24/7 security monitoring
Round-the-clock eyes on every log, alert and sign-in across your tenants — weekends and holidays included.
Microsoft SentinelSIEM
SOC online · 24/7/365
Microsoft Sentinel + Defender XDR
Forensics on call
Every tenant.
Every signal.
Every second.
The XrossRoots Security Operations Center watches your Microsoft 365 and cloud estate around the clock — detecting, investigating and shutting down threats before they become breaches, and proving what happened when it matters.
Global threat posture
ELEVATED
Phishing & token-theft campaigns trending. All monitored tenants protected.
Events analysed / today
0
Logs, signals & telemetry
Alerts triaged
0
Human-reviewed
Threats contained
0
Auto + analyst actions
Mean time to detect
0m
Target < 10 minutes
Mean time to contain
0m
Target < 60 minutes (P1)
01 · Threat radarLive
CriticalHighMediumResolved
02 · Incident feedSIMULATED
03 · Tenants under watchHealthy
Every client tenant has its own health tile. Amber means an analyst is investigating; red means containment is underway.
Full-spectrum security operations
Detect. Respond.
Detect. Respond.
Investigate. Harden.
Everything a modern SOC should do — operated by our analysts on the Microsoft security stack you already license. Filter by mission.
Threat detection & hunting
Custom analytics rules plus proactive KQL hunts for attackers who slip past default alerts.
Defender XDRKQLUEBA
Identity threat protection
Risky sign-ins, impossible travel, MFA fatigue and token theft caught and blocked at the identity layer.
Entra ID ProtectionDefender for Identity
Email & collaboration security
Phishing, business email compromise and malicious links stopped in Outlook, Teams and SharePoint.
Defender for Office 365BEC
Incident response
Triage, containment, eradication and recovery — with a named analyst owning your incident until it's closed.
NIST 800-61Playbooks
Endpoint detection & response
Isolate compromised devices in seconds, kill malicious processes and roll back changes.
Defender for EndpointIntune
Automated response (SOAR)
Playbooks that revoke sessions, reset credentials and block indicators automatically — in seconds, not hours.
Logic AppsAutomation rules
Digital forensics
Evidence collection, timeline reconstruction and root-cause analysis across mailboxes, endpoints and cloud logs.
Unified Audit LogMemory & disk
Threat intelligence
Indicator enrichment, campaign tracking and dark-web credential monitoring for your domains.
Defender TIIOC feeds
BEC & fraud investigation
Trace mailbox takeovers, malicious inbox rules and payment-diversion fraud — and what the attacker saw.
Purview AuditMessage trace
Cloud security posture
Continuous Secure Score and posture reviews, misconfiguration fixes and Conditional Access tuning.
Defender for CloudSecure Score
Vulnerability management
Exposure scanning and risk-ranked patching so the most dangerous weaknesses close first.
Defender Vuln. MgmtExposure mgmt
Awareness & phishing simulation
Realistic phishing drills and short training that turn staff into a reporting line, not a risk.
Attack simulationTraining
Data loss prevention & insider risk
Sensitivity labels, DLP policies and insider-risk signals that keep confidential data inside.
Microsoft PurviewDLP
Compliance & reporting
Audit-ready evidence and executive dashboards aligned to ISO 27001, SOC 2, GDPR and local regulation.
ISO 27001SOC 2GDPR
Backup & ransomware resilience
Immutable Microsoft 365 backups and tested recovery plans, so ransomware is an inconvenience — not a crisis.
M365 BackupDR testing
Incident response · playback
Watch an incident
Watch an incident
unfold — and end.
A realistic business-email-compromise attempt, from first alert to closed case. Press play, or click any stage.
Case · INC-2047EXAMPLE
Suspicious inbox rule & impossible travel
Tenant: VELLORA-FIN · User: a.mehta@vellora.example
Digital forensics & investigation
When it matters,
When it matters,
we prove what happened.
After an incident, leadership, insurers and sometimes regulators need answers: how they got in, what they touched, and whether it's over. Our forensics team reconstructs the full story — with evidence that stands up.
Microsoft 365 audit-log forensicsUnified Audit Log, sign-in and mailbox audit analysis to trace every attacker action.
