AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
November 2, 2026
October 31, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Deliver managed detection and response under your own brand. Connect threats inside your clients’ environments with leaked credentials, dark web findings, and impersonation risks, backed by clear investigation and response responsibilities.
White label managed detection and response lets an MSP offer a security service supported by a specialist provider. The provider supplies agreed monitoring, investigation, and response capabilities while your team manages the client relationship and its part of delivery.
Clients see your portal, reports, and notifications. Behind that experience, the service needs to cover these jobs:
Monitor supported sources with maintained rules and analytics, and show collection gaps.
Gather evidence, check legitimate explanations, and identify affected accounts and systems.
Recommend or carry out supported containment within the client’s permissions.
Search beyond existing alerts where proactive hunting is included.
Explain findings, actions, limitations, and outstanding work.
An assessment should make clear whether activity is benign, suspicious, malicious, or unresolved. Missing evidence belongs in the case so analysts and clients understand the limits of the conclusion.
When comparing white label MDR for MSPs, check what the service investigates and which actions it can execute. MSSP vs MDR explains the difference between service scope and provider labels.
Useful MDR coverage follows the evidence across the client’s environment. Endpoint data can explain a malicious process, while an account takeover may appear mainly in identity and mailbox records.
Process execution, persistence, files, and connections from supported EDR tools or provider agents.
Sign-ins, authentication changes, role assignments, token-related activity, and application permissions.
Message details, reported phishing, mailbox access, forwarding, and inbox-rule changes where available.
Administrative activity, resource access, and relevant configuration changes.
Firewall, VPN, DNS, and sensor evidence showing communications and movement between systems.
For each integration, check these capabilities separately: receiving alerts, retrieving detailed evidence, and executing response. Licensing, audit settings, access permissions, and collection delays can affect each of them.
Existing tools can stay in place where supported. Define coverage by what the SOC can investigate and do through those connections, rather than by the number of logos on an integration page.
Here is an example of white label MDR in practice. An unexpected forwarding rule and a suspicious sign-in lead to an investigation, authorized containment, and a report delivered under the partner’s brand. The timeline is illustrative.
Sign-in to a finance mailbox from an unfamiliar country, minutes after the account appeared in a stealer log.
Sign-in history, the exposure record, mailbox rules and device details are reviewed together. A new forwarding rule confirms the compromise.
Sessions revoked, password reset and the forwarding rule removed, as the client's response rules allow at any hour.
The partner's on-call engineer receives the case summary, evidence and actions taken.
The client's named approver hears from the partner and approves a check of other finance accounts.
A report under the partner's brand records the timeline, evidence, actions and recommendations, including MFA enforcement for the finance team.
Check the forwarding rule, its destination, sign-in history, and available mailbox activity. Review related authentication changes and application permissions to establish whether the activity fits legitimate work.
A new network alone does not prove compromise. Unexplained access followed by an unauthorized forwarding rule and mailbox activity provides a stronger basis for action.
Carry out the actions already authorized for the affected account. Depending on the evidence and supported tools, responders may revoke sessions, secure credentials, and remove the malicious rule. Preserve relevant details where practical.
Verify the outcome of each action. An execution request can fail, and identity-provider session revocation may not immediately end access in every application.
Review authentication methods, application grants, other affected accounts, and evidence of data access. A password reset does not remove malicious application permissions or establish what information the attacker accessed.
Keep unanswered questions visible in the incident assessment and identify what further evidence or action is needed.
Record the timeline, evidence, actions, outstanding work, and recommendations. Separate observed activity from suspected activity. Missing audit records should limit the conclusion, rather than imply that no data was accessed.
Follow the agreed communication procedure while urgent authorized containment proceeds. How to Launch a SOC Service Under Your Brand covers responsibilities and escalation arrangements.
Agree what responders can do before an incident occurs. Define the action, eligible targets, execution conditions, and required approval for each client. A confirmed threat does not grant unrestricted access to change systems.
Some actions can be authorized in advance; others should be prepared and held for approval. Use the following considerations to set those boundaries.
Log the target, reason, authorization, execution result, and follow-up checks. Distinguish reversal from recovery: endpoint isolation can be released, while a password reset requires secure reauthentication with a new credential.
Review permissions when systems, dependencies, or integrations change. If an action requires approval and the approver is unavailable, keep it held and follow the agreed escalation route.
Containment limits attacker activity. The remaining work establishes how access was gained, what was affected, and what must change before normal operations resume.
Confirm how much of that work the MDR service includes. Broader incident response, forensic investigation, or recovery may be included, covered by a retainer, or require a separate engagement.
Collect, protect, and analyze artifacts to answer outstanding incident questions.
Remove persistence and compromised access, and address the weakness that enabled the attack.
Restore affected services and verify their condition before returning them to normal use.
Work with the client’s appointed forensic, legal, insurance, or recovery teams where required.
The final assessment should distinguish confirmed impact, reasonable inferences, and questions the evidence cannot resolve. DFIR for MSSPs covers forensic investigation in more detail.
Threat intelligence for MSPs becomes useful when it changes an investigation or a client’s priorities. A reported attacker technique can become a hunt; an exposed credential can prompt a review of account activity.
White label threat intelligence can support MDR through:
Check known domains, addresses, and file hashes against current and retained activity.
Add source confidence, observation dates, infrastructure history, and campaign information.
Connect active exploitation with affected software, exposed systems, and business impact.
Identify accounts or authentication material in breach records and stealer logs.
Investigate domains, sites, and profiles impersonating the client.
Turn reported attacker behavior into searches across relevant evidence.
