AI agents investigate every alert, add context, and prepare cases for response, on a full-stack SecOps platform that captures and correlates all your security data.
Cloud-based SIEM platform providing visibility across all your data sources
Every alert investigated, with a verdict and the evidence behind it
Manage your external footprint, publicly available data, and Dark Web leaks
Log management and threat detection across any of your log sources
Get ultimate assurance that your environment is free from threat actors
Fully featured distrubuted NDR for on-premises and public cloud environments
A SecOps platform purpose-built for industrial and OT environments
Integrated endpoint agent providing deep visibility, response and forensics
Deploy honeypots and honeytokens and stay ahead of threat actors
24x7 security operations from our Australian SOC. AI investigates every alert, and experienced analysts validate findings and contain threats around the clock.
24x7 managed detection and response across endpoint, network, cloud, identity, and log sources
AI investigations and 24x7 MDR on the Microsoft Sentinel you already own
Eyes-on-glass SOC and continuous threat hunting
Expert hunters and AI agents find attacker activity your alerts missed
Quickly recover from cyber attacks and breaches
ThreatDefence is the only SecOps as a Service company providing broad coverage across your entire technology stack with evidence-based security.
We provide security teams with full-stack SecOps infrastructure – you get deep visibility from day one, gain control over your security data, and get access to a comprehensive set of ready-to-use tools, detections, workflows, playbooks and scenarios.
24x7 SOC, Continuous Monitoring, Threat Containment and Incident Response
Visibility and actionable insights for all IT assets
Leverage our Cyber Range to train defenders based on real-world scenarios and simulations
OT and industrial cyber security services for critical infrastructure
Essential Eight monitoring, reporting, and evidence for ongoing compliance
Privacy Act reform impacts, obligations, and practical security considerations
Monitoring and compliance support for critical infrastructure environments
A practical guide to securing critical infrastructure with continuous monitoring
A practical buyer’s guide for schools evaluating SIEM and SOC services
A practical guide to selecting the right SIEM and SOC service for local government
Articles on security operations, AI and compliance
Events, awards and company news
Read what our customers say about us
Solution briefs and datasheets
How we keep your data secure
Technical support and knowledge base
Guides, case studies, and advisories in one place
How AI agents investigate alerts and run security operations
Free ebook: a practical guide to adopting an AI SOC platform
A practical guide to incident response and digital forensics
Where SOAR playbooks fit and where AI agents take over
Free ebook: modern security operations with Microsoft Sentinel
November 6, 2026
We provide end-to-end SecOps solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs).
Find out how you can become a ThreatDefence partner.
Protect your entire technology stack and build your SecOps on your own pace
White-labeled AI SOC for every client tenant, co-managed with our SOC team
Launch your SOC business without any upfront investment
Embed security operations, threat intelligence and exposure data in your product
Sovereign SOC for Australian MSPs and MSSPs, with onshore analysts and client data
Set the rules for closing alerts automatically, with evidence checks and review
How MSPs deliver branded security monitoring with a SOC partner
ThreatDefence was an official partner of the Cyber Resilience Summit NSW, 29 October 2026 at Hilton Sydney.
Our team was back at BSides Canberra, and our cyber quiz was a hit again.
Two days in Perth with our partner Ever Nimble, on security operations and cyber resilience.
Sponsors of the AUSCERT Cyber Security Conference on the Gold Coast.
Sponsors of the Gartner Security & Risk Management Summit in March.
Sponsors of the Cyber Security for Critical Assets Summit in Perth, February 2026.
Expert conversations with speakers and attendees at CyberCon Melbourne 2025.
Connect your security data. Detect threats. Investigate faster.
Bring security data from across your business into a SIEM built for investigation. ThreatDefence connects events, adds context, and keeps the evidence searchable, so your team can understand threats and act sooner.
We manage the platform, maintain integrations, and tune detections. Your analysts get direct access to the data, with AI investigation tools and our 24x7 SOC available through the same platform.
Connect enterprise systems and bespoke applications. Our team builds and maintains connectors and parsers for agreed security-relevant sources.
AI agents investigate alerts, gather evidence across connected tools, and prepare assessments with recommended actions.
Extend investigations with network detection, endpoint visibility, identity monitoring, deception, and exposure data.
Use the managed cloud service or deploy the platform in your own data center or supported cloud environment.
