Xcitium offering

Managed Security Packages

Managed SOC-Guided, Managed EDR and Managed SOC-Device options. SOC monitoring, endpoint detection, threat investigation, incident response, vulnerability management and reporting are combined according to the selected service package.

Discuss your requirements ↗

An IT lead, security analyst and device specialist work together

Managed service selection

Choose the management and monitoring scope you need

Managed packages differ in threat response, SOC work, and the sources included in monitoring. Select a package profile, then review each service in the full comparison.

01 · Managed SOC - Guided

Who this service model fits

MSPs that prioritize threat intelligence and guided incident response when selecting a service model.

Package capabilities: Threat response focus

Managed SOC - Guided combines threat intelligence, automated containment, incident triage and prioritization, and guided response.

Compare all managed services

Service responsibilities and coverage

Threat intelligenceThreat-feed integration and adversary TTPs

ContainmentAutomated incident containment

ResponseIncident triage and prioritization

Managed SOC - Guided

02 · Managed EDR

Who this service model fits

MSPs that want SOC monitoring with proactive threat hunting and remote incident response.

Package capabilities: SOC investigation and endpoint response

Managed EDR combines SOC monitoring, proactive analysis, anomaly detection, post-incident forensics, and remote containment.

Compare all managed services

Service responsibilities and coverage

MonitorSecurity Operations Center (SOC)

InvestigateProactive analysis · anomaly detection · incident forensics

RespondRemote incident containment and response

Managed EDR

03 · Managed SOC - Device

Who this service model fits

MSPs that want network, user behavior, and cloud monitoring alongside SOC operations.

Package capabilities: Broader monitoring sources

Managed SOC - Device adds network traffic and user behavior analytics, log analysis, cloud monitoring, and insider threat detection.

Compare all managed services

Service responsibilities and coverage

NetworkNetwork Traffic Analysis (NTA)

UsersUser Behavior Analytics (UBA)

Cloud and logsCloud Security Monitoring · Log Management and Analysis

Managed SOC - Device

Package comparison

Three levels of managed security

122 capabilities in 24 categories from Xcitium’s published three-package comparison. Exact inclusions, local service scope and response times are confirmed in the proposal and agreement.

Managed SOC - Guided

Threat intelligence, automated containment and incident prioritization.

Managed EDR

SOC monitoring, proactive threat hunting and remote incident containment.

Managed SOC - Device

Adds network traffic analysis, user behaviour analytics and cloud monitoring to SOC services.

Detection and Monitoring7

Detection and Monitoring
Capability	SOC-Guided	EDR	SOC-Device
24/7 SOC monitoring, analysis and response	Not included	Included	Included
This SOC service is included in Managed EDR and Managed SOC-Device.
Network Traffic Analysis (NTA)	Not included	Not included	Included
User Behavior Analytics (UBA)	Not included	Not included	Included
Log Management and Analysis	Not included	Not included	Included
Cloud Security Monitoring	Not included	Not included	Included
Insider Threat Detection	Not included	Not included	Included
Additional Log Retention	Included	Included	Included

Threat Intelligence3

Threat Intelligence
Capability	SOC-Guided	EDR	SOC-Device
Threat Feed Integration	Included	Included	Included
Adversary TTPs	Included	Included	Included
Monthly Threat Briefings	Included	Included	Included
Monthly threat briefings are available to organizations with a minimum number of endpoints; contact sales for the threshold.

Threat Hunting2

Threat Hunting
Capability	SOC-Guided	EDR	SOC-Device
Proactive Threat Analysis	Not included	Included	Included
Anomaly Detection	Not included	Included	Included

Incident Response5

Incident Response
Capability	SOC-Guided	EDR	SOC-Device
Automated Incident Containment	Included	Included	Included
Incident Triage and Prioritization	Included	Included	Included
Post-Incident Forensics	Not included	Included	Included
Remote Incident Containment	Not included	Included	Included
Attack Surface Reduction	Not included	Included	Included

Vulnerability Management2

Vulnerability Management
Capability	SOC-Guided	EDR	SOC-Device
Regular Vulnerability Scans	Not included	Not included	Included
Patch Management Recommendations	Not included	Not included	Included

