Who does what
Provider
- Investigate alerts across connected tools
- Run authorized containment workflows
- Deliver the integration support purchased in the order
Your team
- Maintain licenses, source access and connectivity
- Set permissions and respond to escalations
- Handle recovery and work outside agreed playbooks
Coverage
- Endpoints
- Identity & Access
Details
Service scope
Best for Teams keeping multiple security vendors and wanting shared detection and response workflows
Integration package
SIEM maintenance and health support depend on the Integration Plus items purchased.
Hunting scope
Ongoing Enablement excludes provider-run hunts unless separately ordered. AI hunting features do not establish that service entitlement.
Response authority
You choose automatic actions and approval gates. Recovery and destructive response remain outside the described operating scope.
Full service analysis
ReliaQuest GreyMatter with Ongoing Enablement co-manages security operations across connected tools. It investigates alerts and can run authorized containment playbooks, while your team maintains licenses, source access, response policy and recovery.
- Your team owns
- Maintain licenses, source access and connectivity
- Set permissions and respond to escalations
- Handle recovery and work outside agreed playbooks
Shared operating scope
This profile covers GreyMatter with Ongoing Enablement. The order determines integration support, tuning and additional services.
AI authority
Agentic Teammates are an add-on and autonomous workflows require eligibility. Your team configures which production actions require human sign-off. Confirm the automation included in the order and the permitted response actions.
Pricing & contract
$226,000 / 12 months
up to 2,000 EPS AWS Marketplace package for SIEM Integration Plus and Ongoing Enablement up to 2,000 EPS. This is a specific package, not a universal GreyMatter rate. Confirm current scope and pricing.
AWS package · SIEM Integration Plus and Ongoing Enablement · up to 2,000 EPS
- Billing
- Custom
Tradeoffs & buying questions
Strengths
-
Keeps supported existing tools in one investigation and response workflow
-
Configurable approval gates for production actions
-
Specific integration packages define ongoing operating support
Considerations
-
SIEM maintenance and health support depend on purchased integration scope
-
Provider-run hunt campaigns and ad-hoc investigation are not standard Ongoing Enablement
-
Buyer retains connectivity, permissions, escalation decisions and recovery
Ask before buying
- Which integration packages, detection tuning and provider-run hunts are included?
- Which actions can run automatically, and who reviews exceptions or failed playbooks?
- Reconcile endpoint and EPS pricing, add-ons, data-use terms and exit exports in our order.
Customer feedback
Customers value
-
A 2026 Gartner reviewer praises access to engineers and ease of running playbooks
-
G2 reviews displayed on AWS describe useful visibility across existing tools
Reported concerns
-
One August 2026 G2 reviewer reports alert overload and navigation friction
-
Older Reddit customers describe staff changes and uneven support availability. These accounts predate current AI workflows
Common questions
Does GreyMatter replace our entire SOC?
This profile covers shared operations with Ongoing Enablement. Your team keeps access, licensing, response policy, escalation decisions and recovery.
Can GreyMatter act without approval?
Yes, when you configure actions to run autonomously. Production workflows can also require human sign-off. Verify permissions and exclusions for every connected control.
What does the public price cover?
The AWS listing is a 12-month SIEM Integration Plus and Ongoing Enablement package up to 2,000 EPS. The core-platform FAQ uses per-endpoint pricing, so confirm the metric and included services in a current quote.
Company details
- Headquarters
- Tampa, Florida
- Founded
- 2007