Who does what
Provider
- Investigate validated threats and hunt
- Contain threats through agreed modules
- Maintain Argus detections and case reporting
Your team
- Deploy agents and connect agreed sources
- Authorize containment and escalation
- Own business recovery and excluded remediation
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Teams choosing modular detection and response across an existing security environment
Choose the plan and modules
Core targets Microsoft Azure and Defender XDR. Broader coverage, hunting and API access depend on the higher plans.
Endpoint action has prerequisites
Endpoint isolation belongs to Endpoint Responder. Other response surfaces need their own agreed controls.
Incident response varies by plan
Incident response is included by plan, with different commitments. Agree included effort and dispatch terms.
Full service analysis
mnemonic Argus MDR investigates threats and supports containment through the contracted response modules, including endpoint isolation with Argus Endpoint Responder. Your team deploys the required agents, agrees response authority and handles business recovery.
- Your team owns
- Deploy agents and connect agreed sources
- Authorize containment and escalation
- Own business recovery and excluded remediation
Choose the plan and modules
Core targets Microsoft Azure and Defender XDR with standard playbooks and indicator sweeps. Advanced and Enterprise broaden the service, with different engineering, API and incident-response commitments. Confirm the plan and modules together, including any CrowdStrike Endpoint Responder scope.
Endpoint action has prerequisites
Argus Endpoint Responder uses CrowdStrike and supports endpoint isolation, investigation and evidence collection. That module does not establish the same containment authority for every cloud, network or OT source connected to Argus.
Incident response varies by plan
The current matrix includes incident response in every plan but distinguishes Standard, Adapted and an Enterprise 24/7 guaranteed response. Agree dispatch times, included effort and escalation conditions before treating these as equivalent.
Pricing & contract
- Billing
- Custom
Request a quote for the selected plan and response modules, including platform licenses, ingestion, retention and implementation.
Tradeoffs & buying questions
Strengths
-
Combines analyst investigation with specific endpoint containment
-
Offers different hunting and detection-engineering levels
-
Provides Argus case visibility alongside modular coverage
Considerations
-
Coverage and response authority depend on selected modules
-
Core does not include the same API and hunting scope as higher plans
-
Endpoint containment requires the corresponding response module
Ask before buying
- Which endpoint, cloud and network modules are included, and which actions can analysts take without another approval?
- Does the quote include the required platform licenses, ingestion, retention and implementation, and what is the minimum term?
- Which incident-response hours and dispatch SLA apply to our plan, and can we export cases, events and detection content when leaving?
Integrations
Endpoint
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
Cloud
- Microsoft Azure
Other integrations
- Argus case platform
Common questions
Does every plan include the same threat hunting?
No. The current matrix lists indicator sweeps for Core and hypothesis-based hunting for Advanced and Enterprise.
Does Argus replace our whole SOC?
This profile covers modular MDR with agreed containment. The buyer retains source deployment, authorization and business recovery. A broader SOC handoff needs a separate responsibility agreement.