Defend's console is organised around five surfaces that match the lifecycle of an MSP SOC: Sense (detect), Investigate (understand), Respond (act), Harden (close gaps), and Prove (report). This article is a map of where each workflow lives so you can find the right page fast. Defend runs at app.theonestack.com/defend.
Sense — detect
The Sense surface is the front line. Its landing page is the Command Center, your at-a-glance triage view. Sense contains:
-
Command Center (
/defend) — the SOC overview and triage starting point. -
Active Alerts (
/defend/sense/alerts) — detections that have fired; critical items first. -
Incidents (
/defend/sense/incidents) — alerts escalated/correlated into tracked incidents. -
Patterns (
/defend/sense/patterns) — behavioral patterns surfaced by the engine. -
Inbox (
/defend/sense/inbox) — the queue of items needing attention.
Investigate — understand
The Investigate surface is for digging into an entity or alert:
-
Entity Search (
/defend/investigate) — search devices, identities, domains, IPs, people, assets. -
Saved Queries (
/defend/investigate/saved) — reusable threat-hunt queries. -
Graph Explorer (
/defend/investigate/graph) — visualise relationships between entities. -
Attack Chains (
/defend/investigate/attack-chains) — related detections linked into one attack story; open a chain to replay it.
Respond — act
The Respond surface is where you take action on an incident:
-
Active Incidents (
/defend/respond) — incidents in flight. -
Playbooks (
/defend/respond/playbooks) — SOAR response workflows. Run them from an alert, or have them run on a rule where automated response has been enabled (off by default). -
Endpoints (
/defend/respond/endpoints) — managed agents; isolate, kill a process, collect forensics. -
Comm Templates (
/defend/respond/comms) — client/communication templates. -
PSA Queue (
/defend/respond/psa) — items handed to the PSA for ticketing. -
Approvals (
/defend/respond/approvals) — actions awaiting approval before they execute.
Harden — close gaps
The Harden surface turns posture data into a remediation worklist:
-
Posture (
/defend/harden) — the overall hardening scorecard. -
Policy (
/defend/harden/policy) — detection/response policy. -
Training Gaps (
/defend/harden/training) — users who need security training. -
Patch Gaps (
/defend/harden/patches) — missing patches. -
MFA Coverage (
/defend/harden/mfa) — identities without MFA. -
CA Drift (
/defend/harden/ca-drift) — conditional-access policy drift.
Prove — report
The Prove surface produces the evidence and reports clients and auditors want:
-
Customer Reports (
/defend/prove/reports) — build a client-facing report. -
Compliance Evidence (
/defend/prove/evidence) — evidence for compliance frameworks. -
MITRE Coverage (
/defend/prove/mitre) — which ATT&CK tactics/techniques your flagged rules map to. It is a read of the rule store, and it names its evaluation arm: rule evaluation is retired on this arm, so the map does not report what the engine is evaluating. -
Executive QBR (
/defend/prove/qbr) — quarterly business review deck. -
Audit Exports (
/defend/prove/audit) — raw exports for auditors. -
Scheduled Reports (
/defend/prove/scheduled) — recurring report delivery.
A Typical Flow
Detection availability: Detection evaluation is currently limited and may not be live in your environment, so alerts may not appear for activity on enrolled devices. This article describes how the workflow runs when detections are evaluating; it does not promise a working first detection today. No alerts does not mean a device is clean.
- Sense — an alert fires; you triage it from the Command Center / Active Alerts.
- Investigate — open the alert or its attack chain, read the process tree and timeline, search related entities.
- Respond — isolate the endpoint, run a playbook, or push the item to the PSA queue. Sensitive actions can require Approvals.
- Harden — fix the underlying gap (MFA, patch, training, CA) so it does not recur.
- Prove — show the client what happened and that the gap is closed via a report or QBR.
FAQ
Where do I start each day?
The Command Center (/defend) — it is the Sense landing page and your triage overview.
Where do response actions like isolate live? Under Respond → Endpoints, or directly from an investigation. See Isolating Endpoints and Remediation Actions.
Can I scope protection to only certain M365/Google groups? Group-based protection scoping (protect selected M365/Google groups and ignore the rest) is being rolled out. Until it ships in your environment, Defend protects enrolled devices and identities at the organization level. This article will be updated when group scoping is available.