Monitor
Work your Defender XDR and Purview tools during business hours, and monitor identities and endpoints around the clock, across the data sources included in scope.
CompleteCare Shield · Managed security operations
Part of CompleteCare
Microsoft security operations, with the response model defined before an incident.
CompleteCare Shield runs business-hours security operations on Microsoft Defender XDR and Purview, plus around-the-clock monitoring of identities and endpoints with active response, and SIEM logging. Detection, triage, escalation, incident coordination, reporting, and ongoing improvement are defined before an incident.
Take the three-minute Opportunity Finder
No email needed.
Assess my SOC readiness →
A short form. We reply within one business day.
The important question
Not “do we have security tools?” Who is watching, and what are they allowed to do?
A SIEM or Defender license does not create a security operations function. Before steady state, Shield defines the monitored data sources, severity model, escalation contacts, response authority, approved automated actions, evidence and retention requirements, business-hours and after-hours process, reporting cadence, and the handoff to customer, insurer, legal, forensics, or other responders when required.
A Microsoft Sentinel workspace can look healthy while many of its analytic rules never fire. Tuning finds that and fixes it.
What Shield covers
Eight operating functions.
Detect
Maintain detections and analytics appropriate to the environment and use cases.
Triage
Validate alerts, add context, reduce noise, and determine severity.
Escalate
Route incidents to named customer contacts using the agreed severity and communication plan.
Respond
Take active response on identities and endpoints only within the response authority established during onboarding. Actions outside that authority are escalated to named customer contacts.
Coordinate
Support investigation and handoff across the customer, Microsoft, insurer, forensic provider, legal counsel, and other parties as the incident requires.
Improve
Tune detections, review recurring causes, and use incident learnings to improve the environment.
Report
Provide a recurring executive view of incidents, detection coverage, material changes, open risks, and recommended priorities.
Microsoft stack
What Shield can operate across.
Depending on licensing and architecture, Shield can operate across these Microsoft security signals.
On Microsoft 365 E3, E5, or E7? Shield is the enterprise track for Defender XDR and SOC operations: we deploy the security those licenses include, put the E5 security features to work, and monitor identities and endpoints around the clock.
-
SIEM and XDR
- Microsoft Defender XDR
- SIEM logging
- Microsoft Sentinel, as an option
-
Endpoint and identity
- Defender for Endpoint
- Defender for Identity
- Microsoft Entra identity signals
-
Email and cloud apps
- Defender for Office 365
- Defender for Cloud Apps
-
Agent and AI workloads
- Microsoft security data for agent and AI workloads
- Microsoft Agent 365 signals
Where licensed and available, with the relevant Defender capabilities.
AI workloads belong in the security model too. As agents gain identities, connectors, tools, and access to organizational data, security operations should include the new attack surface rather than treat AI as a separate universe.
Response targets and compliance
What we commit to, and what we do not.
We commit to
- Critical-severity events follow the response target defined in your Shield SOW and incident-response matrix.
- Severity definitions, clock start, and whether a target covers acknowledgement, triage, or action are set with you during onboarding.
- Shield supports the monitoring, logging, response, and evidence disciplines used in regulated security programs.
We do not
- Assume a response target from a marketing figure in place of your SOW.
- Claim that Shield by itself makes an organization compliant.
Commercial model
Annual commitment, confirmed in the SOW.
If you add the Microsoft Sentinel option, we measure ingest before we scope it.
We measure your actual sign-in, endpoint, and firewall telemetry first, then agree with you what goes into Sentinel. The ingest bill stays visible, and higher ingest means a higher Microsoft bill. Daily volume usually lands in one of these ranges:
5–10 GB/day
10–15 GB/day
15–20 GB/day
20–25 GB/day
Passthrough billing. Microsoft bills Sentinel ingest as consumption, separate from Shield.
Term. Shield runs on an annual commitment. The other CompleteCare modules run month-to-month with 30 days’ notice.
Modules are scoped with a defined initiation plan and an ongoing managed-service scope. Full commercial terms are confirmed in the SOW for the selected modules.
Defender licensing, Microsoft Sentinel ingestion and retention where the Sentinel option is in scope, and related Azure consumption are separate from Centered Networks fees and are sized during scope.
Common questions.
What are you allowed to do during an incident?
Active response on identities and endpoints happens only within the response authority agreed during onboarding. Actions outside that authority are escalated to named customer contacts.
What is the response target for a critical incident?
Critical-severity events follow the response target defined in your Shield SOW and incident-response matrix. Severity definitions, clock start, and whether the target covers acknowledgement, triage, or action are established during onboarding.
Does Shield make us compliant?
No. Shield supports the monitoring, logging, response, and evidence disciplines used in regulated security programs. It does not by itself make an organization compliant.
Do you cover AI and agent workloads?
Where Microsoft Agent 365 and the relevant Defender capabilities are licensed, agent and AI signals can be incorporated into the security operating model rather than treated as a separate universe.
Decide how incidents will be handled before one forces the decision.
Tell us what security tooling you license today, who is on call, and what response authority you are willing to agree to. We start with a readiness review before onboarding.
Need the data-protection program too? See CompleteCare Govern →
Thanks, we’ve got it.
A senior member of our team will reach out within one business day to confirm scope and fit.