Security Monitoring · Agreed Hours
Service group: CybersecuritySecurity alerts reviewed by people, during hours you can rely on
Your security tools generate alerts that only matter if someone reads them. We collect the important ones from Microsoft 365, endpoints and firewalls, review them during agreed hours, act on what is real and tell you what happened.
At a glance
- Service
- Human review and triage of security alerts from your existing tools during agreed business hours
- Best suited to
- Organizations of roughly 5 to 200 employees whose security alerts currently go unread or to a shared mailbox
- Core inclusions
- Alert routing, triage, initial containment, escalation to your contacts, monthly reporting and tuning
- Explicitly not
- Not a 24/7 service and not a security operations centre; alerts outside agreed hours wait for the next review window unless extended coverage is quoted
- Sources
- Microsoft Defender XDR, Entra ID sign-in and risk events, Microsoft 365 audit alerts, endpoint protection and supported firewalls
- Pricing basis
- Per user or per device per month based on sources monitored, confirmed in a written quotation
- How to start
- Book a consultation to list your alert sources and agree review hours
What cybersecurity monitoring means here
Cybersecurity monitoring is the routine review of security alerts generated by tools you already use: Microsoft Defender, Entra ID sign-in risk detections, Microsoft 365 alert policies, endpoint protection consoles and firewalls. We route those alerts to our ticketing system, review them during agreed hours, decide whether they are real, act on the ones that are and record the outcome.
We want to be precise about coverage. This is business-hours monitoring, written into your scope with specific days and times. It is not a security operations centre and does not include continuous overnight or weekend analysis. Automatic protections in your tools, such as blocking malware or quarantining email, keep working outside those hours; human review resumes in the next window.
For many small organizations, moving from nobody reviewing alerts to a person reviewing them every business day is a significant improvement. If your risk profile calls for continuous coverage, we will say so during discovery.
What goes wrong without monitoring
Alerts to nowhere
Security notifications go to a former administrator, a shared mailbox nobody opens, or nowhere at all.
Too much noise
Untuned alerts bury the few that matter, so people stop looking.
Late discovery of compromise
A suspicious sign-in or new forwarding rule is noticed only when clients report fraudulent invoices.
No record of what happened
When an insurer or client asks about an incident, there is no timeline of alerts and actions.
What we do
Alert routing
Security alerts from in-scope sources are routed to our ticketing system so nothing depends on a single inbox.
Triage
Each alert is reviewed against context such as the user's normal locations, device and recent changes, then classified.
Initial containment
Under your approved playbook we can reset passwords, revoke sessions, block sign-in, isolate a device or remove a malicious inbox rule.
Escalation
Confirmed or high-severity issues are escalated to your named contacts by phone and ticket, with recommended next steps.
Tuning
Noisy, low-value alerts are adjusted so attention stays on meaningful events.
Monthly reporting
A summary of alerts, true incidents, actions taken and recommended improvements.
Scope
Review days, hours and alert sources are listed in your proposal.
Typically included
- Routing of alerts from in-scope sources to our ticketing system
- Alert review and triage during agreed business hours
- Initial containment actions under your approved playbook
- Escalation to your named contacts
- Alert tuning and noise reduction
- Monthly monitoring report
Not included unless separately scoped
- 24/7, overnight or weekend monitoring
- Security operations centre (SOC) services or a SIEM platform build
- Proactive threat hunting
- Forensic investigation or incident response retainer
- Monitoring of systems or tools not listed in scope
Alert sources we commonly monitor
- Microsoft Defender XDR incidents and alerts
- Microsoft Entra ID risky sign-ins and risky users
- Microsoft 365 alert policies, such as forwarding rule creation and mass deletion
- Endpoint protection and EDR consoles
- Business firewall and VPN security events where supported
- Backup platform alerts related to deletion or tampering
Who it suits
Organizations with tools but no reviewer
Businesses that have invested in Defender, EDR or a modern firewall but have no one reading their alerts.
Business-hours operations
Teams whose staff and systems are mostly active during the working day.
Firms answering due-diligence questions
Organizations that need to explain honestly who reviews security alerts and when.
Benefits
- Security alerts reviewed by a person every agreed business day
- Earlier detection of account takeover and device threats
- Clear escalation to the right people in your organization
- Less noise and more meaningful alerts over time
- A written record of alerts and actions for insurers and clients
How we start monitoring
Source inventory
We list the security tools you have, what alerts they generate and where they go today.
Playbook and contacts
We agree review hours, escalation contacts and which containment actions we may take without asking.
Routing and baseline
Alerts are routed to us and a baseline period helps us understand normal activity.
Tuning
We reduce noise and adjust alert thresholds with you.
Operate and report
Daily review, escalation and monthly reporting continue under your scope.
Ways to buy
Prices are proposed and confirmed in a written quotation.
Monitoring for existing tools
Per-user or per-device monthly review of alerts from tools you already license.
With managed endpoint security
Combine monitoring with managed endpoint protection so one team owns both tools and alerts.
Extended hours by quotation
If your scope needs review outside standard business hours, we will discuss what is realistic and quote it in writing.
Frequently asked questions
Is this a 24/7 SOC?
No. We review alerts during the business hours written into your scope. Automated protections in your tools keep working at other times, and we tell you plainly if your needs call for continuous coverage.
What happens to an alert at night or on the weekend?
Your tools' automatic protections act as configured, and the alert is waiting in our queue for review at the start of the next agreed window.
Do we need a SIEM for this?
Usually not at this size. We work with the alerting built into Microsoft 365, Defender and your other tools. A SIEM can be scoped separately if your requirements justify it.
Will you contact us when something is wrong?
Yes. Confirmed or high-severity issues are escalated to the named contacts in your playbook by phone and ticket, with the actions already taken and recommended next steps.
Related services
Products and packages
Industries we support
Service areas
Further reading
Make sure someone reads your security alerts
Tell us which tools you use and we will propose review hours, sources and a playbook in writing.