Who does what
Provider
- Investigate and validate covered alerts
- Escalate through configured contact and ticket workflows
- Perform authorized containment and supported remediation
Your team
- Complete onboarding and maintain licensed coverage
- Configure contacts, permissions and response rules
- Own remaining remediation, client communication and recovery
Coverage
- Endpoints
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for MSPs and Kaseya-centered IT teams needing SOC support in PSA and RMM workflows
Authority and execution
SOC settings authorize actions; Respond rules determine execution. Supported actions include device isolation, process termination, software removal, account disabling and session termination, depending on source and context.
Data retention
Current Kaseya MDR documentation retains raw data for three days and processed data for 400 days, searchable throughout. RocketCyber has a separate retention policy.
Product transition
Kaseya MDR and RocketCyber can operate in parallel during synchronization. Review connector permissions and organization mappings; do not decommission RocketCyber assets without guidance.
Full service analysis
Kaseya MDR investigates endpoint, Microsoft 365 and firewall activity through its SOC and can isolate devices or perform authorized endpoint and Microsoft 365 actions. You complete onboarding, maintain integrations and contacts, define action permissions and execution rules, and handle remaining remediation and customer recovery.
- Your team owns
- Complete SOC onboarding and license all required endpoints and Microsoft 365 accounts
- Maintain agents, connectors, contacts and organization context
- Configure global and organization-specific response authority and execution rules
- Handle remaining remediation, customer communication and recovery
Current response configuration
Use the current Kaseya MDR SOC settings and Respond rules when defining authority. The older RocketCyber guide explains historical isolation behavior but does not replace current organization-level settings. Granting authority does not itself trigger an action.
Platform boundaries
Kaseya MDR, Kaseya SIEM and SaaS Alerts are related but distinct products. The MDR integration guide defines supported sources. A PSA connector supplies case context rather than being a threat-detection source.
Transition and retention
The new platform preserves the SOC model during parallel operation with RocketCyber. Current Kaseya MDR raw retention is three days; processed events, alerts and rule results remain searchable for 400 days. Do not apply the legacy retention policy to the new service.
Pricing & contract
- Billing
- Per-endpoint, Per-user, Custom
Quote-based. April 2026 terms require one license per covered endpoint and one license for up to 1.3 covered Microsoft 365 accounts. Committed terms are defined in the order, fees are typically monthly in advance, and onboarding or implementation fees can apply. SOC coverage starts only after customer onboarding.
Tradeoffs & buying questions
Strengths
-
MSP-oriented organization, PSA and RMM workflows
-
Documented separation of SOC permissions and execution rules
-
Processed data remains searchable for 400 days
Considerations
-
Installing agents alone does not activate SOC coverage
-
Response depends on source support, permissions and configuration
-
MSPs retain customer coordination, remaining remediation and recovery
Ask before buying
- Which action permissions, Respond rules and detection-specific automations will be enabled?
- Which data remains raw or processed, and what export and retention requirements must our contract meet?
- Which product licenses, Microsoft 365 account allowances, onboarding charges and committed terms apply?
Customer feedback
Customers value
-
RocketCyber reviews from June 2023 and April 2025 value SOC contact and timely guidance; the June account was incentivized
-
January 2024 G2 and December 2023 Capterra RocketCyber accounts value integration with their security stack
Reported concerns
-
January 2024 and April 2025 RocketCyber accounts describe false positives or difficult setup
-
December 2023 reviews describe remaining technical work; an incentivized June 2023 account reports slower non-incident support
Integrations
Endpoint
- Datto EDR
- CrowdStrike
- SentinelOne
5 more integrations
- Sophos
- Bitdefender GravityZone
- Deep Instinct
- Cylance Monitor
- Webroot Monitor
Other integrations
- Microsoft 365
- Graphus
- Datto RMM
8 more integrations
- Autotask PSA
- Kaseya BMS
- ConnectWise
- Halo PSA
- Syncro
- Cisco Meraki
- Fortinet
- Palo Alto Networks
Common questions
Is Kaseya MDR the same platform as RocketCyber?
It evolves the RocketCyber service with a new interface and investigation workflow. Both platforms can run in parallel during synchronization; confirm mappings and connector permissions before making changes to legacy assets.
Can the SOC act on threats?
Yes, within configured authority and source support. Current settings permit device isolation, endpoint actions and Microsoft 365 account or session actions. Permissions establish what is allowed; Respond rules and detection-specific settings govern execution.
How are coverage and fees determined?
The April 2026 terms use endpoint and Microsoft 365 license units, order-specific committed terms and typically monthly advance fees. Onboarding charges can apply, and coverage begins after SOC onboarding.