Who does what
Provider
- Investigate and classify SIEM incidents
- Implement agreed detection-content changes
- Escalate findings and response recommendations
Your team
- Maintain SIEM hosting and source health
- Validate detection changes and incident context
- Execute containment and recovery
Details
Service scope
Best for Teams keeping their SIEM and an internal incident-response function
Existing platform
Splunk, QRadar and Sentinel are named. The buyer maintains hosting, licenses, source devices and log transport for the certified instance.
Shared detection operation
Verizon implements and maintains agreed detection content with joint validation. Custom engineering and work beyond the included ticket allowance need additional scope.
Buyer executes response
Analysts investigate and recommend action. Your team or a separately contracted responder carries out containment, repair and recovery.
Full service analysis
Verizon Managed SIEM investigates alerts and implements ongoing detection-content changes after joint validation with your team. You retain SIEM hosting, source health, change approval, containment and recovery.
- Your team owns
- Maintain SIEM hosting, licenses, source devices and log transport
- Supply incident context and validate detection changes
- Execute containment, remediation and recovery
Shared detection operations
Verizon implements ongoing detection-content changes after customer impact analysis and validation. This is recurring operational work, while SIEM hosting, source health and incident containment remain with the buyer.
Notification scope
The guide separates real-time and periodically reviewed detections. Its notification SLA excludes non-real-time handling and starts at the defined incident status, not first attacker activity.
Changes and data have limits
The guide meters content changes through a service-ticket allowance. Different change types consume different ticket quantities. It also distinguishes portal log availability from longer incident-associated retention. Agree the allowance, export format and exit window in the order.
Pricing & contract
The currently served guide describes setup and monthly charges per SIEM instance with one-, two- or three-year commitments. Contracted daily ingestion has overage charges. Extra instances, dedicated engineering and work beyond the included service-ticket allowance can add cost. Buyer licenses and maintenance remain separate.
Tradeoffs & buying questions
Strengths
-
Uses an existing customer SIEM
-
Includes ongoing detection-content implementation
-
Pairs analyst investigation with a defined change workflow
Considerations
-
Buyer executes containment and remediation
-
Non-real-time alerts have different notification commitments
-
Ingestion overages and extra engineering can add cost
Ask before buying
- Which SIEM instance and detection content will Verizon maintain, and what content-change ticket allowance and engineering work are included?
- Which detections are reviewed in real time, when does the notification clock start and who executes containment?
- What ingestion overages, extra-instance costs and retention or export limits apply to our order?
Integrations
Platform / SIEM
- Splunk
- IBM QRadar
- Microsoft Sentinel
Common questions
Does Verizon contain threats for us?
This service combines SIEM detection-content maintenance with investigation and recommendations. Your team or a separately contracted service executes containment and recovery.
Which SIEMs can we use?
The current service page names Splunk, IBM QRadar and Microsoft Sentinel. Confirm the certified version, hosting and instance scope.
How are charges structured?
The currently served guide specifies setup and monthly charges per SIEM instance and one-, two- or three-year commitments. Daily ingestion overages, additional instances and extra engineering can add charges.