See what is being collected, where it comes from, and whether it is still arriving. Track volumes, active sources, and recent events from one overview, with direct access to the underlying records.
Bring cloud services, on-premises infrastructure, and specialist applications into your security operations. Collect through supported agents, syslog, APIs, cloud integrations, and network sensors.
Gather supported process, authentication, file, and system activity from monitored devices.
Collect events from firewalls, VPNs, switches, servers, storage, and applications.
Connect identity providers, email security, SaaS applications, and security platforms.
Bring cloud audit trails, security findings, and account activity into the same investigation.
Add connection history, protocol records, and network detections from monitored segments.
Extend coverage with parsers and connectors built around your application’s available logs and interfaces.
Browse Integrations
Different products describe the same activity in different ways. ThreatDefence parses incoming records and maps them to consistent fields, helping analysts connect activity across sources.
Available asset, identity, and threat intelligence context adds meaning to the events, while source-specific details remain accessible.
Bring in events through the collection method suited to each source.
Extract useful fields from vendor-specific records and custom logs.
Use consistent fields for users, hosts, addresses, actions, and outcomes.
Add available business and security context to support assessment.
Apply correlation rules, threat intelligence, and behavioral analytics.
Keep evidence searchable and archive it according to your requirements.
Get ready-to-use dashboards for your connected sources, from identity and endpoint activity to firewalls, cloud services, and network traffic. Review trends, investigate findings, and open the underlying events directly.
Customize dashboards for your team or customers, or build your own views using the same data.
Follow a user, host, address, or indicator across connected data. Search consistent fields, inspect source records, and bring relevant results into a case without moving between consoles.
Find related activity across available identity, endpoint, email, cloud, and network records.
Reconstruct the sequence before and after a detection.
Check addresses, domains, hashes, and other indicators across selected sources and time ranges.
Explore detections mapped to relevant attacker techniques.
Compare current activity with available history and peer patterns.
Identify related accounts, systems, and services that need further investigation.
Connect activity across your security tools to uncover threats that individual events may not reveal. A sign-in, repeated MFA prompts, and a new forwarding rule can together point to account takeover.
ThreatDefence correlates these signals into a detection, with supporting evidence ready for investigation.
Detect sequences spanning multiple tools, accounts, and systems.
Check relevant activity against indicators and intelligence sources.
Understand which attacker behaviors applicable detections address.
Refine detection logic as your environment changes and investigations reveal noise or missing coverage.
TD-COR-118
sequence by user.name within 15m [duo.result == "denied"] with count >= 10 [entra.signin where geo.country not in user.history] [o365.New-InboxRule where forward.external]
Behavioral analytics helps identify changes that deserve attention, including unfamiliar access, unusual volumes, and unexpected relationships between systems.
The platform combines those signals with available context, helping analysts assess whether the activity reflects legitimate work or a developing threat.
Review changes in devices, locations, authentication patterns, and account activity.
Identify unexpected increases in sign-ins, downloads, or other monitored actions.
Investigate accounts and hosts accessing resources outside their established patterns.
Check findings against approved tools, working patterns, and known activity.
AI agents investigate alerts by querying relevant evidence, checking indicators, and following findings across connected systems. Analysts receive an assessment with supporting records, unresolved questions, and recommended next steps.
Inspect the queries and results supporting the assessment.
Retrieve additional activity through supported integrations as the investigation develops.
Prepare actions for approval or execute them within explicitly authorized limits.
Keep findings, analyst decisions, approvals, and response outcomes together.
Macro in invoice.docm launched encoded PowerShell, which resolved a domain first seen today and opened SMB to a database server. Same pattern on no other host.
Explore the AI SOC Platform
Examine available process trees, command lines, authentication activity, persistence changes, and software information.
Investigate sign-ins, role changes, application access, administrative actions, and cloud configuration events.
Connect firewall decisions with sensor evidence, including observed connections, DNS activity, protocol details, and intrusion findings.
Build a view of observed accounts, endpoints, software, network devices, and cloud resources from connected sources.
Keep the history needed for investigations, service reviews, and audit support. Configure searchable retention and longer-term archiving around the requirements of each data source.
Use retained records in dashboards, searches, investigations, and supported detection workflows.
Archive to supported S3-compatible storage, including storage you own.
