IT Partner delivers Managed Detection and Response (MDR) on the platform that fits your environment — Microsoft Sentinel, N-able’s MDR platform, or another supported third-party SIEM/MDR stack. We onboard or validate the monitored scope, tune detections and automation, triage incidents within contracted service levels, coordinate approved containment actions, and report monthly. The service is priced at $15 per user per month; 24/7 coverage and major-incident labor are included only when the contract explicitly says so. For Sentinel-only monitoring that builds on IT Partner’s own Sentinel implementation, see the Microsoft Sentinel SIEM/SOAR Ongoing Monitoring service.
A managed detection and response service requires precise operational boundaries. The statement of work defines which platform is monitored — Microsoft Sentinel, N-able’s MDR platform, or another supported third-party SIEM/MDR stack — who monitors which sources, when analysts are available, how severity and escalation work, which response actions may run automatically, what the client must approve, and which platform and licensing costs remain with the vendor. IT Partner is platform-flexible by design: we partner with N-able and can deliver the service on N-able’s platform, on Microsoft Sentinel, or on an agreed third-party stack, with 24/7 coverage available through IT Partner’s own NOC or partner relationships when contracted. This distinguishes the service from IT Partner’s Microsoft Sentinel SIEM/SOAR Ongoing Monitoring, which is built specifically for Sentinel deployments we implement. Automated responses use the chosen platform’s capabilities — such as Azure Logic Apps playbooks on Sentinel — and require explicit permissions and change control. The service reduces detection and response risk but cannot guarantee that every threat will be detected or prevented.
Service kickoff and platform selection: confirm business constraints, security priorities, endpoint counts, data expectations, response authority, escalation contacts, and reporting recipients, and agree the detection platform — Microsoft Sentinel, N-able, or another supported stack — based on your environment, licensing, and cost profile.
Access and readiness validation: validate IT Partner access to the chosen platform, the connected Microsoft or third-party security services, and the relevant tenants and subscriptions; review licensing, data retention, connector or agent health, and any existing detection configuration.
Data source and detection onboarding: onboard or validate the agreed data sources and detection content, prioritizing high-value identity, endpoint, cloud, network, and security telemetry already available to the client.
Detection tuning and baseline: review existing detections, map priority use cases to the client environment, suppress known benign activity, tune severity and entity mapping, and establish an initial alert baseline to reduce noise.
Automation and containment playbook configuration: implement or refine the agreed automated responses on the chosen platform — such as Sentinel automation rules and Logic Apps playbooks, or the equivalent response automation in N-able or the selected third-party stack — for triage, notification, enrichment, ticket creation, and approved containment actions.
Operational runbook and escalation setup: document triage categories, escalation paths, notification methods, severity handling, client approval requirements, and handoff procedures for incidents that require client action or broader remediation.
Service transition and steady-state operations: move into recurring MDR operations with alert triage, incident response activities, detection tuning within the agreed coverage, and monthly security reporting.
It is an ongoing monthly managed security service that delivers threat detection, alert triage, incident response coordination, containment playbooks, and monthly reporting on the detection platform that fits your environment — Microsoft Sentinel, N-able’s MDR platform, or another supported third-party SIEM/MDR stack. The contract defines the monitored scope, coverage hours, response authority, and service levels.
Microsoft Sentinel, N-able’s MDR platform — IT Partner is an N-able partner — or another supported third-party SIEM/MDR stack agreed during scoping. The platform is chosen at kickoff based on your existing estate, licensing, data volume, and cost profile, so you are not forced onto a single vendor.
Microsoft Sentinel SIEM/SOAR Ongoing Monitoring is built specifically for production Sentinel deployments and follows on from IT Partner’s Sentinel implementation. This MDR service is platform-flexible: it can run on N-able or another third-party stack, and it fits organizations that do not have Sentinel or prefer not to run one.
Organizations that want ongoing managed detection and response without committing to a single SIEM vendor. An existing Microsoft Sentinel deployment can be used but is not required — the platform can also be N-able-based or another supported stack agreed during scoping.
The contract defines the monitored platform, data sources, coverage hours, detection content, triage and escalation process, response authority, reporting, service levels, and which vendor costs remain with the client. 24/7 coverage and major-incident labor are included only when explicitly stated.
Onboarding can include validating or adding agreed sources and detections on an existing platform, and N-able-based deployments are arranged through IT Partner’s N-able partnership when that platform is selected. Full greenfield Sentinel architecture, large migrations, and extensive connector deployment require explicit scope.
IT Partner onboards or validates data sources and detections on the chosen platform, tunes detection content, reduces alert noise, provides alert triage within the agreed service coverage, runs approved incident response and containment playbooks, and delivers periodic threat reporting.
Analysts investigate and coordinate response within the contracted severity, coverage, labor, and authority boundaries. Forensic services, legal or breach counsel, crisis communications, ransomware negotiation, and unlimited major-incident labor are separate unless expressly included.
Approved automation on the chosen platform may be configured or tuned — Sentinel automation rules and Azure Logic Apps playbooks, or the equivalent automated response capabilities in N-able or the selected third-party stack. Each playbook requires testing, permissions, change control, and a documented decision about automatic versus human-approved actions.
Yes, when contracted. 24/7 coverage is delivered through IT Partner’s own NOC or partner relationships such as N-able, and is priced as part of the service order rather than included by default.
The service is priced at $15 per user per month. The final monthly total is confirmed during scoping based on user count, the chosen platform, data volume, integrations, coverage window, and response obligations.
This is an ongoing monthly managed service, not a one-time implementation. After onboarding and tuning, it continues as recurring detection, triage, response, and reporting for as long as the contract runs.
Onboarding time depends on the chosen platform and the number of data sources and endpoints in scope. The schedule is set at kickoff and precedes the first full monthly service cycle.
Maintain the platform licensing and consumption costs, provide timely access and permissions, name escalation contacts who can approve containment or remediation, confirm IT Partner’s response authority, provide environment context for responsible tuning, perform remediation that stays under client control, and participate in monthly reviews.
Platform licensing and subscription costs, cloud consumption, net-new platform architecture unless scoped, large remediation projects, full forensics and breach counsel work, custom integrations beyond the agreed scope, onsite response, and unlimited major-incident labor. 24/7 coverage is available only when contracted.
By an actively defended environment: the monitored scope documented and under change control, incidents triaged and closed within the contracted procedure, approved automation tested and recorded, and recurring reports showing service activity, tuning progress, material incidents, and recommended improvements.