Multi-Platform Managed Detection and Response (MDR) Service
IT Partner delivers Managed Detection and Response (MDR) on the platform that fits your environment — Microsoft Sentinel, N-able’s MDR platform, or another supported third-party SIEM/MDR stack. We onboard or validate the monitored scope, tune detections and automation, triage incidents within contracted service levels, coordinate approved containment actions, and report monthly. The service is priced at $15 per user per month; 24/7 coverage and major-incident labor are included only when the contract explicitly says so. For Sentinel-only monitoring that builds on IT Partner’s own Sentinel implementation, see the Microsoft Sentinel SIEM/SOAR Ongoing Monitoring service.
What this engagement is
A managed detection and response service requires precise operational boundaries. The statement of work defines which platform is monitored — Microsoft Sentinel, N-able’s MDR platform, or another supported third-party SIEM/MDR stack — who monitors which sources, when analysts are available, how severity and escalation work, which response actions may run automatically, what the client must approve, and which platform and licensing costs remain with the vendor. IT Partner is platform-flexible by design: we partner with N-able and can deliver the service on N-able’s platform, on Microsoft Sentinel, or on an agreed third-party stack, with 24/7 coverage available through IT Partner’s own NOC or partner relationships when contracted. This distinguishes the service from IT Partner’s Microsoft Sentinel SIEM/SOAR Ongoing Monitoring, which is built specifically for Sentinel deployments we implement. Automated responses use the chosen platform’s capabilities — such as Azure Logic Apps playbooks on Sentinel — and require explicit permissions and change control. The service reduces detection and response risk but cannot guarantee that every threat will be detected or prevented.
Success criteria
What you receive
How the work unfolds
Service kickoff and platform selection: confirm business constraints, security priorities, endpoint counts, data expectations, response authority, escalation contacts, and reporting recipients, and agree the detection platform — Microsoft Sentinel, N-able, or another supported stack — based on your environment, licensing, and cost profile.
Access and readiness validation: validate IT Partner access to the chosen platform, the connected Microsoft or third-party security services, and the relevant tenants and subscriptions; review licensing, data retention, connector or agent health, and any existing detection configuration.
Data source and detection onboarding: onboard or validate the agreed data sources and detection content, prioritizing high-value identity, endpoint, cloud, network, and security telemetry already available to the client.
Detection tuning and baseline: review existing detections, map priority use cases to the client environment, suppress known benign activity, tune severity and entity mapping, and establish an initial alert baseline to reduce noise.
Automation and containment playbook configuration: implement or refine the agreed automated responses on the chosen platform — such as Sentinel automation rules and Logic Apps playbooks, or the equivalent response automation in N-able or the selected third-party stack — for triage, notification, enrichment, ticket creation, and approved containment actions.
Operational runbook and escalation setup: document triage categories, escalation paths, notification methods, severity handling, client approval requirements, and handoff procedures for incidents that require client action or broader remediation.
Service transition and steady-state operations: move into recurring MDR operations with alert triage, incident response activities, detection tuning within the agreed coverage, and monthly security reporting.
Prerequisites
Who does what
IT Partner
- Onboard or validate data sources and detections on the chosen platform
- Tune detection content and reduce noise
- Provide alert triage within the agreed service coverage
- Run approved incident response and containment playbooks
- Deliver periodic threat reporting
Your team
- Maintain the licensing, subscriptions, and cloud consumption required for the chosen platform and the agreed monitoring scope.
- Provide timely administrative access, delegated permissions, or approved partner access required for the chosen platform and the connected security, identity, automation, and reporting services.
- Identify business owners, technical contacts, and security escalation contacts who can respond to incident notifications and approve containment or remediation actions when required.
- Confirm the approved response authority for IT Partner, including which automated or manual containment actions may be taken without additional approval and which require client authorization.
- Provide context for known applications, privileged accounts, service accounts, business-critical systems, maintenance windows, expected administrative activity, and accepted risks so detections can be tuned responsibly.
- Perform or approve remediation activities that remain under client control, such as user communication, business application changes, endpoint rebuilds, third-party vendor coordination, and policy decisions.
- Review monthly security reports and participate in periodic service reviews, prioritization discussions, and improvement planning.