Explain material threats and the defensive changes they warrant.
Treat an indicator match as a lead to investigate. Shared hosting, outdated indicators, and uncertain attribution can create misleading associations. Keep source confidence and timing with the finding.
White label dark web monitoring searches available sources for credentials and data associated with a client. Coverage may include criminal forums, marketplaces, breach collections, paste sites, and infostealer logs, depending on the service.
Discovery does not establish when the exposure occurred. A new notification may contain an old password, a disabled account, or a record already reported elsewhere. Assess its relevance before treating it as an active incident.
Check the source, available dates, account, and associated service. An account still existing does not prove its exposed password works. Follow the client’s authorized procedures for any further validation.
Review available sign-ins, authentication changes, and activity in the affected service. Prioritize active and privileged accounts, especially where there is evidence of misuse. Record missing history that limits the assessment.
Apply authorized credential and session actions appropriate to the finding. Verify their effect, including any remaining application access. A successful API request does not necessarily mean every session has ended.
An infostealer record may identify an infected device, including a personal device used for work. Address that source where identifiable and change credentials from a trusted device so replacement secrets are not exposed again.
Record what was exposed, what was checked, which actions succeeded, and what remains unresolved. Stronger authentication can reduce future risk, but does not by itself remove stolen sessions or attacker-added access.
No monitoring service can see every private source or prove that an unreported account is safe. The useful result is an investigated finding with a clear priority and next step.
Brand monitoring finds domains, websites, and profiles that may impersonate a client. Similarity is an early signal to assess, rather than proof of malicious intent.
Review registration history, mail configuration, certificates, and website content where available. A parked domain may need monitoring. A cloned sign-in page or observed phishing campaign gives stronger grounds for urgent action.
Confirmed threats can trigger targeted blocking, searches for related messages or visits, and takedown requests. Account for shared infrastructure before blocking. Removal timing depends on the registrar, hosting provider, or platform handling the request.
Track each stage separately: detected, blocked, submitted for takedown, and confirmed removed. The Lookalike Domain Monitoring guide explains detection methods in more detail.
Build watchlists around each client’s domains, brands, critical accounts, exposed services, and important suppliers within the agreed scope. Update them as the business changes so current risks receive attention and obsolete records do not create recurring noise.
The wider setup and contact process is covered in How to Launch a SOC Service Under Your Brand.
Client reports should explain why a finding matters, what was done, and what still needs attention. Counts of exposed records or matched indicators alone do not show whether the risk has been addressed.
Separate new findings from repeated records. Make clear when data was newly discovered rather than newly stolen, and state the reporting period and coverage limitations.
Mask sensitive authentication material in summaries and restrict access to supporting evidence. White Label SIEM for MSSPs covers data handling and access in more detail.
You can offer MDR and external intelligence together or as separate services. In either arrangement, assign responsibility for investigating findings, contacting the client, and taking action.
The White-Label SOC Pricing Models guide covers packaging, pricing units, and margin.
Keep the assessment, evidence, response authority, and execution results in the same case. A recommended action, a submitted request, and verified containment represent different stages of the work.
Record the finding, evidence, alternative explanations, and remaining uncertainty.
Identify the rule or approval that permitted the action and its scope.
Preserve the target, time, result, and failures needing follow-up.
Check the observed effect and any access or activity that remains.
Turn verified lessons into proposed detections, hunting checks, or client remediation tasks.
Use those records to assess service quality alongside response times. For a provider checklist and trial guidance, read How to Choose a White-Label SOC Provider.
ThreatDefence combines an AI SOC platform with a 24x7 SOC, with separate client tenants and portals and reports under your brand.
AI agents investigate every alert and prepare evidence-backed verdicts. Analysts work under each client’s response rules, with action types set to recommend, wait for approval, or run autonomously where authorized. Every action is logged, with rollback available for reversible actions. Leaked credential, dark web, and lookalike domain findings feed the same cases and reports.
Incident response and a retainer are included, with response times guaranteed in the partner agreement. When an incident needs more than containment, the same team continues into investigation and recovery.
Explore the White Label SOC Platform
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
White label MDR is managed detection and response delivered under an MSP’s brand by a specialist provider. The provider performs the agreed monitoring, investigation, and response work while the MSP manages the client relationship and its part of delivery.
Yes, but how actions are executed varies. The provider may act within prior authorization, request approval, or guide the MSP or client through the response. Confirm supported tools, permitted actions, and approval rules before the service starts.
MDR includes response within its agreed scope. Full forensic investigation and recovery may be included, covered by a retainer, or arranged separately. Check the service description for what happens after initial containment.
Yes, where identity and email integrations provide the necessary evidence and response capabilities. Investigators can review sign-ins, authentication changes, mailbox rules, application grants, and related activity, adding endpoint evidence where available.
It can include indicator enrichment, exploitation intelligence, credential exposure, dark web findings, brand threats, and client briefings under your brand. Check which sources, analysis, and response support the service includes.
Validate the record, identify the account and service, and investigate for misuse. Apply authorized credential and session actions, check the originating device where relevant, and verify the outcome. Record any uncertainty or remaining access.
Yes, when responsibility for investigating findings and coordinating response is clear. Combining it with MDR lets the team check exposures against account activity and manage the work through the same cases.
MDR records can provide evidence of monitoring, investigation, and response where those capabilities meet the insurer’s requirements. Eligibility and claims decisions depend on the policy and the client’s wider controls, not the subscription alone.
AI SOC for MSSPs
What Is Digital Brand Protection?
Lookalike Domain Monitoring