Who does what
Provider
- Triage and investigate supported alerts
- Hunt threats in Google SecOps
- Run approved actions through supported tools
Your team
- License Google SecOps and partner tools
- Connect telemetry and approve response authority
- Handle remediation, recovery and business decisions
Coverage
- Endpoints
- Identity & Access
- Network
Details
Service scope
Best for Google SecOps teams wanting Mandiant investigation and approved containment
Response boundary
Host containment and file collection depend on supported tools and the agreed permissions. Monitoring a source does not confer every response action.
License prerequisites
The partner table requires Falcon Data Replicator for CrowdStrike, Cloud Funnel for SentinelOne, and Defender for Endpoint Plan 2 plus Azure Blob Storage for Microsoft endpoint telemetry.
Separate variants
This profile covers Managed Defense for Google SecOps. Managed Defense Standard has a different partner table; its Trellix email and OT entries are not treated as this offer’s default scope.
Full service analysis
Mandiant Managed Defense for Google SecOps triages alerts, investigates incidents and can contain hosts through supported tools. You supply the licensed environment, approve response authority and handle remediation and recovery.
- Your team owns
- License Google SecOps and the required partner products, and connect supported telemetry
- Maintain supported versions, correct configuration, network access and credentials
- Approve response authority and identify excluded network segments
- Remediate reported compromises and carry out recovery and business decisions
- Arrange separate incident response for compromise predating the service
Offer boundary
This profile covers Managed Defense for Google SecOps. Google publishes a separate Managed Defense Standard partner table, so the two variants’ integrations and licensing requirements are not interchangeable.
Why contain threats
Google documents host containment and file acquisition through supported partners. That supports Contain threats within the agreed tools and permissions; it does not transfer all remediation or recovery work.
Customer evidence
Gartner and TrustRadius reviews concern the wider Managed Defense service family, rather than a verified current Google SecOps deployment. Visible TrustRadius comments date from 2023 and are incentivized.
Pricing & contract
- Billing
- Custom
The quote needs to separate Managed Defense entitlements, customer-owned Google SecOps, partner licenses and onboarding. The public CDW node SKU does not establish a subscription term, minimum quantity or complete service price.
Tradeoffs & buying questions
Strengths
-
Analyst triage and hunting around customer-owned Google SecOps
Adds analyst triage and hunting to a customer-owned Google SecOps environment
-
Named partner products and ingestion prerequisites
Names partner products and ingestion prerequisites in the technology datasheet
-
Authorized host containment through supported tools
Can perform containment within supported tools and agreed authority
Considerations
-
Google SecOps and partner licenses need a separate scope check
Google SecOps and partner licensing must match the selected service variant
-
Customer configuration and remediation duties remain
Customers retain configuration, connectivity and remediation duties
-
Curated-detection support is license-dependent and marked Preview in the datasheet
The datasheet marks curated-detection support as Preview and license-dependent
Ask before buying
- Which supported tools enable host containment and file collection in our environment?
- Which actions are pre-authorized, approval-dependent or recommendation-only?
- How are Google SecOps ingestion, partner licenses, service fees and incident response handoff priced?
Customer feedback
Customers value
-
An April 2026 Gartner service-family reviewer values proactive monitoring
-
Incentivized October 2023 TrustRadius service-family reviews value 24/7 support and analyst availability
Reported concerns
-
Incentivized October 2023 TrustRadius reviews raise reporting, asset-view and integration concerns
Integrations
Platform / SIEM
- Google Security Operations
Endpoint
- CrowdStrike Falcon Insight XDR
- SentinelOne Singularity XDR
- Microsoft Defender for Endpoint
Other integrations
- Microsoft Defender for Identity
- Corelight Open NDR
- Palo Alto Networks Next-Generation Firewall
1 more integrations
- Managed Defense Portal
Common questions
Does Mandiant Managed Defense only investigate and advise?
No. Supported tools allow actions such as host containment and file collection under the agreed response authority.
Does Managed Defense require Google Security Operations?
Yes for the offer profiled here: the service uses a customer-owned Google SecOps instance and supported partner products. Managed Defense Standard is a separate variant.
Is Mandiant Managed Defense pricing public?
Request a scoped quote covering service entitlements, Google SecOps, partner licenses and onboarding. A bare reseller node SKU does not establish the complete subscription cost.