Compliance Support3

Compliance Support
Capability	SOC-Guided	EDR	SOC-Device
Regulatory Compliance Assistance	Not included	Not included	Included
Audit-Ready Reports	Not included	Not included	Included
Security Policy Development	Not included	Not included	Included

Reporting and Insights4

Reporting and Insights
Capability	SOC-Guided	EDR	SOC-Device
Customizable Dashboards	Not included	Included	Included
Executive-Level Reporting	Not included	Included	Included
Detailed Root Cause Analysis	Not included	Included	Included
Key Performance Indicators (KPIs)	Not included	Included	Included

Advanced Capabilities4

Advanced Capabilities
Capability	SOC-Guided	EDR	SOC-Device
AI and Machine Learning	Included	Included	Included
Cloud Sandbox	Included	Included	Included
Zero Trust Architecture Support	Included	Included	Included
Cross-Platform Protection	Included	Included	Included

Advanced Customer Support4

Advanced Customer Support
Capability	SOC-Guided	EDR	SOC-Device
Advanced Customer Support	Included	Included	Included
Managed packages include 7×24 advanced customer support for critical and non-critical issues.
Dedicated Account Management	Included	Included	Included
Flexible Service Plans	Included	Included	Included
Scalable Solutions	Included	Included	Included

Platform SLA2

Platform SLA
Capability	SOC-Guided	EDR	SOC-Device
Business-Hours Customer Support	Included	Included	Included
Platform support is available 5×9 during standard business hours.
Support for Critical Security Operations	Not included	Included	Included
Managed EDR and Managed SOC - Device include 7×24 advanced support for critical security operations.

MDR SLA · Detection and Response4

MDR SLA · Detection and Response
Capability	SOC-Guided	EDR	SOC-Device
Threat Detection	Included	Included	Included
95% of threats are detected within 10 minutes of occurrence.
Incident Triage	Included	Included	Included
High-priority alerts are triaged and escalated within 15 minutes of detection.
Threat Containment	Included	Included	Included
ZeroTrust Containment automatically restricts threats under the configured policy.
Mean Time to Response (MTTR)	Not included	Included	Included
Average response time for critical incidents is 30 minutes.

MDR SLA · Monitoring and Availability3

MDR SLA · Monitoring and Availability
Capability	SOC-Guided	EDR	SOC-Device
SOC Availability in EDR and Device MDR	Not included	Included	Included
SOC is available 24/7/365 in EDR and Device MDR.
Management Portal Uptime	Not included	Included	Included
Management portal uptime is 99.9%.
Log Availability	Not included	Included	Included
Logs are ingested in real time with no more than 5 seconds of latency.

MDR SLA · Reporting and Insights3

MDR SLA · Reporting and Insights
Capability	SOC-Guided	EDR	SOC-Device
Post-Incident Reporting	Not included	Included	Included
A forensic report is provided within 24 hours of incident resolution.
Compliance Reporting	Not included	Included	Included
Threat Dashboard Updates	Not included	Included	Included
Threat dashboards update every 5 minutes with new detections.

Platform Technology Stack8

Platform Technology Stack
Capability	SOC-Guided	EDR	SOC-Device
Next-Generation Antivirus (NGAV)	Included	Included	Included
Firewall Control	Included	Included	Included
EDR with HIPS	Included	Included	Included
Virtualized deception-like protection	Included	Included	Included
Uses a non-persistent virtualized environment rather than decoy targets.
Zero Trust Containment	Included	Included	Included
IT Service Management (ITSM)	Included	Included	Included
Enhanced XDR (EXDR)	Included	Included	Included
Security Information and Event Management (SIEM)	Included	Included	Included

Platform Capabilities6

Platform Capabilities
Capability	SOC-Guided	EDR	SOC-Device
Multi-Method Detection	Included	Included	Included
Integrated AI/ML Threat Intelligence and Indicators	Included	Included	Included
Static and Behavioral NGAV Threat Prevention	Included	Included	Included
Data Loss Prevention and Remediation	Included	Included	Included
Attack Surface Reduction	Included	Included	Included
Viruscope Behavior Monitoring	Included	Included	Included

