AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
October 31, 2026
November 2, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Threat hunting for MSPs searches client environments for attacker activity that routine monitoring may have missed. Cross-tenant hunting helps your team check a shared threat across authorized clients, with evidence and response decisions kept separate for each.Include your own environment. Technician accounts, management tools, and integrations can give an attacker routes into several customers.
A finding at one client can raise questions across the business. If a malicious application appears at one customer, others may have granted it access. If a provider’s management tool is compromised, the investigation may extend into every client it could reach.
Repeating the same checks manually takes time. Applying identical assumptions everywhere can also mislead the team: an expected support session at one client may be unauthorized at another.
For MSPs and MSSPs, multi-tenant threat hunting makes the investigation method reusable while preserving local context. Search across relevant clients, then assess what each match means in its own environment.
Cross-tenant threat hunting runs a question across selected environments. A file hash, application, destination, or sequence of behavior from one investigation becomes a lead to examine elsewhere.
The example distinguishes consent from observed mailbox access. A matching application name or address is a lead; permissions and subsequent activity help establish what happened. Use stable identifiers where available and validate the underlying events before treating matches as the same application or attack.
Choose tenants according to the technology, exposure, or behavior being examined and the access your team holds. Record excluded clients and why they were excluded.
Keep saved client groups current as environments are added or removed, and record the actual scope of each run. Searching all assigned tenants does not necessarily cover every customer the MSP serves.
Confirm the sources and history available for each client. Equivalent events can have different field names or meanings across tools, so validate mappings before reusing a query.
Track completion per tenant. A completed search with no matches differs from a missing source, denied request, timeout, or truncated result. Bound the window and concurrent work to protect shared capacity needed for live operations.
Keep a client identifier attached to each result. Common hostnames, usernames, and private addresses must not merge unrelated activity from different tenants.
Review matches against the client’s approved applications, accounts, and maintenance activity. Keep resulting cases, evidence, and actions within that tenant. Search access and response authority are separate: a cross-tenant match does not authorize containment across every client searched.
Central access should simplify the work while maintaining the controls that apply to an individual investigation:
Analysts and agents reach only the tenants and evidence their roles permit.
Check where queries run and where results, exports, and generated reports are processed.
Findings, attachments, cases, and decisions retain their client association.
Portals, reports, notifications, and tickets contain the intended client’s information.
Log every cross-tenant query for each tenant searched, including the caller, scope, and execution status.
Verify the full path from search to report, including privileged analyst and support access. The location of the underlying data store alone does not establish where a combined result is processed or exported.
Your internal environment is part of your clients’ exposure. RMM platforms, remote-access tools, technician workstations, privileged accounts, and API integrations may hold access to several customers.
Prioritize activity that changes or uses that reach:
Connect suspicious provider activity with what happened at clients. Trace the technician session, account, or integration into the affected environments and compare its actions with the support work it was meant to perform.
The TeamViewer advisory illustrates the risk to technician workstations. A malicious or compromised remote host could attack a vulnerable viewer when the technician connected to it.
When a management product is affected, investigate provider systems and customer access paths together. Coordinate containment and client follow-up so action on the provider’s side does not leave the wider exposure unresolved.
New intelligence can reveal the significance of earlier activity. Identify clients that used the affected technology, then search the available history for the advisory’s indicators and behavior.
Use deployment and version history where possible. Today’s patched installation, or absence of the product, does not establish what was present during the attack period. Include provider infrastructure where a shared tool or integration could have exposed customers.
Report coverage separately for each client. Six months of searchable records supports a different conclusion from two weeks. Another tenant’s completed search cannot compensate for the missing history.
Use retrospective threat hunting to define the exposure window and combine historical searches with checks for remaining artifacts.
A monthly hunting report should show what was examined, what the evidence established, and what needs attention. Include hunts with no matching activity so clients can see work beyond the incident queue.
Connect the work to its outcomes: hypotheses tested, techniques examined, sources and periods searched, incidents raised, fixes completed, and detections proposed or deployed. Identify unresolved recommendations and the person responsible for the next decision.
A provider-wide threat summary can add useful intelligence, but it does not show which checks ran against a particular client’s evidence. Make the client’s own coverage and results clear.
