Sign-ins from unusual places
Unusual sign-in locations raise alerts for review.
Managed security monitoring
Security monitoring for your Microsoft business tools
Microsoft Defender alerts are read, ticketed and explained in plain terms, for businesses from Charleston to Savannah.
Managed cybersecurity services
Managed cybersecurity services for small businesses
One incident gathers related alerts together, as shown in Microsoft's own attack story screen. We read every alert so your staff does not have to spend time doing it.
- 1
Alerts become one incident
Multiple related alerts are grouped into a single incident to show a clear timeline.
- 2
Every alert becomes a ticket
Each alert generates a ticket and is followed carefully through to closure.
- 3
Plain-language report provided
You receive an incident report written in plain terms explaining exactly what happened.
Watching for business email compromise and unauthorized access
Different organizations face different security events, from fake wire requests to unusual sign-ins. Each alert generates a ticket and ends in a plain-language summary.
View typical alerts
See all watched signals
Incident response steps from alert to closed ticket
Managed security services mean response steps remain the same for every alert. Example reports show what you receive with sample names, and no times are promised.
Incident
Example incident reportTicket 48213
- Alert
- Account or device
- Found
- Did
- Left
- Next
- Sent to
- Owner, office manager
Microsoft Defender screens and sample data
Microsoft's own screens show the tools we work in every day. Microsoft Sentinel and Defender organize alerts, evidence and automated steps into clear views.
Microsoft's own documentation screenshots, sample data. Not a CloudCentric customer.
Monitored signals and automated response steps
Microsoft Sentinel is a cloud-based SIEM that collects security logs. Microsoft Defender and Sentinel watch for specific behaviors, generating tickets so findings are investigated and contained.
Mailbox forwarding rules
Rules that forward company email to outside addresses are flagged and checked.
Phishing links clicked
Suspicious links clicked in emails generate alerts for investigation.
Ransomware behavior on a device
Ransomware behavior on a device is an alert Defender can contain.
Accounts of departed employees
Sentinel watchlist highlights any activity on former staff accounts.
One finding searched across every customer
Malicious files or addresses found at one customer are searched everywhere.
Attack contained in progress
Microsoft Defender can automatically disrupt an attack by containing a device or user.
Playbook steps run automatically
Sentinel playbooks post Teams messages, send approval emails or block users.
Logs collected from Microsoft and other systems
Sentinel collects logs from on-premises devices, cloud applications and other infrastructure.
Logs that cannot be changed
Microsoft Sentinel inherits Azure Monitor tamper-proofing, making collected logs append-only.
Tickets followed to closure
Every alert generates a ticket that is tracked until it is fully resolved.
Plain-language incident reports
You receive a clear, written summary of what happened and what was done.
Incident tracking and reporting for small businesses
Your staff has nothing to read because we read every alert. A ticket trail and a plain-language report arrive for your records, explaining exactly what happened and what was done.
- 1
Defender and Sentinel collect signals
Microsoft tools gather security logs from users, devices and applications into one place.
- 2
We read every alert
Suspicious activity is reviewed so your office manager or owner does not have to.
- 3
Related alerts become one incident
Multiple alerts are grouped into a single attack story with a clear timeline.
- 4
Same finding searched across every customer
Threats identified in one place can be searched for across all customers simultaneously.
- 5
Report arrives in plain terms
You get a summary explaining the event without unnecessary technical jargon.
Common questions about security monitoring
- What is monitored by the service?
Alerts from Microsoft Defender are monitored for every customer. Microsoft Sentinel also collects security logs from users, devices, applications and infrastructure, on premises and in the cloud.
- Do we read the alerts or does CloudCentric?
We read every alert so your staff does not have to. Each alert becomes a ticket and is followed carefully through to closure.
- What does a written incident report contain?
Report is a plain-language summary explaining exactly what happened, the timeline of events, the evidence found, and what response steps were taken.
- Is a threat at one customer searched for elsewhere?
Yes. When a threat is found at one customer, the same file, address or behavior can be searched for across every customer at once.
- What does Microsoft Sentinel do that Defender does not?
Sentinel collects logs from other systems. It also groups low-confidence alerts about related users, devices and files into a single higher-confidence incident.
- Do security monitoring and penetration testing go together?
Yes. Penetration tests show what an attacker could reach, and security monitoring watches for the same activity afterwards.
- Where does CloudCentric offer these services?
CloudCentric serves businesses across Charleston and the Lowcountry, from Mount Pleasant to Savannah. Specific hours of coverage and response times are not stated here; please call for details.
Contact CloudCentric for managed security monitoring
Call (844) 422-7000 or book a walkthrough to review Microsoft Defender and Microsoft Sentinel capabilities.
CharlestonMount PleasantNorth CharlestonIsle of PalmsFolly BeachKiawahBeaufortBlufftonHilton HeadSavannah