The Portal brings multi-tenant oversight, case prioritization and analyst routing to the security tools you already run. See where attention is needed, understand the work and find an owner without losing sight of the customer behind it.
Your existing stackCustomer-specific controlsSkills-aware routing
Provider visibility follows access. Case work retains its customer context.
Case Router recommends an analyst using skills, case history and workload. In Recommend mode, a person chooses whether to apply the assignment.
Example journey · synthetic customers and case
Oversee the portfolio, select a customer, review an existing case and choose an owner. This illustration combines related views; prioritization and routing are separate capabilities.
01 - Customer operations
See the portfolio. Work in the right customer.
The MSSP Dashboard brings tenant health, alerts and open case work into a provider view. Select a customer to move into their alerts, or open Tenant Architecture to inspect their team, connectors and service settings.
Give each customer a clear home.
Organize customers and sub-tenants in a hierarchy. Use the tenant switcher to set the working context, and manage provider teams and customer contacts against the selected tenant.
A handover starts with the customer, their tools and their team in view.
Provider → NorthstarExample
Provider team
Identity response
Customer contact
Security lead
Connectors
Customer + shared
Response targets
Tenant overrides
Details belong to the selected customer.
◎
Make scope explicit.
Tenant-aware alerts and case access help analysts stay in the intended customer context. Broader views require the relevant permissions.
◷
Keep service targets specific.
Set response targets by priority and investigation phase. Tenant settings inherit defaults; a rule-specific override takes precedence where configured.
02 - Case Prioritizer
Put evidence behind the priority.
A severity label is a starting point. Case Prioritizer combines the case’s available signals into a weighted risk score, with a breakdown that helps analysts understand why the work deserves attention.
From case context to a reviewable priorityIllustrative
Review the signal breakdown. Request an AI explanation when configured.
Targets follow the applicable SLA
Available signals vary. The score does not automatically erase the case’s severity or turn missing evidence into a low-priority decision.
Score new work in the background.
Automatic prioritization can run after a case is created. That path uses the weighted formula; an AI explanation is a separate action. Analysts can review the result and change the priority.
Keep the guardrails visible.
A case with no underlying evidence keeps its priority. Automated recommendations also respect a severity floor. When a priority change is applied, the applicable response target is recalculated.
Spend less time comparing raw alerts and more time judging the case in context.
03 - Case Router
Match the work to the people who can take it.
Case Router weighs declared skills and training alongside observed case history, workload and seniority. It gives your team a reasoned shortlist, so assigning a case takes less detective work of its own.
Start with what you knowSkills + case history
A weighted scorer works before a learned model is available.
Learn from the outcomesTenant-specific machine learning
With sufficient training history, a trained model can rank analysts. The weighted scorer remains the fallback.
Choose how assignments happenPer customer
Keep assignment manual.
The router does not automatically assign new cases. Your team chooses who owns the work.
Awaiting assignmentNo automatic owner
Routing helps choose an owner. It does not grant access to a customer or execute a response action.
04 - Your service, your stack
Add coordination to the tools you already trust.
The Portal is a distinct edition for providers keeping their SIEM, EDR and SOAR. Its default licensed modules are multi-tenant management, Case Prioritizer and Case Router, alongside core alerts and case work.
The Portal
The provider’s operational layer
Customer hierarchy and oversight
Evidence-based case priority
Analyst matching and assignment controls
Your connected tools
The customer’s security stack
Use supported connectors and customer-specific configuration to bring the relevant activity into Imperum. The available actions depend on the connector and its permissions.
The customer request portal can be enabled and configured for request intake and tracking. It is a separate feature from The Portal edition; the request catalogue determines which submissions need approval.
Choose additional capabilities deliberately.
AI agents, Agent Studio, playbook automation, detections and endpoint collection are outside The Portal’s default module set. Explore the appropriate edition and licences if you want Imperum to do that work too.
Map their tools, users and response targets. Then review real case evidence and analyst recommendations before choosing the level of automatic assignment.
01
Set the customer context
Create the tenant, configure access and connect supported tools.
02
Define the service
Set customer response targets and prepare analyst profiles.
03
Review before expanding
Check priorities and suggested owners; enable Automatic routing when it fits the service.
Questions about The Portal.
1Do we have to replace our SIEM or EDR?
No. The Portal is designed for providers using their own stack. Integration depends on supported connectors, customer configuration and permissions.
2Is The Portal the customer request portal?
No. The Portal is the provider edition. The customer request portal is a separately enabled feature for submitting and tracking requests. Its catalogue and approval rules are configured for the service.
3Will every case be assigned automatically?
No. Routing defaults to Off. Recommend leaves the decision to a person. Automatic attempts to assign an eligible, available analyst; an unavailable candidate or a failed assignment leaves work for the team to handle.
4Can customers have different response targets?
Yes. Configure targets per priority and phase for each tenant, with inheritance from parent and global settings. Rule-specific overrides take precedence when present. These are service targets, not a guarantee of response time.
Security lead