Start with onboarding
One operational environment
Bring the AI investigation layer together with playbooks and endpoint operations.
MSSP/MDR · Run the business
Run the full customer SOC in one estate.
SecOps Platform edition.
SecOps Platform includes the full Autonomous SOC and adds the operational modules, from playbooks to endpoint forensics. Multi-tenant operations belong to the same tier, so your provider team can manage customer work alongside the tools it uses to investigate and respond.
Full Autonomous SOC includedMulti-tenant operations includedAutomatio playbook automation
License & SupportNorthstarUnified Dashboard
Autonomous SOC
AI AgentsNative agents and autonomous pipelines
Agent StudioBuild custom agents
Case PrioritizerCase risk signals
Case RouterAnalyst-aware routing
CerebrumLearns from confirmed decisions
MagisterSupervised junior-analyst casework
Autonomous SOC
Virtus TriageTriage for routed alerts
Virtus PilotInvestigation pipeline
CasesShared investigation workspace
Approval CenterConfigured human decision points
AlertsShared core workspace
SecOps Platform contains this full tier. Module grants and permissions still apply.
SecOps Platform
AutomatioPlaybook automation
DetectionsDetection Lake
Endpoint AgentsEndpoint operations and forensics
Multi-TenantProvider operations
DefensumExposure management
CognitioThreat intelligence
Standalone
Virtus OptimusDetection-as-code
Separate licenseVirtus SentinelAI security posture
Separate licenseScriptoriumDocument intelligence
Separate licenseThese products are outside the platform tier defaults. Confirm each required grant in your issued license.
- Tier defaults
- Not bundled
- Access
- Explicit license grant
- Add to
- Autonomous SOC or SecOps Platform
SecOps Platform
Autonomous
Automatio
Detection Lake
Endpoints
Defensum
Cognitio
Alerts
Cases
- Tenant
- Northstar
- Cases
- NS-104
- Settings
- Multi-Tenant
Operational modules and customer context in one workspace.
Every SecOps Platform deployment contains the full Autonomous SOC. Standalone products are licensed on their own.
Autonomous SOC brings native agents, Virtus Triage and Virtus Pilot, plus Agent Studio, prioritization, routing, Cerebrum and Magister.
SecOps Platform adds Automatio, Detection Lake, endpoint operations, Multi-Tenant, Defensum and Cognitio.
Virtus Optimus, Virtus Sentinel and Scriptorium are licensed on their own, outside the tier defaults.
Work in the customer context with the operational surfaces available under the issued license and user permissions.
Illustrative customer workflow
01 - What it does
Put the investigation and response in one estate.
Use the AI layer and the operational modules together. Your provider team can bring detections into cases, run configured playbooks and inspect endpoint evidence in the same working environment.
The full Autonomous SOC is the foundation.
SecOps Platform adds Automatio, Detection Lake, endpoint operations, Multi-Tenant, Defensum and Cognitio to the Autonomous SOC tier. Casebook holds the investigation, and a playbook run started from a case keeps its execution history there. Endpoint forensics supplies evidence for the analyst to review and record in case notes. The modules your license grants and the user's permissions determine access to these surfaces, with connected services supplying the actions they can perform. Standalone products remain separate license decisions for the service.
Your service can carry an investigation into response without rebuilding the case context for the next analyst.
SecOps Platform: scopeExample
- Foundation
- Full Autonomous SOC
- Operations
- Playbooks, detections, endpoints
- Provider work
- Multi-Tenant
- Standalone
- Virtus Optimus, Virtus Sentinel, Scriptorium
Standalone products are licensed separately. Module grants and permissions still apply.
Customer operations in the tier
Use multi-tenant operations alongside the licensed SOC modules.
02 - How it works in the product
Follow the work through connected modules.
Configure the services and permissions each workflow needs before bringing customer work into it.
- 01License & Support
Review the SecOps Platform modules granted by the issued license.
- 02Marketplace
Connect the customer sources and supported actions the service will use.
- 03Cases
Keep investigation notes and ownership together, and run a selected playbook with the case context.
- 04Endpoints
Inspect collected evidence in Forensics and record relevant findings in the case notes.
Approval depends on the action, playbook and applicable policies. Endpoint collection and indexing must be configured.
03 - How it connects
Choose how much of the SOC you operate.
The AI tier supplies investigation capabilities. SecOps Platform extends it with operational modules; The Portal serves providers keeping their own SIEM, EDR and SOAR.
Works with
In the editions
Autonomous SOCIncluded
The AI tier: included in full within SecOps Platform.
SecOps PlatformEdition
This edition: the full estate for provider operations.
The PortalEdition
The provider edition for your own stack.
04 - What it means for your service
Sell the full managed SOC from one estate.
An operational estate supports the service you deliver around it. Cases keep the investigation record while playbooks and endpoint tools give the analyst ways to act and check the result.
A record for the next analyst
Review the case notes and linked playbook history during handoff.
Repeat a configured procedure
Use Automatio for work that should follow the playbook you define.
Customer context alongside the tools
Manage the customer hierarchy in the tier that includes the operational modules.
Start with one customer
- 01Pick an investigation
Choose a customer case that needs both evidence review and a response.
- 02Configure the decision points
Review permissions, connected actions and approval behavior.
- 03Agree the license
Confirm provider operations and the modules required for that workflow.
Questions about SecOps Platform edition.
1What is the difference between the Autonomous SOC tier and the SecOps Platform tier?
The license model groups AI agents, Agent Studio, case prioritization and routing, Cerebrum and Magister under Autonomous SOC. SecOps Platform extends that group with playbooks, detections, endpoint operations, multi-tenant operations, Defensum and Cognitio. Your issued license determines enabled modules; confirm the commercial package in your proposal.
2Can a provider also use Imperum’s AI triage?
AI agents belong to the Autonomous SOC and SecOps Platform product defaults; they are not part of The Portal’s default module set. If you want AI triage alongside provider operations, discuss a license that covers both capabilities, then configure the relevant integrations and triage rules. The enabled modules on your license determine access.
3Which edition does a provider need for AI triage?
AI agents belong to the Autonomous SOC and SecOps Platform defaults. They are outside The Portal's default module set. For AI triage alongside provider operations, discuss a license covering both capabilities, then configure the integrations and triage rules. Enabled modules on the issued license determine access.
Have any other questions? Talk to our team
Build your managed SOC.
Keep the work connected.
Walk through a customer investigation with the AI and operational modules your service needs.