Advanced EDR (AEDR)8

Advanced EDR (AEDR)
Capability	SOC-Guided	EDR	SOC-Device
Advanced Response Tools	Included	Included	Included
Remote Scripting	Included	Included	Included
File Quarantine and Removal	Included	Included	Included
Remote Process Termination	Included	Included	Included
File Retrieval	Included	Included	Included
Endpoint CLI Access	Included	Included	Included
Remote Windows Event Log Access	Included	Included	Included
Network Isolation	Included	Included	Included

Enhanced XDR (EXDR) · Detection13

Enhanced XDR (EXDR) · Detection
Capability	SOC-Guided	EDR	SOC-Device
Interprocess Memory Access	Included	Included	Included
Windows Event Hooks	Included	Included	Included
Device Driver Installations	Included	Included	Included
File Access, Modification, and Deletion	Included	Included	Included
Registry Access, Modification, and Deletion	Included	Included	Included
Network Connections	Included	Included	Included
URL Monitoring	Included	Included	Included
DNS Monitoring	Included	Included	Included
Process Creation	Included	Included	Included
Thread Creation	Included	Included	Included
Interprocess Communication (for example, named pipes)	Included	Included	Included
Real-Time Telemetry Expansion	Included	Included	Included
Endpoint Event Chaining and Enrichment	Included	Included	Included

Enhanced XDR (EXDR) · Investigation14

Enhanced XDR (EXDR) · Investigation
Capability	SOC-Guided	EDR	SOC-Device
Adaptive Event Modeling	Included	Included	Included
Behavioral Analysis	Included	Included	Included
Static File Analysis	Included	Included	Included
Time-Series Analysis	Included	Included	Included
Automated Malware Analysis Integration	Included	Included	Included
Threat Hunting Interface or API	Included	Included	Included
Matching Against Private Indicators of Compromise (IOC)	Included	Included	Included
Threat Intelligence Integration	Included	Included	Included
Linking Telemetry to Recreate Events	Included	Included	Included
Process and Attack Visualization	Included	Included	Included
Confidence-Based Alert Prioritization	Included	Included	Included
Alert Prioritization by System Criticality	Included	Included	Included
Risk Exposure Monitoring	Included	Included	Included
Reporting on Repeated Alerts for Automation	Included	Included	Included

Services4

Services
Capability	SOC-Guided	EDR	SOC-Device
Xcitium Threat Research Labs Service (CTRL)	Included	Included	Included
Automation Scripting Service	Included	Included	Included
Baselining Pro Service	Included	Included	Included
Cyber Transparency Service	Included	Included	Included

Endpoint Compliance and Management12

Endpoint Compliance and Management
Capability	SOC-Guided	EDR	SOC-Device
Patch Management	Included	Included	Included
Vulnerability Reporting	Included	Included	Included
Custom Xcitium Security Policies	Included	Included	Included
Device Asset Discovery	Included	Included	Included
Remote Monitoring and Management	Included	Included	Included
Vulnerability Scanning	Included	Included	Included
Device Enrollment	Included	Included	Included
Incident Log Activity	Included	Included	Included
Application Control	Included	Included	Included
External Device Control	Included	Included	Included
Compliance Reporting	Included	Included	Included
Hosted Ticketing	Included	Included	Included

Customer Support3

Customer Support
Capability	SOC-Guided	EDR	SOC-Device
Support Request Acknowledgement	Not included	Included	Included
Critical support requests are acknowledged within 15 minutes.
Issue Resolution Time	Not included	Included	Included
Published resolution times are 4 hours for standard requests and 1 hour for critical requests.
Response to Non-Critical Queries	Not included	Included	Included
Non-critical requests receive a response within 24 hours.

Data Security and Encryption3

Data Security and Encryption
Capability	SOC-Guided	EDR	SOC-Device
Data Encryption at Rest and in Transit	Included	Included	Included
Data is encrypted at rest and in transit.
Data Retention	Included	Included	Included
Logs are retained for 7–30 days by default, with customized retention periods available.
Breach Notification	Included	Included	Included
Notice of a suspected breach is issued within 4 hours of discovery.

Performance Metrics3

Performance Metrics
Capability	SOC-Guided	EDR	SOC-Device
False-Positive Rate in Escalated Alerts	Not included	Included	Included
In Managed EDR and Device, SOC analysts validate and prioritize alerts to help reduce noise.
Mean Time to Detect (MTTD)	Not included	Included	Included
Managed EDR and Device use Zero Trust Containment to isolate unknown threats during analysis and block unauthorized persistent changes to the endpoint.
Incident Success Rate	Not included	Included	Included
Managed EDR and Managed SOC - Device combine incident containment, investigation, and response actions.