Set retention for different data sets according to operational and business requirements.
Export selected records by query, source, and time range for further analysis.
Turn platform activity into reports your stakeholders can use. Security teams get operational detail, leaders get priorities, and assessors get supporting records.
Security Performance: Review investigation activity, case outcomes, coverage, and response times.
Executive Reporting: Summarize significant risks, trends, and recommended actions.
Compliance Support: Review available control checks and evidence mapped to relevant frameworks, including Essential Eight, NIST, PCI DSS, and ISO 27001.
Customer Reports: Generate service reviews and incident summaries, with branding options for partners.
Run customer SIEM environments from one partner workspace. Each tenant keeps its own data, permissions, retention settings, and procedures, while your team gets shared operational visibility.
Review customer alerts, source health, workload, and service performance.
Apply the collection, reporting, and response settings appropriate to each service.
Search across the clients each analyst is authorized to access.
Offer the portal and reports under your own brand.
Coordinate tasks, tickets, and supported actions through ITSM and automation integrations.
event.action:"New-InboxRule" AND forward*
Explore AI SOC for MSSPs
Your SIEM shares one platform with the rest of your security operations. Add network detection, attack surface monitoring, brand protection, and dark web exposure, and their findings arrive in the same cases, searches, and reports.
Add network sensors for connection history, protocol records, and detections that firewall logs alone cannot show.
Discover internet-facing domains, hosts, and services, and bring exposure findings into the same investigations.
Track lookalike domains and cloned login pages targeting your users and customers.
Match leaked credentials to enabled accounts so exposed users can be reset before they are used.
See which AI services are reached from your network and compare activity with your approved list.
Combine exposure, vulnerabilities, and control gaps into one view of what to fix first.
Choose the deployment that fits your infrastructure and operating requirements.
ThreatDefence runs the infrastructure and handles platform updates, scaling, parser maintenance, and detection tuning.
Deploy the platform in your own environment, with hosting, connectivity, access, and operational responsibilities agreed during setup.
Both approaches provide the platform’s search, investigation, dashboard, and case-management capabilities.
Put experienced analysts behind your detections. Our SOC investigates escalations, runs threat hunts, and coordinates response through the same platform your team uses.
AI agents gather initial evidence, detection engineers maintain coverage, and incident responders support complex cases. Responsibilities and response authority follow your agreed procedures.
Correlation rule fires: VPN login from a Tor exit node, then mailbox rule change.
Agents query SIEM, identity, and email sources and attach the evidence.
A SOC analyst confirms account takeover and approves containment.
Sessions revoked, account disabled, forwarding rule removed, customer notified.
Explore Our Managed SOC
CountryAustraliaUnited StatesNew ZealandUnited KingdomCanadaSingaporeOtherI'm an MSP, MSSP, or reseller
Δ
It is a security information and event management platform that brings data from connected sources together for detection, investigation, reporting, and response. It includes AI investigation capabilities and can be delivered with our 24x7 SOC service.
Yes. ThreatDefence manages the agreed platform infrastructure, integrations, parsers, and detection content. Monitoring, investigation, and response responsibilities are defined as part of your service.
Sources include endpoints, network infrastructure, identity providers, email security, cloud services, servers, and business applications. Custom integrations extend coverage using available logs and APIs.
Yes. Authorized users can access search, dashboards, investigation tools, and exports within their assigned roles and tenant scope.
AI agents gather evidence, investigate alerts, query connected tools, and prepare recommended actions. Analysts can inspect supporting records, challenge findings, and direct further work.
Searchable retention and archive policies are configured around your requirements. Different sources can have different retention periods, with archive retrieval arrangements agreed during setup.
Yes. Supported S3-compatible storage can be used for customer-owned archives, with storage access, retention, and recovery arrangements configured during deployment.
Yes. Available reports and control checks support evidence gathering for relevant frameworks. Reporting coverage depends on connected sources and configured assessments; it does not replace the wider compliance assessment.
Yes. Multi-tenant management provides separate customer environments with shared operational views, permissioned search, reporting, and optional white-label capabilities.
Yes. The platform can be deployed in your data center or supported cloud environment. Infrastructure, connectivity, access, and service responsibilities are agreed during planning.
Timing depends on deployment requirements, source readiness, access, and any custom integration work. Collection can begin in stages, with coverage validated as sources are connected.