Who does what
Provider
- Endpoint investigation
- Threat hunting and tuning
- Host, process and file containment
Your team
- Access and response permissions
- Business impact decisions
- Recovery beyond scope
Coverage
- Endpoints
Details
Service scope
Best for Teams buying endpoint response capacity
Offer
Current Managed Cyber Defense endpoint and SOC bundle.
Workflow
Analysts triage alerts and investigate suspicious endpoint activity.
Response
Remote isolation, process stopping and executable blocking.
Full service analysis
T-Systems Managed Cyber Defense investigates endpoint alerts and can isolate hosts, stop processes and block executables through its SOC. The buyer agrees response permissions, supplies access and business context and retains recovery work outside the contracted incident service.
- Your team owns
- Access, incident contacts and business impact decisions.
- Response permissions and recovery beyond the contracted scope.
Pricing & contract
- Billing
- Custom
Request a quote identifying endpoint protection licenses, monitored devices, onboarding and the incident response allowance. Confirm how large-scale compromises and recovery are charged.
Tradeoffs & buying questions
Strengths
-
The current service description identifies concrete actions performed by the SOC.
Considerations
-
This endpoint bundle does not establish management of the buyer's wider SIEM, identity or cloud operations.
Ask before buying
- Which endpoint tooling replaces or works alongside our current protection, and which devices are covered?
- Which host, process and file actions can the SOC take without approval, including on critical servers?
- What does the incident response team include for a large-scale compromise, and where do additional fees and recovery duties begin?
Common questions
Is this a full outsourced SOC for every system?
The current package combines endpoint protection, EDR and SOC response. Agree any wider log sources, security platforms and incident services separately.