Custom SLAs2

Custom SLAs
Capability	SOC-Guided	EDR	SOC-Device
Critical Application Monitoring	Not included	Included	Included
Managed EDR and Managed SOC - Device have a 5-minute threat detection SLA for critical applications.
Industry-Specific Compliance	Not included	Included	Included
Compliance reports and audit documentation help organizations prepare evidence for HIPAA, PCI DSS, and GDPR.

Capabilities

Fit the way your team works

Core capabilities

SOC monitoring, endpoint detection, threat investigation, incident response, vulnerability management and reporting are combined according to the selected service package.

Deployment and fit

Confirm each package’s inclusions, response responsibilities and service level in the agreement. Local service scope is clarified separately on enquiry.

Capabilities

Capabilities with a specific purpose

Scope

Managed SOC-Guided focuses on threat intelligence, automated containment and guided response. Managed EDR and Managed SOC-Device add SOC investigation and response.

Workflow

Service areas include detection and monitoring, threat intelligence, threat hunting, incident response, vulnerability management, compliance support, reporting and customer support.

Output and handoff

The selected tier determines the mix of SOC/EDR, device coverage, retention, briefings and reporting, including how incident context reaches the customer.

Responsibility boundary

Service hours and SLA are defined by the selected package and agreement. Some monthly briefing features require a minimum endpoint count.

Compare approaches

Service role and adjacent approach

Consideration	Managed SOC-Guided	Managed EDR
Primary focus	SOC-Guided emphasizes threat intelligence and guided response.	The Managed EDR option focuses on endpoint detection and response.
Workflow	SOC-Guided routes analyst guidance and escalation to the customer response team.	EDR routes endpoint alerts into SOC investigation and endpoint response decisions.
Output and handoff	SOC-Guided hands observations, recommendations and escalation context to the customer.	Managed EDR hands endpoint findings, response actions and reports to the customer.

Before you start

Reconcile the service matrix with the contract

Get written confirmation of which tier includes SOC analysts, log sources, endpoint actions, threat hunting, retention and reports. Document SLA, ownership, endpoint minimums and escalation separately.

01
What precisely differs between SOC-Guided, Managed EDR and SOC-Device?
02
Which region and contract does 24/7 monitoring and response apply to?
03
How are endpoint minimums, log retention and reporting cadence set?

Evidence for your evaluation

Xcitium three-package comparison

Guided, EDR and Device capabilities and published service terms.

In practice

Choosing a managed service level

A mid-sized organization compares a service to extend its security team. Before selecting a tier, it clarifies monitoring scope, responsibilities, response process, and contractual terms.

What your team gains

01
Package comparison tied to security needs.
02
Clear scope for incident investigation, vulnerability work, and reporting.
03
Written agreement on monitoring and response boundaries.

Before you decide

Questions, answered

How are managed packages differentiated?

Managed SOC-Guided, Managed EDR and Managed SOC-Device. SOC-Guided emphasizes analyst support, while EDR focuses on endpoint detection and response. Packages are selected for the organization’s needs.

Which service areas are covered?

Monitoring and detection, threat intelligence and hunting, incident response, vulnerability management, compliance support and reporting.

Where are SLA and package inclusions confirmed?

Confirm inclusions, device minimums, retention, SLA and response commitments in a written offer and agreement.

Next step

Discuss your requirements

Tell us about your environment and priorities to discuss the right solution, pilot scope and rollout in Azerbaijan.

Discuss your requirements ↗

Managed Security Packages

Who this service model fits

Package capabilities: Threat response focus

Who this service model fits

Package capabilities: SOC investigation and endpoint response

Who this service model fits

Package capabilities: Broader monitoring sources

Three levels of managed security

Managed SOC - Guided

Managed EDR

Managed SOC - Device

Fit the way your team works

Core capabilities

Deployment and fit

Scope

Workflow

Output and handoff

Responsibility boundary

Reconcile the service matrix with the contract

Evidence for your evaluation

Xcitium three-package comparison↗

Choosing a managed service level

Discuss your requirements

Xcitium three-package comparison