ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24×7 managed detection and response across endpoint, network, cloud, identity, and log sources
Eyes-on-glass SOC and continuous threat hunting
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Get ultimate assurance that your environment is free from threat actors
Quickly recover from cyber attacks and breaches
24×7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Cloud-based SIEM platform providing visibility across all your data sources
Manage your external footprint, publicly available data, and Dark Web leaks
AI triage, investigation and response on the tools you already run
Fully featured distrubuted NDR for on-premises and public cloud environments
Deploy honeypots and honeytokens and stay ahead of threat actors
Every alert investigated, with a verdict and the evidence behind it
Integrated endpoint agent providing deep visibility, response and forensics
Log management and threat detection across any of your log sources
A SecOps platform purpose-built for industrial and OT environments
ThreatDefence puts security and compliance at the heart of our service, keeping your data protected at all times.
See how we keep your data secure.
Guides, case studies, and advisories in one place
Read what our customers say about us
Solution briefs and datasheets
Technical support and knowledge base
What to check in your Microsoft 365 tenant
Remote code execution flaws that need patching now
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to Incident Response and Digital Forensics
Read how cyber range helps to train cyber defenders
How AI agents investigate alerts and run security operations
How AI SOC platforms work, from integrations to autonomy
Free ebook: a practical guide to adopting an AI SOC platform
How brand impersonation works and how to detect and stop it
How lookalike domain attacks work and how to take them down
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Where SOAR playbooks fit, where AI agents take over, and how the two work together.
AI SOC hyperautomation transforms cybersecurity ops by autonomously detecting, analyzing, and remediating threats.
Honored to Support the Launch of the University of Technology Sydney Cybersecurity Precinct!
ThreatDefence Cyber had the privilege of meeting with Honeywell Dubai’s Digital City leadership to explore synergies in OT/SCADA and…
Read More
Equinox to support companies with ready to use, end-to-end SecOps infrastructure, including a full stack platform able to capture and…
ThreatDefence had an amazing time at AISA CyberCon 2024, connecting with industry leaders and advancing cyber security conversations.
Connect your tools. Investigate across your stack. Respond with context.
ThreatDefence connects your existing tools to the AI SOC platform, bringing their evidence and response capabilities into your security operations. Agents can follow findings across systems, while analysts investigate and act from a shared workspace.
Connect firewall, VPN, DNS, and network detections to investigate suspicious connections, remote access, and data movement.
Bring endpoint alerts, process activity, and file evidence into investigations, with containment through supported integrations.
Connect sign-ins, authentication changes, account activity, and privileged access records to investigate identity threats.
Follow phishing detections into message, recipient, and account activity to understand who was targeted and what happened next.
Investigate access, configuration changes, and suspicious activity across cloud infrastructure and business applications.
Use application events, API logs, repository activity, and security findings to investigate threats to your software and data.
Add vulnerability findings and asset exposure to help prioritize threats affecting systems that matter to your business.
Coordinate tasks, trigger supported workflows, and keep service tickets aligned with investigation and response progress.
Integrations give the platform more than alerts. They provide the evidence to investigate, the context to assess risk, and supported actions to contain threats.
APIs, syslog, cloud connectors, agents, and log forwarding.
Consistent fields for the same user, host, or address across tools.
Asset details, identity information, threat intelligence, and case history.
Agents query connected sources and build an assessment with evidence.
Supported actions through your tools, with approvals and results recorded.
Collect logs and alerts through APIs, syslog, cloud connectors, agents, and log forwarding. Supported query interfaces let agents retrieve additional evidence during an investigation.
Map incoming events to consistent fields so activity involving the same user, host, or address can be connected across tools.
Enrich findings with available asset details, identity information, threat intelligence, and relevant case history.
Agents query connected sources, test explanations, and build an assessment with supporting evidence and recommended actions.
Execute supported actions through your tools, with permissions, approval rules, and results managed by the platform.
A suspicious sign-in can lead to checks of mailbox activity, endpoint behavior, and network connections, all contributing to the same investigation.
Browse supported products by category. Explore connections across security, infrastructure, business applications, and operational tools.
Sign-in attempts, item usage, and audit events from 1Password Business.
Phishing, business email compromise, and account takeover detections from Abnormal Security.
Web application and API protection events, including blocked attacks, from Airlock.
