Who does what
Provider
- 24/7 alert investigation
- Core threat hunting
- Containment playbooks
Your team
- Action permissions
- Source connectivity
- Recovery beyond scope
Coverage
- Endpoints
- Cloud Workloads
- SaaS Applications
- Network
Details
Service scope
Best for European teams adopting Cortex-based MDR
Service
Guardian xMDR Core, above endpoint-focused Essential.
Platform
Cortex XDR with XSOAR playbooks.
Response
Managed containment with the action matrix agreed in the order.
Full service analysis
Nomios Guardian xMDR Core validates alerts and runs containment playbooks through Cortex XDR and XSOAR, with 24/7 analysts in the Netherlands. The buyer agrees the permitted actions, maintains the source connections and owns recovery beyond the selected package.
- Your team owns
- Agreeing response authority and providing business context.
- Keeping the purchased telemetry sources connected and changes communicated.
- Recovery and remediation beyond the selected response package.
Core defines this profile
Essential concentrates on endpoints. Core adds cloud and SaaS monitoring, external log sources, hunting and managed containment. The EU-hosted managed SIEM and identity threat detection are Advanced features, while a named analyst is in Elite.
Pricing & contract
- Billing
- Per-endpoint, Tiered
The quote depends on tier, endpoint count and coverage. Confirm Cortex licensing, log retention, onboarding and any SIEM extension.
Tradeoffs & buying questions
Strengths
-
The published tier split helps buyers separate Core from SIEM and named-analyst upgrades.
-
The service names its Dutch operating SOC and EU data hosting.
Considerations
-
Cortex XDR is the underlying platform, so another endpoint stack may need migration.
-
Exact containment actions and source coverage still require a service schedule.
Ask before buying
- Which containment playbooks are included in Core, and which actions require our approval before the SOC runs them?
- Which cloud, SaaS and firewall sources fit Core, and which require Advanced with the managed SIEM extension?
- What are the Core price, included Cortex licenses, retention and exit terms, and does the 250-endpoint renewal comparison threshold apply to our purchase?
Integrations
Endpoint
- Palo Alto Networks Cortex XDR
Other integrations
- Palo Alto Networks Cortex XSOAR
Common questions
Can Guardian xMDR use our existing SIEM instead of Cortex?
Guardian xMDR is the standardized Cortex offer. Nomios separately sells Custom MDR around other tools. The managed SIEM extension is available from Advanced for sources outside Cortex's native library.
Is 250 endpoints the service minimum?
The public page attaches 250 endpoints to its license-renewal comparison offer. It does not clearly establish that number as the minimum for every Guardian xMDR contract, so confirm eligibility in the quote.
Company details
- SOC regions
- Europe / UK