Start with onboarding
A shared shift starting point
Review customer health and open work together before the team chooses what to work on.
MSSP/MDR · Process
Every customer's health in one view.
Move straight into their alerts.
The MSSP Unified Dashboard brings tenant health, alerts and open case work into a provider view. Start the shift with the portfolio in sight, find the customer that needs attention, then switch into that tenant's alerts with the customer context already selected.
Cross-tenant provider viewTenant context on drilldownAnalyst allocation in view
MSSP Unified DashboardAlertsAll TenantsHarbor Retail
TenantsConnector profiles122
Total alerts14852
Open cases237
CriticalCritical92
Tenant Health
Northstar
Healthy
Harbor Retail
Warning
Juniper
Healthy
Meridian Health
Warning
Quick Actions
Manage TenantsView All AlertsCase Management
Cross-Tenant Alert Queue
CriticalSuspicious OAuth consent grant
Harbor RetailEscalatedHighImpossible travel sign-in
NorthstarQueuedHighEncoded PowerShell command
Meridian HealthQueuedHighNew cloud access key
Harbor RetailQueuedMediumNew inbox forwarding rule
JuniperQueuedAlertsHarbor Retail
CriticalSuspicious OAuth consent grantIdentity source
EscalatedHighNew cloud access keyCloud source
QueuedLowBlocked sign-in from a new deviceIdentity source
Auto ClosedWorking context: Harbor Retail
Harbor RetailWarning
- Lead
A. Rivera- Open cases
- 7
- Connector profiles
- 2 own
- Response targets
- Inherited from Harbor Group
- MSSP Team
- A. Rivera,
M. Kaya - Customer Team
T. Bakker, IT manager- Connectors
Microsoft Sentinel, Okta
Tenant Architecture holds the team, connectors and targets.
Analyst Allocation
NorthstarPool 2, Dedicated 1
3 analystsHarbor RetailPool 1, Dedicated 2
3 analystsJuniperPool 2, Dedicated 0
2 analystsCase RouterRecommend
Routing defaults to Off. In Recommend mode a person applies an assignment.
OffRecommendAuto
- Customer
- Harbor Retail
- Assignment
- A person decides
Selecting a tenant switches the working context. Visibility follows the user's authorized scope.
Read tenant health alongside the cross-tenant alert queue. The figures shown are illustrative.
Harbor Retail needs attention. Its critical alert stays identifiable in the cross-tenant queue.
Selecting Harbor Retail switches the tenant context and opens its Alerts view.
Review analyst allocation, then use Case Router where licensed. Recommend mode leaves assignment to a person; routing defaults to Off.
Illustrative customer workflow
01 - What it does
Start the shift with the portfolio in view.
Give the operations lead a shared starting point for customer work. Tenant health and the alert queue bring the customer that needs attention into view before the team opens its alerts.
Find the customer behind the alert.
The provider view brings cross-tenant KPI cards together with Tenant Health, the Cross-Tenant Alert Queue and Analyst Allocation. Select a tenant card to switch the working context and open that customer's Alerts. The portfolio view remains a starting point for authorized operators, with the investigation carried out in the customer's context.
One click takes the shift lead from the portfolio into the customer's alerts, with no console hopping.
Harbor Retail: healthExample
- Status
- Warning
- Open alerts
- 52
- Open cases
- 7
- Lead
- A. Rivera
Illustrative tenant and values. Not customer performance data.
The selected customer follows you
Tenant-card drilldown sets the context for the Alerts view you open.
02 - How it works in the product
Find the work. Open its customer.
Use the provider overview to decide where to look, then the tenant view to examine the work. Opening a customer changes what you see; permissions and routing modes decide what you can do there.
- 01Unified Dashboard
Open the provider dashboard from the header in multi-tenant mode.
- 02Tenant Health
Review each tenant card alongside the Cross-Tenant Alert Queue.
- 03Alerts
Select a tenant card to switch context and open that customer's alerts.
- 04Analyst Allocation
Review the distribution of case work before choosing the next owner.
Provider visibility follows authorized scope. Case Router requires its module entitlement and defaults to Off.
03 - How it connects
Keep oversight connected to the work.
The dashboard gives the lead a provider view; Casebook keeps the investigation record. Tenant Architecture supplies customer teams and service settings, while routing helps a permitted operator choose an owner.
Works with
In the editions
The PortalDefault module
Multi-Tenant is a default module of this edition.
Autonomous SOCOutside the defaults
Discuss licensing for provider operations.
SecOps PlatformIncluded
Multi-tenant operations are part of this tier.
04 - What it means for your service
Put attention where the customer needs it.
A shared view helps the shift lead find work without losing the customer behind it. The drilldown then takes analysts into the right context, with assignment still governed by its own controls.
Less console hopping
Start with tenant health and cross-tenant work in one provider view.
An explicit working context
Selecting a customer opens its Alerts view within authorized scope.
Customer work stays identifiable
Keep the tenant attached as the team reviews alerts and case ownership.
Start with one customer
- 01Open one customer
Review its health card and confirm the alert drilldown.
- 02Check the team
Inspect its team and service settings in Tenant Architecture.
- 03Review assignment
Check the routing mode before applying a recommendation.
Questions about MSSP Unified Dashboard.
1How does Imperum support MSSPs and MDR providers?
Multi-tenant operations give providers customer-scoped views, connector profiles and onboarding workflows. Authorized operators can work across their permitted customer scope, while the self-service portal offers customer access to requests and cases. Configure tenant permissions and customer workflows to match the service you deliver, and confirm the required modules in your license.
2What does the MSSP Unified Dashboard show?
It brings cross-tenant KPI cards, Tenant Health, the Cross-Tenant Alert Queue, Quick Actions and Analyst Allocation into a provider view. Selecting a tenant card switches the tenant context and opens its Alerts view. Figures depend on the deployment and are not product performance claims.
3Does opening a tenant assign its case work?
No. Tenant-card drilldown changes the working context. Case Router is a separate capability that requires its module entitlement. Routing defaults to Off; in Recommend mode a person decides whether to apply an assignment.
Have any other questions? Talk to our team
See the customer.
Then move the work forward.
Walk through your provider view and customer workflow with the Imperum team.