Part of Defend, in progress — Threat Intel and Security are now part of Defend, not separate products. This area is still being built: some screens, menu names and actions described here may not be available yet, or may still show the older Threat Intel or Security names.
Detection availability: Detection evaluation is currently limited and may not be live in your environment, so alerts may not appear for activity on enrolled devices. No alerts does not mean a device is clean.
Defend includes a SIEM layer: one alert queue that brings together detections from the Defend agent and events from connected cloud sources, groups related alerts into incidents, and gives your analysts one place to triage them. It used to be documented as a separate product called Security (SIEM and SOC). That product is retired and is now part of Defend.
Defend is a tool for your team. It is not a managed SOC or MDR service, and The One Stack doesn't watch your clients' alerts around the clock.
How it fits together
- Defend agent (EDR): runs on each enrolled device and records process, network, file and sign-in activity. See What is Defend?
- SIEM alerts and incidents: where detections become alerts in one queue, and related alerts become incidents you work and close.
- Threat intelligence: dark web and credential exposure. See Threat intelligence in Defend.
- Phishing: reported-email triage for Microsoft 365. See Defend Phishing: overview.
Other apps cover other layers: Shield is DNS filtering, Cypher is security awareness training, CyberAssure is client compliance and risk scoring, and major incidents are run in the War Room in PSA.
Who uses it
- Security analysts: daily alert triage and incident investigation.
- Security engineers: managing detection rules and connectors.
- vCISOs and account managers: reviewing security reports for clients.
What's in it (in progress)
- Unified alert queue, filterable by severity, client, device and MITRE technique. See SIEM alerts in Defend.
- Incidents with a timeline view. See Security incidents in Defend.
- Detection rules (Sigma and behavioral). See SIEM detection rules in Defend.
- Cloud connectors (Microsoft 365, Google Workspace, Azure). See Log ingestion and connectors in Defend.
- Asset correlation and IOC matching. See Asset correlation in Defend.
- Not available yet: threat hunting and KQL queries. See Threat hunting in Defend.
FAQ
Is Security a separate product from Defend?
No. Security (SIEM and SOC) is now part of Defend. Older Security links open Defend, and some screens may still show the older name.
Can it cover multiple clients?
Yes. Data is kept per client organization, and analysts can filter the alert queue by client.