Who does what
Provider
- Alert investigation and hunting
- Contracted Sentinel operation
- Detection tuning
Your team
- Connected source systems
- Access and response permissions
- Major incident approvals
Coverage
- Cloud Workloads
- SaaS Applications
Details
Service scope
Best for New Zealand Microsoft security teams
Service
Guardian XDR for Enterprise, formerly iCE.
Platform
Microsoft Sentinel and Defender XDR in the customer environment.
Response
Shared incident handling with defined major incident costs.
Full service analysis
DEFEND Guardian XDR for Enterprise investigates alerts and operates Microsoft Sentinel alongside the buyer's security team. The buyer maintains connected source systems, agrees response permissions and funds approved major incident work beyond the included allowance.
- Your team owns
- Operating and configuring the source systems connected to Sentinel.
- Supplying business context, access and incident contacts.
- Approving response authority, major incident spending and work beyond the service scope.
Major incidents can add charges
The Enterprise datasheet distinguishes routine incident handling from major incident work. Confirm the included allowance and approval process before treating the service as an unlimited incident response retainer.
Pricing & contract
- Billing
- Custom
Guardian XDR pricing depends on ingestion and support scope. The Enterprise datasheet includes two hours per incident with fair use, then approved major incident work on a time-and-materials basis. Confirm Microsoft costs, onboarding and change fees.
Tradeoffs & buying questions
Strengths
-
Platform operation accompanies investigation and threat hunting.
-
Source-system ownership and major incident charges are addressed in the service documentation.
Considerations
-
The buyer continues to operate the connected source systems.
-
Major incident work and some service requests can incur additional charges.
Ask before buying
- Which Sentinel and Defender sources, response playbooks and permissions are included in our Enterprise service schedule?
- How does the two-hour incident allowance apply, who approves major incident charges and what response hours apply to low-severity cases?
- What will the quote charge for ingestion, Microsoft licenses, onboarding and ongoing platform changes, and what data and configurations can we export when leaving?
Integrations
Platform / SIEM
- Microsoft Sentinel
Cloud
- Microsoft Azure
- Amazon Web Services
Other integrations
- Microsoft Defender XDR
- Microsoft 365
Common questions
Is Guardian XDR for Enterprise the former iCE service?
Yes. DEFEND's current Enterprise page identifies iCE as Guardian XDR for Enterprise. Older marketplace and service documents may still use the iCE name.
Does the Business package price apply to Enterprise?
No. Guardian XDR for Business is a separate Microsoft 365 Business Premium offer. Use an Enterprise quote with its own sources, operating responsibilities and incident response terms.