Security is the unified SOC/SIEM platform for MSPs. It consolidates alerts from endpoint agents, cloud connectors, IOC feeds, vulnerability scans, and compliance checks into a single queue — so analysts and SOC operators work from one place instead of juggling multiple dashboards.
The platform is multi-tenant: one Security instance covers all your client organizations with separate data per org. A posture score on the dashboard gives a rolling composite view across all open risk.
How Security Fits With Defend and Shield
These three products cover different layers of security operations:
Security (this product) is the SOC and SIEM layer. Its job is detection, correlation, investigation, and response. It ingests events from every source, runs detection rules against them, groups related alerts into incidents, and gives analysts the tools to triage and close out threats.
Defend is the endpoint detection and response (EDR) layer. It runs on individual devices, records security telemetry continuously, and evaluates detection rules against it. It does not enforce blocking policies on the endpoint. Detection events from Defend flow into Security, where they become alerts in the main queue and contribute to MITRE coverage reporting. Defend configuration (detection policies, exclusions) is accessible through the Defend sub-product.
Defend is the identity and email risk layer. It monitors user risk scores, enforces email security policies (SPF, DKIM, DMARC), runs Security Awareness Training (SAT) campaigns, and tracks shadow-AI usage. Defend findings surface in the Security dashboard alongside alerts from other sources.
In short: Defend is the sensor and enforcement layer. Security is where everything comes together for investigation and response.
Who Uses Security
- SOC analysts — daily alert triage, incident investigation, threat hunting, and response actions
- Security engineers — managing detection rules, tuning thresholds, configuring connectors
- MSP vCISOs and account managers — reviewing compliance posture and generating reports for client delivery
What Security Includes
- SOC dashboard with posture score
- Unified alert queue (all sources, filterable by severity, client, device, MITRE technique)
- Incident management with timeline view
- Detection rules (Sigma, KQL, and behavioral)
- SIEM data connectors (M365, Google Workspace, Azure)
- Threat hunting with natural-language and KQL query support
- IOC tracking and live fleet matching
- Fleet intel showing per-IOC and per-MITRE match counts
- Vulnerability management with CVE triage and remediation tracking
- Email security and DMARC report parsing
- Compliance framework rollup (connects to the Compliance product)
- Alert tuning suggestions
FAQ
Is Security the same as Defend? No. Defend is the EDR agent and enforcement layer. Security is the SOC/SIEM platform that receives events from Defend (and every other source) and gives analysts a place to investigate them.
Do I need Defend active to use Security? No. Security works with any combination of active connectors and agents. Defend integration is additive — enabling it adds endpoint detection events to the alert queue and populates MITRE coverage data.
Can Security cover multiple client organizations? Yes. The platform is multi-tenant by design. Each org's data is isolated, and analysts can filter the alert queue by client.