Mailbox & BEC forensicsInbox rules, forwarding, OAuth app grants and exactly which emails were read or sent.
Endpoint triage & memory captureLive response, disk and memory collection, and malware analysis on affected devices.
Chain of custodyHashed, time-stamped evidence handling suitable for insurers, HR and legal teams.
Root-cause & executive reportsA clear technical report plus a plain-language summary for the board and stakeholders.
Evidence board · Case INC-2047EXAMPLE
2026-09-14 01:52:07 UTC
Phishing email delivered — lookalike invoice link
EmailEvents · Defender for Office 365
2026-09-14 02:03:41 UTC
Credentials entered on spoofed sign-in page; token replayed
SigninLogs · Entra ID
2026-09-14 02:09:12 UTC
Hidden inbox rule created: move “invoice” mail to RSS folder
OfficeActivity · New-InboxRule
2026-09-14 02:14:30 UTC
SOC alert fires — impossible travel + suspicious rule correlated
Sentinel incident · Severity High
2026-09-14 02:21:05 UTC
Sessions revoked, account disabled, rule removed
Playbook · Analyst-approved
2026-09-14 09:30:00 UTC
Forensic report: no data exfiltrated, no payment diverted
Root-cause report · Delivered
EVIDENCE unified-audit-export_INC-2047.json
SHA-256 9f2c4e…b71a08 (sample)
CUSTODY Collected 02:24 UTC · sealed · access-logged
SHA-256 9f2c4e…b71a08 (sample)
CUSTODY Collected 02:24 UTC · sealed · access-logged
MITRE ATT&CK® coverage
Mapped to how
Mapped to how
attackers actually work.
Our detections are mapped to the MITRE ATT&CK framework, so you can see exactly which attacker techniques are covered — and where to invest next.
Global attack surface · MITRE ATT&CK® tacticsDefending
TA0001Detect + automated response
Initial Access
Stopped by
Detect + automated response
Detect + analyst response
Visibility / hunting
Hover or tap a pin to inspect a tactic
Illustrative view — pin positions are symbolic, not attack origins. Each client receives an ATT&CK coverage map for their own tenant during onboarding, reviewed quarterly.
Severity & response targets
Clear rules for
Clear rules for
when the clock starts.
Every alert is classified by severity, and every severity has a response target written into your agreement.
P1Critical
Active compromise, ransomware or data exfiltration in progress.
- Acknowledge
- ≤ 15 min
- Containment
- ≤ 1 hour
- Updates
- Every 30 min
P2High
Confirmed malicious activity on an account or device, contained scope.
- Acknowledge
- ≤ 30 min
- Containment
- ≤ 4 hours
- Updates
- Every 2 hours
P3Medium
Suspicious behaviour needing investigation; no confirmed impact.
- Acknowledge
- ≤ 4 hours
- Resolution
- 1 business day
- Updates
- Daily
P4Low
Policy deviations, hygiene findings and informational alerts.
- Acknowledge
- 1 business day
- Resolution
- Scheduled
- Updates
- Monthly report
Typical targets shown. Final response times are agreed per client and written into the service-level agreement.
DAILY
Analyst-reviewed alerts
Nothing is auto-closed without a human decision.
- Triage notes on every alert
- Escalations by Teams, email & phone
MONTHLY
Security operations report
What we saw, what we stopped, and what to fix next.
- Incidents & trends
- Secure Score movement
- Top recommendations
QUARTERLY
Executive security review
A board-ready briefing on risk, coverage and roadmap.
- ATT&CK coverage map
- Tabletop exercise option
- Compliance evidence pack
Who's on watch
Meet the
Meet the
SOC lead.
Every SOC engagement has a named lead accountable for detection quality, response and the reports you receive.
Get protected
Put your tenant
Put your tenant
on our watch.
Start with a free security posture review of your Microsoft 365 tenant. We'll show you what we'd monitor, what we'd fix first, and how onboarding works.
Request a call
Tell us what you need and pick two time slots on different days, in your own time zone. We'll confirm one within one business day.
Request a callPrefer email? bridge@xrossroot.com