Detections and vulnerability findings from Alert Logic.
Access and error logs from Apache HTTP Server, including ModSecurity WAF events where enabled.
Phishing, account takeover, and data loss detections from Armorblox.
Phishing, malware, and data loss detections from Avanan email security.
Account activity, access control, and network traffic logs from Amazon Web Services.
Identity and access activity, including policy and role changes, from AWS IAM.
Log delivery from AWS services through Amazon SQS queues.
Web requests, rule matches, and blocked attacks from AWS WAF.
Logs streamed from Microsoft services through Azure Event Hubs.
Spam, phishing, and malware events from Barracuda Email Security.
Malware detections, threat events, and endpoint activity from Bitdefender.
Endpoint activity, malware detections, and alerts from Carbon Black.
Network, security, and remote access events from the Cato Networks SASE platform.
Traffic, policy, and threat prevention logs from Check Point firewalls.
Malware detections, file events, and endpoint activity from Cisco Secure Endpoint (AMP).
Spam, phishing, and malware events from Cisco Secure Email.
Traffic, policy, and intrusion events from Cisco firewalls.
Network traffic, security, and application events from Cisco Meraki.
DNS queries, web traffic, and blocked threats from Cisco Umbrella.
Traffic, access, and application firewall events from Citrix NetScaler.
WAF, firewall, and DNS events from Cloudflare.
File movement and data loss events from Code42 insider risk and DLP.
Backup and recovery events, including ransomware alerts, from Cohesity Helios.
Audit events and user activity from Atlassian Confluence Cloud.
Ticket sync and remote management context from ConnectWise for MSP workflows.
Network metadata, DNS, and protocol logs from Corelight sensors.
Alerts, incidents, and endpoint activity from Palo Alto Networks Cortex XDR.
Detections, process activity, and network connections from the CrowdStrike Falcon platform.
Log data and detections stored in CrowdStrike Falcon LogScale.
Privileged account, session, and vault activity from CyberArk.
Detections, malicious operations, and endpoint activity from Cybereason.
Model breaches and network anomaly alerts from Darktrace.
DMARC aggregate reports that show who is sending email as your domains.
Authentication, MFA, and access events from Cisco Duo.
Detections and endpoint activity from ESET EDR and endpoint protection.
Network detections and protocol activity from ExtraHop network detection and response.
Phishing, malware, and business email compromise detections from FireEye EX.
Traffic, policy, and threat events from Fortinet FortiGate firewalls.
Secrets and credentials found in code repositories by GitGuardian.
Detections and log data from Google Security Operations (Chronicle).
Audit logs, security findings, and network activity from Google Cloud Platform.
Admin, sign-in, Gmail, and Drive activity, plus alerts and user records, from Google Workspace.
Traffic, policy, and threat events from Hillstone firewalls.
Traffic flows and policy events from Illumio microsegmentation.
Device, security, and compliance events from Apple devices managed by Jamf.
Directory, authentication, and device events from the JumpCloud platform.
Traffic, policy, and security events from Juniper firewalls.
Remote management context and automated tasks through Kaseya.
Admin and user activity events from LastPass Business.
Alarms and log data from LogRhythm SIEM.
Malware detections, threat events, and endpoint activity from McAfee endpoint security.
Email, sign-in, file, and admin activity from Microsoft 365.
Activity, access, and network logs from Microsoft Azure.
Alerts, detections, and endpoint activity from Microsoft Defender.
Sign-ins, audit events, and risky user detections from Microsoft Entra ID (formerly Azure AD).
Incidents and log data from Microsoft Sentinel for investigation alongside other sources.
Spam, phishing, and malware events from Mimecast.
Device context and remote management actions through N-able.
Web traffic, cloud app usage, and security alerts from Netskope.
Access and error logs from NGINX web servers and proxies.
Device context, tasks, and remote management through NinjaOne.
API security findings and attack detections from Noname Security.
Sign-ins, MFA, and user lifecycle events from Okta.
Sign-in, MFA, and user events from OneLogin.
Traffic, threat, and URL filtering logs from Palo Alto Networks firewalls.
Phishing, malware, and data exfiltration detections from Perception Point.
Traffic and firewall rule events from pfSense.
Spam, phishing, and malware events from Proofpoint.
