Who does what
Provider
- Investigate contracted telemetry 24/7
- Operate detections and shared cases
- Execute agreed remote response
Your team
- Maintain source access and licenses
- Share SOC decisions and action authority
- Handle out-of-scope remediation and recovery
Coverage
- Endpoints
- Network
- Cloud Workloads
- Identity & Access
Details
Service scope
Best for Teams sharing SOC operations around Microsoft Sentinel or Splunk
Modular service
Microsoft, Splunk, endpoint and network services have separate scope. Tool support does not include every source, license or response action.
Shared SOC workflow
The Microsoft offer includes detection engineering, collaborative investigation and a Technical Account Manager. Agree the daily split of SOC work.
Incident escalation
Remote response is limited by the service description. DFIR triage needs written approval and is chargeable. Further incident response needs an accepted proposal.
Full service analysis
NCC Group Managed Extended Detection and Response investigates alerts 24/7 and operates shared detection and response workflows through its Unified Cyber Platform. You retain source access, agreed SOC decisions, action permissions and remediation or recovery beyond contracted response.
- Your team owns
- Maintain telemetry sources, endpoint agents, credentials and licenses
- Share daily SOC decisions and agree case responsibilities
- Set action permissions and approve chargeable escalation
- Handle remediation, recovery and business decisions beyond contracted response
Why co-managed SOC
The Microsoft service describes shared delivery, detection engineering and collaborative investigation with a Technical Account Manager. These recurring SOC responsibilities support the co-managed lane. The exact division of case ownership and operational decisions belongs in the contract.
Response and DFIR
The MXDR service module separates initial remote advice and response from DFIR triage. Triage requires written approval and is chargeable. Further incident-response work needs proposal acceptance. An embedded response team does not mean unlimited remediation or recovery.
Regional delivery
UK procurement evidence supports the UK offer. Confirm German and French contracting eligibility separately. Hosted-SIEM terms name the Netherlands, UK and Germany as possible data locations. That does not establish local service availability, support language or all analyst and case-data locations.
Price scope
The May 2024 G-Cloud MXDR reference starts at £1,500/month excluding VAT. Setup depends on scope and Microsoft licenses are additional. Confirm the module, monitored sources, retention, service reviews and response entitlement before comparing totals.
Pricing & contract
G-Cloud: from £1,500/mo ex VAT Indicative pricing from public research, not official provider pricing. Ask the provider for a current quote.
May 2024 UK reference · ex VAT · setup and Microsoft licensing are additional
- Billing
- Custom
- Onboarding
- Depends on selected modules, source access, licenses and agreed response permissions
Tradeoffs & buying questions
Strengths
-
Shared detection engineering and investigation for Microsoft environments
-
Named Microsoft, Splunk, endpoint and network service options
-
Public UK procurement sheet provides a scoped starting price
Considerations
-
Modules, licenses and supported sources need explicit scoping
-
DFIR and extended incident response can add charges
-
Customer licenses and telemetry maintenance remain required
Ask before buying
- Which Microsoft, Splunk, endpoint and network modules are included, and who owns daily detections, cases and service reviews?
- Which remote actions are permitted, how long is initial response included, and what triggers chargeable DFIR or a separate incident-response proposal?
- For our country, confirm eligibility, support language, analyst and data locations, setup, licenses, retention and exit export.
Integrations
Platform / SIEM
- Microsoft Sentinel (Microsoft service)
- Splunk (Splunk service)
Endpoint
- Microsoft Defender (scoped endpoint service)
- Carbon Black (scoped endpoint service)
Cloud
- AWS, Azure and GCP telemetry (Splunk service)
Other integrations
- NCC Group Unified Cyber Platform
- Splunk SOAR response options
- NCC Group network sensors
Common questions
Why is NCC Group in Co-manage the SOC?
Its Microsoft MXDR offer includes shared delivery, detection engineering and collaborative investigation. Agree which recurring decisions and case responsibilities remain with your team.
Can NCC Group act on threats?
Yes, within contracted remote-response scope and permissions. Written approval is required for chargeable DFIR triage. Further incident response needs an accepted proposal.
What does the public price include?
The May 2024 G-Cloud MXDR sheet starts at £1,500/month excluding VAT. Setup is separately scoped and Microsoft licensing remains an additional buyer cost.
Company details
- Headquarters
- Manchester, United Kingdom
- Founded
- 1999