Keep conclusions within that coverage. A result from one monitored site does not clear other sites. For OAuth-app findings, publisher verification is one contextual signal; assess the permissions and observed activity before concluding that the application is safe.
White-label reporting can use the partner’s logo, colors, domain, and sending identity. Review recipients, attachments, and linked cases before distribution to preserve client boundaries.
A repeatable MSP threat hunting service needs an agreed scope, time assigned to the work, and a route from findings to action. Plan for the main service events:
Establish client context, available evidence, and priority questions. Record data gaps while proceeding with checks the existing sources support.
Run relevant hypotheses regularly and include the results in monthly reporting.
Check affected clients after disclosures involving campaigns, compromised products, or exploited vulnerabilities.
Define how supplier incidents, business changes, and unexplained activity enter the hunting program.
Use a scoped compromise assessment when a wider review of possible intrusion is needed.
For managed threat hunting for MSPs, agree who selects and runs hunts, provides local context, approves response, and communicates with the client. Specialist capacity can support the MSP’s team, while follow-up remains assigned and visible.
Check what the provider already includes before packaging the service. Consider scheduled hunts, requested investigations, reporting, and incident support together when comparing white-label SOC pricing models.
A validated finding at one client can improve coverage elsewhere. Identify the suspicious behavior and the other tenants with relevant exposure and suitable telemetry.
Test the logic before wider deployment. Process names, application usage, and useful thresholds can differ between clients. An administrator or application approved locally should not become a trusted exception for the entire estate.
Share the method while keeping the originating client’s evidence and sensitive details separate. Track versions, dependencies, local tuning, and rollout status, then review alert quality after deployment.
If the finding requires substantial analyst interpretation, retain it as a reusable hunt. A scheduled investigation can provide more value than a production rule that generates recurring noise.
Begin with your own environment and a small group of clients whose tools and operating context you understand. Verify access, evidence availability, per-tenant logging, and the response handover.
Choose a shared concern, such as suspicious application consent or unexpected remote access. Complete the hunt, review each client’s result, and assign follow-up for findings and gaps. Expand once the work is repeatable and outstanding actions remain visible.
ThreatDefence partners get hunting built into the white-label SOC service.
Partner analysts and ThreatDefence hunters search assigned client tenants, with data kept in each client’s region and every cross-tenant query logged per tenant.
Hypothesis-led hunts run on a schedule, and every client receives a monthly hunting report as part of the standard service.
Hunts run after every relevant advisory, with results reported per client. The security advisories include searches for each threat.
Hunting reports carry the partner’s brand and are sent from the partner’s email domain.
The SOC also monitors the partner’s RMM tools, privileged accounts, and administrative activity.
A hunt that finds an attacker moves straight into response, with guaranteed SLAs.
Findings sync two ways with ConnectWise, Autotask, and HaloPSA, plus ServiceNow.
Partners can try the service in their own environment with an NFR license, and the first month is free for partners.
Explore AI SOC for MSSPs
Explore threat hunting for your organization, from investigation coverage to reporting and next steps.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or resellerRequest an NFR license for our own environment
Δ
Yes. A suitable platform and managed hunting partner can provide specialist capacity. The MSP still needs to supply client context, coordinate decisions, and track follow-up. Agree how the provider’s work connects with response and client communication.
Use tenant-scoped access, client-labeled results, separate cases, and per-tenant logging for every cross-tenant query. Apply those boundaries to agents, reports, exports, and tickets too. Confirm where combined results are handled rather than relying on storage location alone.
Yes. Technician accounts, management tools, and integrations can provide routes into customer systems. Investigate unusual sessions, new credentials, unexpected scripts, and unauthorized remote access. If a provider system is compromised, examine the client access it held.
Show the questions tested, evidence coverage, findings, and resulting actions. Include no-match results with their limitations, detection improvements, and unresolved recommendations. A hunt count alone does not establish that relevant threats were examined or findings addressed.
Yes. White-label hunting services can provide reports under your brand and email domain. Confirm branding across reports, portals, and notifications, alongside the client-specific records supporting the conclusions.
Run shared hunts where clients have relevant exposure and suitable evidence. Adapt queries and interpretation to the environment, recording excluded tenants and checks that could not complete. A shared search should not imply coverage it did not provide.
Threat Hunting Service
AI SOC for MSSPs
White Label MDR and Threat Intelligence