All agents

COMINGSOC · SIEM and EDR alarms

XDefend Reads two alarms as one incident

XDefend reads SIEM and EDR alarms together, not one by one. It brings the user, the device and the last 24 hours together, writes what happened in plain words, opens the security ticket and reaches the on-call analyst. If nobody answers it hands the incident to the XSecure SOC team.

What it does

  1. 01

    Joins the alarms

    It gathers SIEM and EDR alarms about the same user or device into one incident.

  2. 02

    Gathers the context

    Who signed in, from which device and where; what happened in the last 24 hours, all beside the incident.

  3. 03

    Writes the priority

    It explains why an incident is high or low priority; the decision stays with the team.

  4. 04

    Opens the ticket and calls

    It opens the security ticket and calls the on-call analyst in your scenario’s order.

  5. 05

    Hands over to the SOC

    If nobody answers it hands the incident to the XSecure SOC with the context it gathered; the analyst does not start from zero.

  6. 06

    Suggests a response

    If a step such as isolating a device is needed it suggests it; the step is taken only with your approval.

How it works

  1. Detects

    It reads the SIEM and EDR alarms together and matches the ones that belong to one incident.

  2. Plans the action

    It writes the summary, the context and the step it suggests; who is told is in your scenario.

  3. Hands you the control

    Every suggested response comes to you for approval; if nobody answers, the incident goes to the XSecure SOC.

  4. Records it

    The alarms, the decisions and the moment of hand-over stay on one incident record, with their times.

What it never touches

  • It isolates no device and locks no account without your approval.
  • It does not close or delete alarms; closing is your team’s call.
  • It keeps the context it gathers on the incident record only.

What it connects to

Source
SIEM (such as QRadar), EDR (such as Microsoft Defender)
Action
ITSM ticket, on-call phone call
Hand-over
XSecure SOC

Let us talk through how the agent would run in your own environment.

Request a meeting
Next agentXOperateIT operations · nightly checks