Vulnerability and asset findings from Qualys.
Vulnerability, asset, and risk findings from Rapid7.
Login, API, and data access events from Salesforce.
Endpoint detections, threat events, and agent activity from the SentinelOne Singularity platform.
Ticket creation and synchronization with ServiceNow for incident and remediation work.
Automated workflows triggered through Shuffle.
Cases and automated playbooks through Siemplify.
Security data held in Snowflake, plus access and query activity on the data warehouse.
Vulnerability findings in code, open-source dependencies, and containers from Snyk.
Traffic, policy, and threat events from SonicWall firewalls.
Detections, threat events, and endpoint activity from Sophos Central.
Traffic, policy, and threat events from Sophos XG firewalls.
Alerts and log data held in Splunk.
Alerts and log data held in Sumo Logic.
Malware detections, threat events, and endpoint activity from Symantec endpoint security.
Access requests, sessions, and audit events from Teleport.
Vulnerability and asset findings from Tenable.
Application allowlisting, ringfencing, and blocked execution events from ThreatLocker.
Web traffic, API, and attack events from ThreatX.
Secret access and privileged credential activity from Thycotic Secret Server.
Automated workflows triggered through Tines.
Malware detections, threat events, and endpoint activity from Trend Micro.
Spam, phishing, and malware events from Trend Micro Email Security.
File integrity, configuration, and vulnerability findings from Tripwire.
Email delivery and account activity events from Twilio SendGrid.
External exposure and vendor risk findings from UpGuard.
Network and identity detections from the Vectra AI platform.
Network traffic, application, and security events from VeloCloud SD-WAN.
Security events from VMware application and infrastructure platforms.
Traffic, policy, and threat events from WatchGuard firewalls.
Network metadata, DNS, and protocol logs from Zeek sensors.
Web traffic, cloud app usage, and threat events from Zscaler.
Take action where the threat is, using the controls already deployed across your environment. Available actions depend on the integration and permissions you grant.
Isolate affected hosts and run supported remediation actions through connected endpoint platforms.
Revoke sessions, restrict accounts, or reset credentials through supported identity integrations.
Block confirmed destinations through connected firewalls and secure web gateways.
Create tasks, trigger automation, and synchronize supported ITSM tickets so remediation stays connected to the case.
The platform records each action’s approval state and outcome, keeping completed work, failures, and pending decisions visible.
Extend coverage to applications and systems beyond the catalog. ThreatDefence can build connectors and parsers around available logs, APIs, and supported collection methods.
Bring security-relevant activity from internal applications, databases, and specialist systems into investigations.
Connect services that expose useful events, investigation queries, or response functions through an API.
Collect and parse supported device and application logs through syslog, files, or forwarding tools.
Use network sensors and supported OT integrations to add industrial evidence, with collection designed around operational requirements.
We agree the scope, access requirements, and supported capabilities for each custom integration before implementation.
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
ThreatDefence connects with endpoint, identity, email, network, cloud, SaaS, vulnerability, SIEM, ITSM, and automation platforms. The catalog shows supported products, while custom integrations extend coverage to other sources.
Depending on the product and interface, an integration may collect logs, receive alerts, retrieve investigation evidence, or execute response actions. These capabilities are configured around the available APIs, product licensing, and permissions granted.
Yes, where the integration provides investigation tools. Agents can retrieve relevant activity and context as an investigation develops, with access controlled by platform permissions and tool calls recorded.
We assess its available APIs, logs, and collection options. A custom connector or parser can then be scoped to bring relevant data and supported capabilities into the platform.
Yes, where supported. Actions can include endpoint isolation, session revocation, account restrictions, and destination blocking. Execution follows your configured permissions, approvals, and limits.
The platform normalizes incoming data and uses available identifiers and context to connect related activity. Queries, findings, and actions stay together in the investigation record.
Timing depends on the integration, access arrangements, and configuration required. Existing connectors can be onboarded once prerequisites are ready. Custom sources need additional development and validation.
Yes. ThreatDefence can investigate alerts from your SIEM and query supported connected sources. Network metadata, detections, and other supported outputs can also be forwarded to existing systems.
Connections use the permissions granted for their purpose. Platform roles, tenant boundaries, and approval rules govern access and actions, with investigation calls and response outcomes recorded.