What's not included
Limitations & technical notes
Frequently asked questions
What is IT Partner’s Multi-Platform Managed Detection and Response (MDR) service?
It is an ongoing monthly managed security service that delivers threat detection, alert triage, incident response coordination, containment playbooks, and monthly reporting on the detection platform that fits your environment — Microsoft Sentinel, N-able’s MDR platform, or another supported third-party SIEM/MDR stack. The contract defines the monitored scope, coverage hours, response authority, and service levels.
Which MDR/SIEM platforms can IT Partner use?
Microsoft Sentinel, N-able’s MDR platform — IT Partner is an N-able partner — or another supported third-party SIEM/MDR stack agreed during scoping. The platform is chosen at kickoff based on your existing estate, licensing, data volume, and cost profile, so you are not forced onto a single vendor.
How is this different from the Microsoft Sentinel SIEM/SOAR Ongoing Monitoring service?
Microsoft Sentinel SIEM/SOAR Ongoing Monitoring is built specifically for production Sentinel deployments and follows on from IT Partner’s Sentinel implementation. This MDR service is platform-flexible: it can run on N-able or another third-party stack, and it fits organizations that do not have Sentinel or prefer not to run one.
Who is this MDR service for?
Organizations that want ongoing managed detection and response without committing to a single SIEM vendor. An existing Microsoft Sentinel deployment can be used but is not required — the platform can also be N-able-based or another supported stack agreed during scoping.
What is included in the MDR service?
The contract defines the monitored platform, data sources, coverage hours, detection content, triage and escalation process, response authority, reporting, service levels, and which vendor costs remain with the client. 24/7 coverage and major-incident labor are included only when explicitly stated.
Does this service include deploying the detection platform from scratch?
Onboarding can include validating or adding agreed sources and detections on an existing platform, and N-able-based deployments are arranged through IT Partner’s N-able partnership when that platform is selected. Full greenfield Sentinel architecture, large migrations, and extensive connector deployment require explicit scope.
What does IT Partner do during the monthly MDR service?
IT Partner onboards or validates data sources and detections on the chosen platform, tunes detection content, reduces alert noise, provides alert triage within the agreed service coverage, runs approved incident response and containment playbooks, and delivers periodic threat reporting.
What incident response is included?
Analysts investigate and coordinate response within the contracted severity, coverage, labor, and authority boundaries. Forensic services, legal or breach counsel, crisis communications, ransomware negotiation, and unlimited major-incident labor are separate unless expressly included.
Are automated responses included?
Approved automation on the chosen platform may be configured or tuned — Sentinel automation rules and Azure Logic Apps playbooks, or the equivalent automated response capabilities in N-able or the selected third-party stack. Each playbook requires testing, permissions, change control, and a documented decision about automatic versus human-approved actions.
Can IT Partner provide 24/7 coverage?
Yes, when contracted. 24/7 coverage is delivered through IT Partner’s own NOC or partner relationships such as N-able, and is priced as part of the service order rather than included by default.
How is the service priced?
The service is priced at $15 per user per month. The final monthly total is confirmed during scoping based on user count, the chosen platform, data volume, integrations, coverage window, and response obligations.
Is this a one-time project or an ongoing service?
This is an ongoing monthly managed service, not a one-time implementation. After onboarding and tuning, it continues as recurring detection, triage, response, and reporting for as long as the contract runs.
How long does onboarding take?
Onboarding time depends on the chosen platform and the number of data sources and endpoints in scope. The schedule is set at kickoff and precedes the first full monthly service cycle.
What are the client’s responsibilities?
Maintain the platform licensing and consumption costs, provide timely access and permissions, name escalation contacts who can approve containment or remediation, confirm IT Partner’s response authority, provide environment context for responsible tuning, perform remediation that stays under client control, and participate in monthly reviews.
What is not included in the service?
Platform licensing and subscription costs, cloud consumption, net-new platform architecture unless scoped, large remediation projects, full forensics and breach counsel work, custom integrations beyond the agreed scope, onsite response, and unlimited major-incident labor. 24/7 coverage is available only when contracted.
How is success measured for this service?
By an actively defended environment: the monitored scope documented and under change control, incidents triaged and closed within the contracted procedure, approved automation tested and recorded, and recurring reports showing service activity, tuning progress, material incidents, and recommended improvements.