Run every customer's security on one platform. Keep each one's context.
Add customers without adding consoles. Imperum gives MSSPs and MDR providers one multi-tenant platform for the process, technology, people and scale behind the service.
Tenant context across alerts, cases, connectors and reports1,400+ connectorsOn-premises, cloud, hybrid or air-gapped
Monthly report for Northstar's CISO with alert trends, case stats and SLA compliance
Quick start:
Executive summary for my CISO with alerts and casesSOC daily brief with triage statsCompliance report with SLA and audit dataAI engine performance metrics
Backlog, resolution, routing, workload and shift indicators per analyst, within each viewer's tenant scope.
Metrics › Platform KPI
02 - Technology
Connect each customer's tools.Deploy a connector once. Configure it per customer.
Choose from 1,400+ connectors and 26,000+ connector actions. Deploy a connector once, then set credentials, VPN route and deployment location per customer.
Marketplace › Configure › Tenant ProfilesSample data
Back to Marketplace
Configure CrowdStrike Falcon OfficialDeployed
EDRInstance: CrowdStrike Falcon
Tenant Profiles
One connector, a separate credential and config profile per customer – no forks.
Run a large team around the clock.Shifts, skills and presence in one place.
See who is on shift and what they are working on, plan coverage across time zones, coach junior analysts and bring the customer's people in when a case escalates.
Settings › Roster › Teams & ShiftsSample data
Roster
Shift schedules, on-call coverage, and analyst assignments.
Roster Teams
Manage SOC team groups and their shift schedules
CSV TemplateCSV ImportNew Team
EMEA SOC Europe/Amsterdam3 Shifts
Europe
Add Shift
EMEA Day07:00–15:00MonTueWedThuFri
A. RiveraM. KayaVirtus Triage-01Virtus Enricher-01
EMEA Evening15:00–23:00MonTueWedThuFri
J. DahlVirtus Triage-01Virtus Responder-01
EMEA Night23:00–07:00MonTueWedThuFriSatSun
T. BakkerVirtus Triage-01Virtus Hunter-01Virtus Responder-01
APAC SOC Asia/Tokyo3 Shifts
Asia Pacific
Shifts per team and time zone, with analysts and Virtus agents on the same shift.
Dedicated or pooled analysts
Dedicate analysts to a customer or serve it from your shared pool.
Onboarding › Users & RBAC; Access Control
Team presence and chat
See who is on shift and what analysts are working on. Send direct messages, chat per case and mirror case chat to Microsoft Teams both ways.
Plan shifts by team and time zone with analysts and Virtus agents together. Import Microsoft Teams Shifts.
Settings › Roster
Follow-the-Sun Coverage
Map teams and shifts across time zones. On cloud deployments, a world map shows where analysts are connected from now.
Roster › Follow-the-Sun Coverage
Shift handoff
Hand open cases to the next shift with handoff notes. The case list shows who handed each case over.
My Space › Shift Handoff
Availability and HR Sync
Auto routing skips unavailable analysts, including those away or on leave. HR Sync imports approved leave from HR tools such as BambooHR.
Status menu; Roster › HR Sync
Analyst VPN
Enroll remote analysts in the platform's built-in WireGuard VPN, with no separate VPN concentrator to buy. Each downloads their own configuration.
Roster › VPN
Customer team and Virtus calls
Name a customer's contacts per case stage. Virtus calls them by voice or emails them. On a call they can acknowledge, ask for a callback or hear a brief.
Be ready when a customer is under attack.Availability tiers and auto-tuning.
An attack on one customer can bring a surge of alerts. Choose the availability tier your deployment supports, and when Imperum controls its host, auto-tuning recommends or applies more resources as load rises.
Settings › High Availability › What each tier survivesSample data
High Availability
Keep the platform serving when a node or a whole host fails.
What each tier survives
Honest limits, shown before you move
T0Single nodeT1Warm standby (2 hosts)T2Single-host HA
A container restartsYesit restarts on its ownYesit restarts on its ownYesit restarts on its own
One Search Index or Data Stream node failsNodown until it restartsAfter failoveran operator promotes the standbyYesautomatically
The whole host is lostNorestore from backupAfter failoverabout 10 minutesNoall six nodes are on this host
Data lost at worstEverything since the last backupThe last seconds of Database and Search Index writes; up to 15 min of uploaded files and forensic collections; events in flight in the Data Stream. None on a planned switchover.None for a node loss
Database and CacheSingleReplicated to the standbySingle (not highly available)
Hosts and memory1 host, 16 GiB or more2 hosts of the same size1 host, 64 GiB or more (96 GiB recommended)
Failover-Operator-triggered; never automaticAutomatic, within seconds
What each tier survives, as the product states it.
High availability
Run a single node, a warm standby on a second host, or single-host HA that fails over by itself. Warm standby is not offered for MSSP deployments yet.
Settings › High Availability
Auto-tuning
When Imperum controls its host, auto-tuning recommends more CPU and memory as load rises, or applies it. On Kubernetes it also adds storage and replicas.
Health & Troubleshooting › Auto-Tuning
Questions from MSSPs and MDR providers.
1How does Imperum support MSSPs and MDR providers?
Multi-tenant operations give providers customer-scoped views, connector profiles and onboarding workflows. Authorized operators can work across their permitted customer scope, while the self-service portal offers customer access to requests and cases. Configure tenant permissions and customer workflows to match the service you deliver, and confirm the required modules in your license.
2Is The Portal the same thing as the customer portal?
The Portal is a product edition whose default modules include multi-tenant operations, Case Router and Case Prioritizer. The self-service customer portal is a separate feature for submitting requests and following permitted cases. Distinguish the edition you license from the customer-facing access and workflows you configure.
3How is each customer’s data kept apart?
Multi-tenant mode uses tenant context to scope supported views, API operations and connector credentials. Customer profiles let you configure separate service connections. Authorized provider operators and administrators can access the customer scope assigned to them. Confirm the required data boundary, permissions and deployment arrangement for each customer during architecture review.
4Can each customer have its own case response targets?
Yes. You can configure case time budgets by priority and lifecycle phase, with customer overrides and inheritance from a parent tenant. A rule-specific target takes precedence; otherwise the tenant setting or global default applies. These are workflow targets for tracking your service, not a promise of response times from Imperum.
5Can a provider also use Imperum’s AI triage?
AI agents belong to the Autonomous SOC and SecOps Platform product defaults; they are not part of The Portal’s default module set. If you want AI triage alongside provider operations, discuss a license that covers both capabilities, then configure the relevant integrations and triage rules. The enabled modules on your license determine access.
6Can one playbook be deployed to several customers?
Yes. An authorized operator can deploy an enabled, validated playbook to selected tenants. Deployment creates a tenant-specific copy and records its relationship to the source.
A deployment can be removed from one tenant without removing the source playbook or another tenant’s copy. Check each tenant’s connector setup, permissions and approval configuration before putting the workflow into use.
7Does Imperum replace our SIEM or EDR?
Imperum can work alongside an existing SIEM or EDR through configured integrations. Those connections can supply alerts and make supported actions available to investigations and playbooks. Coverage depends on the connector, credentials and configuration, so validate the tools and workflows you want to retain.
Start with onboarding
A. Rivera
M. Kaya
J. Dahl
T. Bakker