What’s Included
Managed Solution will deploy ConnectWise MDR for Microsoft 365, paired with the ConnectWise Security Operations Center (“SOC”), to monitor, alert, and protect Client’s Microsoft 365 environment. The service integrates with Microsoft Defender for Office 365, Defender for Identity, and Defender for Cloud Apps to provide continuous 24/7 monitoring of Client’s Microsoft 365 tenant. Alert feeds from these integrated Defender products are analyzed by ConnectWise’s internal systems and certified SOC analysts to detect email-borne threats, identity-based attacks, anomalous user behavior, and cloud application activity minimizing alert fatigue and enabling high-fidelity escalations.
Upon detection of a security incident or indicator of compromise within Client’s Microsoft 365 environment, Managed Solution will undertake the following steps in coordination with the ConnectWise SOC:
- All security alerts originating from Client’s Microsoft 365 tenant are initially analyzed by the ConnectWise SOC, triaged, and contextualized against global threat intelligence, with significant alerts escalated to Managed Solution’s security team. Our security analysts will investigate each escalated alert to confirm whether it represents a true security incident and assess the threat’s severity, scope, and potential impact on Client’s data, users, and cloud resources. Alert categories include:
- Phishing: Basic, credential harvesting, and advanced social engineering attacks
- Spoofing: Domain and display name impersonation
- Business Email Compromise (BEC): CEO fraud and compromised account alerts
- Spam: Unwanted bulk email
- Zero-Day Attacks: Exploitation of unpatched vulnerabilities
- Anomalous Activity: Unusual outbound email volume and suspicious inbox rules
- Threat Intelligence: IOC-based alerts tied to known malicious URLs, file hashes, or sender addresses
- Managed Solution will leverage unified monitoring dashboards (e.g., ConnectWise BrightGauge or equivalent) to maintain real-time visibility into threats across Client’s Microsoft 365 environment, incorporating Microsoft Secure Score telemetry, audit log data, and signals aggregated by the MDR platform to assess the nature, origin, and potential lateral movement or propagation of detected threats across cloud workloads and identities.
- Upon verifying a security incident or high-risk threat, we will promptly notify Client’s designated security contact(s), providing threat details, including affected users, mailboxes, files, or applications, along with preliminary recommended actions, and will collaborate with Client to determine appropriate response measures consistent with Client’s operational requirements and any predefined incident response plan.
- Managed Solution, in concert with the ConnectWise SOC, will execute containment and remediation measures for confirmed threats, which may include disabling or revoking access for compromised user accounts, invalidating active sessions and OAuth tokens, blocking malicious mail flow rules or inbox forwarding configurations, removing malicious email messages from affected mailboxes, restoring altered SharePoint or OneDrive files to a pre-incident state where versioning permits, and revoking risky third-party application permissions. Response actions will be executed in accordance with MDR service capabilities, applicable Microsoft 365 administrative permissions granted by Client, and any Client-specific instructions.
- For any significant incident, Managed Solution will document the event and actions taken in a report or within the ticketing system, including the nature of the threat, affected Microsoft 365 services and user accounts, detection and neutralization methods employed, and recommendations for Client regarding additional hardening steps, policy adjustments, or security improvements to reduce future risk within the Microsoft 365 environment.
- Note: Client’s Microsoft 365 tenant must include a minimum of one (1) Microsoft Defender for Office 365 Plan 2 license.