Who does what
Provider
- Investigate endpoint alerts
- Perform initial containment
- Audit configurations and report findings
Your team
- Deploy and administer endpoints
- Investigate escalated alerts
- Remediate and restore clients
Coverage
- Endpoints
Details
Service scope
Best for MSPs retaining endpoint administration and client incident ownership
Response handoff
The SOC provides initial containment. Your MSP retains endpoint administration, follow-up investigation and remediation.
CrowdStrike package
Eligible tenants can migrate with approval. Other endpoint, cloud and network offerings have separate terms.
Commercial terms
Monthly and annual-commitment billing use endpoint counts. Duplicate devices can be billed and the evaluation converts unless canceled.
Full service analysis
SonicSentry MDR for Endpoint investigates endpoint alerts and provides initial containment, including host isolation, through the CrowdStrike service. Your MSP deploys agents, maintains policies and exclusions, investigates escalated alerts and completes remediation and recovery.
- Your team owns
- Deploy sensors and maintain policies, exclusions and endpoint inventory
- Provide customer support and investigate escalated alerts
- Complete remediation, restoration and recovery
Initial response and MSP work
SonicSentry provides SOC monitoring and initial compromise response. The CrowdStrike FAQ assigns deployment, policies, exclusions, customer support and further investigation to the MSP. Set an explicit handoff for device cleanup and restoration after containment.
Exact endpoint package
The current endpoint page leads with CrowdStrike, while other endpoint technologies have their own service documentation. Cloud and network monitoring are separate SonicSentry services. The CrowdStrike offering should be scoped independently of those additions.
Licensing and evaluation
The CrowdStrike FAQ describes both monthly billing and annual commitments, and warns that duplicate or retired devices can still be billed. Its 21-day proof of concept converts to production unless canceled. Review those terms before starting an evaluation.
Pricing & contract
- Billing
- Per-endpoint
The CrowdStrike FAQ counts active devices at month-end. Monthly billing and annual-commitment arrangements are described, with overages for annual commitments. Duplicate or retired devices can remain billable. The 21-day proof of concept converts to production unless canceled.
Tradeoffs & buying questions
Strengths
-
Documents MSP and SOC responsibilities separately
-
Provides incident visibility and requested SIEM access
-
Supports migration of eligible existing CrowdStrike tenants
Considerations
-
MSP retains policy maintenance and follow-up investigation
-
Duplicate or retired devices can increase billing
-
Evaluation converts to production unless canceled
Ask before buying
- Which threats trigger isolation without new approval, and what exceptions and release procedure apply?
- Can our tenant migrate, what modules are included and who owns the tenant at exit?
- How do device counts, duplicates, annual overages and evaluation conversion affect billing?
Integrations
Endpoint
- CrowdStrike Falcon
Common questions
Is SonicSentry the same as Solutions Granted?
SonicWall acquired Solutions Granted in November 2023 and incorporated its managed-security operations. This profile covers the current SonicSentry CrowdStrike endpoint offering.
Does the endpoint service include cloud and firewall response?
Cloud and network are separate service lines with different response capabilities. The endpoint package should not be treated as the entire SonicSentry suite.