Spark MDR for Microsoft Sentinel is a Managed Service providing you with expert 24x7 monitoring and response to events and alerts generated from your Microsoft Sentinel instance.
The managed service consists of 4 components that enable the expert teams at Spark to provide managed security outcomes for your Microsoft sentinel instance.

• Security Event Management Service - log collection, event detection and 24 x 7 monitoring. Spark security experts utilise the native SOAR capabilities in Microsoft Sentinel to provide automated response to known threats and utilisation of AI analysis across an organisation to provide insight to abnormal user activities and identity and protect against new threats.
• Security Incident Response - incl. up to 10 incident responses per month from the base service, with additional incident packs available as required. The Security Incident Response Service provides several components, to effectively manage operational security incidents throughout their lifecycle from their creation through to incident closure for in scope logging devices.
• Use case tuning - support of existing use cases built upon Spark’s own use case library. Fine tuning of existing use cases to allow for better detection and reduction of false positives, advanced security event management tuning of use cases specific to the customer’s requirements and Microsoft Sentinel instance
• Reporting - monthly live report walkthrough from a Virtual Security Manager including: Monthly Executive Summary, Log Ingestion Tracking, Security Alert Breakdown and Sentinel Storage Tracking

The managed service also has additional uplifts available to support your unique requirements and improve your security maturity.

• Threat Hunting (Optional) - Proactive threat hunting utilising a purpose-built threat hunting capability that Spark uses across its own networks leveraging MITRE ATT&CK framework.
• Virtual Security Manager for Microsoft Sentinel (Optional) – dedicated SecOps resource providing monthly customer review, realisation of Microsoft Sentinel security maturity model deliverables and optimisation of managed detection and response effectiveness

Benefits of Spark MDR for Sentinel

• 24x7 coverage - Real time monitoring, triage, incident investigation and remediation by Spark’s NZ based Security Operations Centre
• Optimised Security Operations through access to highly experienced security analysts
• Reduction in security alert fatigue from Spark security automation
• • Holistic threat visibility with Spark Threat Intelligence including exclusive Malware Free Networks (MFN) feeds from the GCSB’s National Cyber Security Centre.

With Spark’s MDR for Microsoft Sentinel, customers can access a powerful combination of tools and people capability to augment their teams and security capability protect their data, endpoints and network in a cloud connected world.