Who does what
Provider
- Investigate agreed telemetry
- Execute permitted containment
- Report actions through partner workflows
Your team
- Maintain tools and telemetry
- Set approval and contact rules
- Restore services and make other changes
Coverage
- Endpoints
- Identity & Access
- SaaS Applications
Details
Service scope
Best for MSPs retaining their existing endpoint tools and customer operations
Response authority
Advanced permits host and account containment. The onboarding runbook defines pre-authorized actions and approval exceptions.
Tier boundary
Essential is advice-only. Proactive hunting starts in Premium and incident-response retainer access is listed under Elite.
Commercial basis
Partner rates are private. Confirm the tier, asset or ingestion basis, source coverage and retention in the quote.
Full service analysis
Vijilan ThreatRespond Advanced investigates alerts and can isolate hosts, disable accounts and block indicators within the agreed response runbook. Your MSP maintains the connected tools and telemetry, defines approval limits and owns recovery and changes outside that scope.
- Your team owns
- Maintain tool access, connectors and reliable telemetry
- Agree permitted actions, exceptions and escalation contacts
- Complete recovery and changes outside the response runbook
Advanced changes who acts
Essential leaves execution with the MSP. Advanced adds direct containment. The onboarding runbook defines the actions Vijilan may take and those requiring approval. Agree recovery responsibilities alongside those permissions.
Hunting is a separate tier decision
The current package table places proactive ThreatHunt in Premium. Advanced includes identity response and credential monitoring, but buyers should confirm hunting and incident-response retainers separately.
Read the response clock carefully
The published SLA summary starts its response clock at confirmed triage or a partner ticket and measures an analyst taking ownership. It is not a guarantee that an incident is contained by that deadline. The executed agreement controls remedies.
Pricing & contract
- Billing
- Per-endpoint, Per-user, Custom
Rates are shared privately with verified partners. Confirm the Advanced tier, asset or ingestion basis and contract term in the quote.
Tradeoffs & buying questions
Strengths
-
Keeps supported existing endpoint tools
-
Defines approval-dependent and pre-authorized actions
-
ConnectWise tickets and notes synchronize both ways
Considerations
-
Essential does not include direct containment
-
Proactive hunting starts in Premium
-
Response commitments depend on working telemetry and contacts
Ask before buying
- Which tools and actions are pre-authorized, and which require approval?
- Who repairs telemetry, restores systems and communicates with each client?
- Which tier, sources, retention and billing units does the quote include?
Integrations
Platform / SIEM
- ThreatLog
- CrowdStrike Falcon Next-Gen SIEM
Endpoint
- SentinelOne
- Microsoft Defender for Endpoint
- Carbon Black
1 more integrations
- CrowdStrike Falcon
Other integrations
- Microsoft 365
- Active Directory
- Microsoft Entra ID
1 more integrations
- ConnectWise PSA
Common questions
Is ThreatRespond the same service as ThreatDefend?
ThreatRespond works with the customer's existing supported tools. ThreatDefend is Vijilan's separate CrowdStrike-based service.
Does the public SLA guarantee containment within 15 minutes?
No. The published critical response target measures analyst ownership after confirmed triage or a partner ticket. Contract terms and approved actions still govern.