01
Connect the environment
Connect the Defender tenant through its API and identify endpoint groups and available telemetry.
Stage outcome: Defender signals and endpoints connected to the SOC
← Services
Xcitium offering
Managed EDR for Microsoft Defender
Expert oversight for a Defender environment. Keep your existing Microsoft Defender environment and add 24/7 SOC monitoring, isolated execution of unknown files with ZeroDwell and incident response.
Discuss your requirements ↗
Managed EDR
SOC and ZeroDwell for Defender
Microsoft Defender telemetry feeds Xcitium’s 24/7 SOC. ZeroDwell virtualizes unknown execution on the endpoint, isolating it from the device’s operating system and data. Analysts validate signals, investigate incidents and document response.
02
Isolate the unknown
ZeroDwell virtualizes unknown execution on the endpoint and isolates it from the device’s operating system and data. This endpoint protection operates separately from the Defender telemetry feed to the SOC.
Stage outcome: Unknown execution isolated from endpoint OS and data
03
Validate and investigate
SOC analysts review alerts in device and incident context, set priorities and record findings in an incident timeline.
Stage outcome: Validated alert and incident timeline
04
Respond and report
Response and remediation follow agreed permissions; reporting records the outcome and next steps.
Stage outcome: Incident report and next steps
Defender environment
Microsoft Defender
Endpoint OS and data
Unknown fileZeroDwell endpoint virtualization
Microsoft Defender APIXcitium SOC
ValidateInvestigateRespond · RemediateReport · Incident timeline
Operational outcome
24/7 SOC monitoring for the existing Defender environment, endpoint isolation of unknown execution, analyst investigation and documented response.
Capabilities
Capabilities with a specific purpose
Scope
The service adds prevention-first ZeroDwell protection and SOC operations to environments using Microsoft Defender.
Workflow
Review existing Defender configuration and endpoint coverage; agree agent/policy deployment, alert triage and response ownership.
Output and handoff
The service coordinates monitoring, incident analysis, containment and handoff of next steps to the customer.
Responsibility boundary
The pilot covers Defender tenant permissions, licensing, agent compatibility, policies and containment authority.
Business Premium and managed protection
Microsoft 365 Business Premium combines Defender for Business, Defender for Office 365 Plan 1, Entra ID P1 and Intune Plan 1. Xcitium Managed EDR adds 24/7 SOC monitoring, ZeroDwell containment of unknown execution and incident investigation. Microsoft licensing defines the platform capabilities; the Xcitium service supplies analyst operations and agreed response.
Microsoft 365 E3 and SOC operations
Microsoft 365 E3 includes Defender for Endpoint Plan 1, Entra ID P1 and Intune Plan 1. From July 1, 2026, the suite also includes Defender for Office 365 Plan 1. Xcitium SOC investigates available Defender signals and coordinates response. Defender for Endpoint Plan 2 capabilities require the corresponding additional entitlement beyond the base E3 endpoint plan.
Compare approaches
Service role and adjacent approach
| Consideration | Managed EDR for Microsoft Defender | Managed EDR |
|---|---|---|
| Primary focus | The service adds prevention-first ZeroDwell protection and SOC operations to environments using Microsoft Defender. | Managed EDR for MSPs using Xcitium protection or the customer’s existing third-party EDR. |
| Workflow | Review existing Defender configuration and endpoint coverage; agree agent/policy deployment, alert triage and response ownership. | Endpoint telemetry, SOC triage and agreed response. |
| Output and handoff | The service coordinates monitoring, incident analysis, containment and handoff of next steps to the customer. | Incident report and response recommendations. |
Before you start
Validate Defender coexistence
Pilot a small endpoint group and confirm tenant admin roles, Defender licenses and policies, device groups and ownership of containment/exception decisions. Trace an approved test signal into SOC review; record permitted response, exceptions and rollback.
- 01
How does the service fit the current Defender plan and endpoint types?
- 02
Which tenant permissions and telemetry does the SOC need?
- 03
Who approves containment, exceptions and rollback?
Evidence for your evaluation
In practice
SOC review of Microsoft Defender signals
An organization already uses Microsoft Defender telemetry but lacks capacity for consistent SOC review, prioritization and response coordination. Managed EDR for Microsoft Defender adds managed security operations around the existing endpoint signals.
What your team gains
- 01
Managed SOC review of Defender signals
- 02
Incident prioritization and analyst context
- 03
Agreed response ownership and next steps
Before you decide
Questions, answered
Which Microsoft Defender plans can the service work with?
The service supports environments using Microsoft Defender Antivirus, Defender for Endpoint, Defender for Business, and Microsoft 365 Business Premium, E3 or E5. Xcitium adds SOC operations and ZeroDwell around the existing setup; feature availability depends on the Microsoft plan and tenant configuration.
How does the SOC receive Defender telemetry, and what access is needed?
Defender telemetry reaches the SOC through a native API integration. Validate tenant roles, required API permissions, endpoint groups and telemetry coverage in a pilot.
How does ZeroDwell isolate unknown execution, and how does the SOC respond?
ZeroDwell virtualizes unknown execution on the endpoint and isolates it from the device’s operating system and data. The SOC validates alerts, investigates incidents, and reports response and remediation. In the pilot, define which Defender actions the SOC may take, which require approval, and who owns exception decisions.
Next step
Discuss your requirements
Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.