Skip to contentTry UnifiedONE free for 30 days. MSPs onboard up to 15 customers; businesses can ask us for an Access Code.Try UnifiedONE free for 30 daysSee how the trial works

SOC Commander

Three alerts. One attack. One clear next step.

SOC Commander lists each tenant's incidents from its connected Microsoft sources, opens each one with its related alerts and evidence, and recommends the response actions your connected controls support.

Less alert chasing. Faster decisions.
Join the CommunitySee how it works

Create your account and start your guided onboarding.

  • Works alongside your existing tools
  • One view per incident
  • Analysts stay in charge

The problem

Analysts spend the day stitching alerts together.

Related activity arrives as separate alerts in separate tools. Working out the connection takes time that the attacker uses.

Queue by queueDisconnected

Three queues. Three investigations.

The link between the alerts is found late, or not at all.

With UnifiedONEOne incident view

One incident, its alerts and next steps.

SOC Commander shows each incident with its related alerts and the available and recommended actions your controls support.

The attack story

Connected evidence. A clearer investigation.

Open an incident to see its related alerts, entities and evidence on one page, with the actions available for this tenant.

Illustrative attack, step by stepAn illustration of how one attack connects, not a SOC Commander screen. What an incident shows depends on the telemetry the connected environment actually sends, and on what the analyst confirms.
Identity provider

A valid sign-in from an unfamiliar device

Why it is linkedThe source address matched infrastructure the Threat Intelligence Network had already validated as malicious.

An available action is not an allowed action.
In one workspace
  • Incidents and alerts
  • Identities and sign-ins
  • Devices
  • Email
  • Threat intelligence
  • Governed response
  • Recommended actions
An available action is not an allowed action.
  • Tenant authority
  • Analyst role and permissions
  • Capability offered by the connected provider
  • Required licensing
  • Approval and audit requirements

Any one of these can fail on its own. When one does, the action is shown as unavailable and the reason is named.

Context and proof

Shared context. Private customer data.

Shared defensive context can strengthen the investigation without revealing which customer observed it.

What the lookup never returns
  • Customer name
  • Tenant identity
  • Affected users
  • Mailboxes or files
  • Investigation detail

Defensive knowledge travels. Customer data does not.

Built for your team

Fewer alerts to chase. For every team.

SMBs

See each incident and its recommended actions, even without a SOC.

MSPs & MSSPs

Investigate each customer's incidents with shared defensive context. An MSP-wide SOC view is planned.

Enterprises

Give every team the same view of each incident.

SOC teams

Investigate the story, not the alert queue.

Questions people ask

Security investigation and response, answered.

What does SOC Commander actually do?

It is the workspace where a tenant's incidents are investigated and handled. Today it gives you an incident list with charts and a table sorted by date, an incident drawer with the available and recommended actions, and a full incident page that brings alerts, identities, devices, email context and threat intelligence together. Understanding comes first, response second.

Is this a replacement for Microsoft XDR, or for my own SOC?

No. Microsoft provides strong security telemetry and controls, and your analysts provide judgement. SOC Commander adds the layer around them: cross-tenant defensive context, community reputation and protection orchestration. It is designed to make an existing security environment more connected, not to replace it.

Which response actions are available in my tenant?

That depends on your environment. Identity, endpoint and email response are described as categories on purpose, because every action is conditioned on tenant authority, the analyst's permissions, the capability the connected provider actually offers, the required licensing, and your approval and audit rules. When an action cannot run, SOC Commander shows it as unavailable and names the reason.

Does the AI investigate and respond on its own?

No. SOC Commander recommends actions for each incident. The analyst still reviews the evidence, a person still decides, and the response still passes every governance condition. There is no autonomous investigation and no autonomous response.

More questions
Can an analyst see another customer's incidents?

No. What can be asked of the community is whether an indicator has been observed before and how its reputation has evolved. Customer names, tenant identities, affected users, mailboxes, files and investigation detail never travel. The defensive lesson is shared; the environment it came from is not.

Does SOC Commander patch vulnerabilities or push updates?

No. SOC Commander investigates activity and coordinates governed response. Patch delivery and vulnerability remediation are not SOC Commander functions today, and nothing on this page describes them as one.

How is this different from Front Gate Protection?

Front Gate Protection is preventive. It helps stop validated threats at the entrance. SOC Commander is operational. It takes over when activity is already inside the environment and somebody has to understand it, decide what to do, and confirm that it worked.

What does an MSP or MSSP get from it?

SOC Commander currently supports investigation within each tenant. Shared defensive context helps analysts review findings. A single SOC view across an MSP's customers is planned.

Start here

Do not just see the alert. Understand the incident.

See how SOC Commander connects tenant activity, defensive intelligence and governed response in one investigation workspace.

Join the CommunityExplore the platform

Create your account and start your guided onboarding.