AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
November 10, 2026
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
ThreatDefence AI alert triage investigates every alert as it arrives. Agents query your connected security tools, assess the evidence, and deliver clear verdicts with recommended next steps, helping your team cut through noise and act on real threats.
ThreatDefence AI Auto Triage investigates every alert across your connected tools, resolves benign activity under your policies, and prepares real threats for response. Your analysts spend less time clearing noise and more time on cases that matter.
Every alert gets investigated, and benign activity closes under your approved policies. Suspicious and uncertain cases reach analysts with context, evidence, and clear verdicts, so your team focuses on threats instead of clearing noise.
AI agents query connected tools, follow leads, and build investigation timelines without manual evidence gathering. Findings and recommended actions arrive together, saving analyst time and reducing dependence on a few experienced investigators.
Confirmed threats become actionable cases with containment steps ready to run. Authorized actions execute automatically, while escalations and approval requests reach the right people with the evidence needed to act.
Analyst feedback, verdict changes, and response outcomes improve future investigations. AI automatically drafts new detections, tunes existing rules, and proposes targeted allow-list entries for review, reducing recurring false positives and strengthening coverage as your environment changes.
AI agents investigate alerts, add context, and prepare cases for response. Your team gets the evidence to act, with approvals and automation under your control.
Agents investigate every alert across your connected tools, including low-severity signals. They query live data and follow suspicious activity to establish what happened.
Asset details, identity activity, threat intelligence, and previous cases enrich each alert. Evidence from across your tools helps distinguish expected behavior from potential compromise.
Suspicious and uncertain findings become cases with clear verdicts, severity, and supporting evidence. Escalations reach the right analysts with recommended next steps ready.
Attacker actions are recorded in the case, with containment steps prepared in sequence. Revoke sessions, isolate endpoints, and block malicious activity within approved limits or after analyst approval.
AI agents investigate alerts from every connected source, applying shared security context and consistent assessment across your stack. Handle growing alert volumes while keeping verdicts, automated responses, and cases needing analyst attention visible in one view.
Connect your security and business tools through ready-to-use integrations. Give AI agents access to the data and actions they need, with permissions you control.
Keep evidence, timelines, verdicts, and response actions in one case. Analysts and AI agents work together, with clear ownership, approvals, and progress tracking through to resolution.
Connect the tools that raise most of your alerts and watch the agents investigate them in co-pilot mode, with every query on the record.
Give analysts the context and controls to move investigations forward. Review enriched findings, take response actions, and automate remediation across connected tools from one workspace.
Users, hosts, IP addresses, file hashes, and domains are enriched with reputation, first and last seen, and related cases, helping analysts connect activity and assess its significance.
Revoke sessions, remove inbox rules, reset passwords, or isolate endpoints from the case. Approval rules and execution limits control each action, with outcomes recorded alongside the investigation.
Run response workflows across your connected environment, including security platforms, business systems, and ITSM tools. Coordinate actions, synchronize tickets and updates, and track outcomes in the case.
Every AI verdict includes a confidence score backed by the investigation’s evidence. Connecting relevant data across your tools gives agents a fuller picture, helping close evidence gaps and distinguish expected activity from threats. Missing or conflicting information remains visible for analyst review.
The platform lets you adjust playbooks and response rules based on confidence, severity, and the action’s impact. Set thresholds for closing benign alerts, escalating uncertain cases, or preparing containment for approval. As data coverage and investigation quality improve, you can expand automation within the limits you control.
Here’s an example of how AI investigates a credential dumping alert, gathers evidence across your tools, and prepares a verdict for analyst review.
WerFault.exe accessed LSASS memory on ACM-FIN-07, triggering a high-severity detection mapped to T1003.001. The agent begins investigating the process, its origin, and surrounding activity.
The process tree and Microsoft signature are consistent with Windows Error Reporting. A memory dump was created. Crash handling is a possible explanation, but the agent continues checking for deliberate abuse.
The agent checks current configuration and recent changes associated with LocalDumps and SilentProcessExit. No suspicious changes are found in the available history. This supports the assessment but does not rule out abuse by itself.
An application error records lsass.exe crashing at 03:12:43, immediately before the alert. The timing supports crash-related memory access.
Two other finance workstations show similar activity. All three recently installed the same update, giving IT a common change to investigate without assuming it caused the crashes.
The agent checks available file, network, and sign-in telemetry. It finds no evidence of dump transfer, suspicious outbound activity, or related account misuse in the reviewed window.
Likely benign crash-related activity · 88% confidenceThe case includes the supporting evidence, query history, and remaining limitations. Closure requires analyst confirmation, and the dump files are flagged for secure handling.
The analyst validates the crash evidence and configuration checks, then closes the three related alerts. IT receives follow-up tasks to investigate the crashes and securely handle the dumps under the organization’s retention policy.
Track investigation coverage, MTTD, MTTR, analyst time saved, and verdict quality in the platform. Review the evidence behind each assessment, record corrections, and use analyst feedback to refine investigation skills, customer context, and closure policies.
AI agents also use investigation outcomes to identify recurring noise and detection gaps, then propose improvements:
Adjust conditions and thresholds that repeatedly flag expected activity.
Create narrow exceptions for verified activity, such as authorized scanning.
Propose throttling or retiring rules after reviewing their detection coverage.
Draft rules from confirmed attacker behavior to catch similar activity earlier.
Each proposal links to its supporting investigations and moves through testing and approval as a merge request. Track rule precision alongside analyst agreement, overrides, and incorrect closures to see whether changes improve quality as well as speed.
Faster investigations. Clear evidence. Coordinated response.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
AI alert triage uses AI agents to assess incoming security alerts. Agents gather evidence from connected tools, test benign and malicious explanations, and record a verdict, priority, and recommended next steps for review or closure under approved policies.
The term describes an AI agent that performs investigation tasks such as querying security tools, correlating activity, and preparing an assessment. In triage, it handles the initial investigation so human analysts can focus on suspicious activity, uncertainty, and response decisions.
Yes, for alert classes you explicitly authorize and where evidence requirements and closure criteria are met. Each closure retains its investigation record, closed alerts are sampled for quality, and uncertain or conflicting findings go to an analyst.
Accuracy varies by alert class, available data, and investigation method. ThreatDefence tracks analyst agreement, overrides, incorrect closures, and missed escalations, with monthly quality reporting to help customers assess performance and set appropriate autonomy.
The case goes to an analyst with the evidence collected, the checks completed, and a clear explanation of what remains unresolved. Missing data and conflicting findings stay visible so the analyst can direct the next steps.
Duplicate alerts are linked to an existing case, while related activity can be added as supporting evidence. Analysts can review why alerts were grouped and separate them when they represent different investigations.
Yes. The platform connects to tools such as Microsoft Sentinel, Splunk, Microsoft Defender, and CrowdStrike through their APIs. Agents investigate incoming alerts and query supporting evidence across connected sources.
Yes. Partners manage triage across clients from one operations queue, with separate tenant data, client-specific policies, approval rules, and reporting. White-label delivery lets partners provide the service under their own brand.