does the quote include SIEM licenses, and which endpoint, firewall or vulnerability services are separate?

Customer feedback

Customers value

  • June 2026 G2 and September 2026 Gartner accounts value monitoring and analyst responsiveness

  • A February 2026 incentivized G2 reviewer values investigation guidance and help with internal technical issues

Reported concerns

  • January 2026 Gartner and June 2026 G2 accounts raise cost or value concerns

  • A February 2026 incentivized G2 reviewer describes documentation, integration and Splunk-query friction

Integrations

Platform / SIEM

  • Splunk Enterprise
  • Splunk Cloud
  • Microsoft Sentinel
2 more integrations
  • Google Security Operations
  • Securonix

Cloud

  • AWS
  • Azure
  • GCP

Other integrations

  • Deepwatch Security Center
  • ServiceNow

Common questions
Does Deepwatch run the entire SOC?This profile uses Co-manage the SOC because Deepwatch operates investigations, hunting and detection engineering across supported tools. You retain telemetry, access policy, remaining remediation and recovery.

This profile uses Co-manage the SOC because Deepwatch operates investigations, hunting and detection engineering across supported tools. You retain telemetry, access policy, remaining remediation and recovery.

Which response actions are supported?Opt-in Active Response supports endpoint process termination and host isolation, plus identity actions such as session revocation, password reset and account control. Execution depends on supported technologies and your Response Intent Matrix.

Opt-in Active Response supports endpoint process termination and host isolation, plus identity actions such as session revocation, password reset and account control. Execution depends on supported technologies and your Response Intent Matrix.

What does the public price cover?AWS lists $245,198 for a 12-month MDR package including Deepwatch-provided Splunk licensing at 50 GB/day. Managed EDR, vulnerability and firewall services are separate dimensions. Confirm quantities, licenses and private-offer terms.

AWS lists $245,198 for a 12-month MDR package including Deepwatch-provided Splunk licensing at 50 GB/day. Managed EDR, vulnerability and firewall services are separate dimensions. Confirm quantities, licenses and private-offer terms.

Company details
Headquarters
Palo Alto, California