Who does what
Provider
- Operate contracted Sentinel SOC
- Investigate and prioritize incidents
- Maintain SIEM health and reporting
Your team
- Maintain sources, access and custom use cases
- Approve response authority
- Own business recovery
Coverage
- Endpoints
- Cloud Workloads
- Network
Details
Service scope
Best for Enterprises outsourcing daily SOC operations around Microsoft Sentinel
Full or shared operation
This profile covers full management. Shared coverage retains more daily SOC work with the buyer.
Sentinel and hunting scope
Sentinel only. Premium hunting covers selected accessible sources.
Actions require agreement
Define containment actions and approvers in the runbook. The buyer supplies custom use cases and source-system changes.
Full service analysis
Lumen Defender AMDR for Microsoft Sentinel runs the contracted SOC monitoring, incident queue and SIEM operations. Your team retains source-system access, business approvals and recovery, with containment authority defined in the statement of work.
- Your team owns
- Maintain log sources, access and customer-defined use cases
- Approve actions and escalation priorities
- Complete business remediation and recovery outside the order
Full or shared operation
Lumen offers full management and shared support for an existing SOC. This profile describes full management. A shared contract can leave sensitive investigations and daily decisions with your team, so agree the ownership split.
Sentinel and hunting scope
The service guide limits the platform to Microsoft Sentinel. It places threat hunting in Premium and ties it to selected accessible log sources. Cortex XSIAM AMDR and other Lumen security services have separate scopes.
Actions require agreement
Public material describes response and remediation, while the service guide specifies triage, notification and managed SIEM operations. Name each permitted containment action and its approver in the response runbook. The customer supplies custom use cases and changes to source systems.
Pricing & contract
- Billing
- Custom
Quote the managed service separately from Sentinel ingestion, retention, licenses, onboarding and Premium threat hunting. Full and shared management have different scopes.
Tradeoffs & buying questions
Strengths
-
Can retain a qualifying Sentinel environment
-
Covers recurring SIEM operations as well as alerts
-
Offers full and shared management arrangements
Considerations
-
Service is specific to Microsoft Sentinel
-
Threat hunting depends on Premium scope
-
Containment permissions need an explicit agreement
Ask before buying
- Does the order assign the daily SOC to Lumen or only shared shift coverage, and which containment actions can it execute?
- Which Sentinel ingestion, retention, licenses and onboarding charges sit outside the service fee?
- Does our package include Premium threat hunting, and what source coverage, residency and export rights are contracted?
Integrations
Platform / SIEM
- Microsoft Sentinel
Other integrations
- Black Lotus Labs threat intelligence
Common questions
Does every AMDR contract outsource the SOC?
No. Lumen also offers shared management. This profile covers full management within the agreed Sentinel scope.
Is threat hunting included?
The service guide assigns hunting to Premium and to log sources the customer connects and makes accessible.