Start with onboarding
Retain the customer stack
Use supported integrations to bring the tools you already run into customer workflows.
MSSP/MDR · Run the business
Coordinate customer work on your own stack.
The Portal edition.
Keep the SIEM, EDR and SOAR your service already runs. The Portal adds multi-tenant management, case prioritization and analyst routing, alongside core alerts and case work. Your team can find the customer behind the work and choose who takes it next.
Multi-Tenant in the defaultsCase Prioritizer includedCase Router included
License & SupportAll TenantsUnified Dashboard
The Portal
Multi-TenantCustomer hierarchy and context
IncludedCase PrioritizerRisk signals on the case
IncludedCase RouterAnalyst-aware routing
IncludedCore workspaceAlerts and Cases
AI agents and playbook automation are outside this edition’s defaults.
Core workspace
AlertsWork the customer queue
CasesKeep investigation and ownership together
Approval CenterReview decisions that need a person
SettingsConfigure the service
Core alerts and case work follow the user’s permissions.
The Portal
My Space
Dashboard
Alerts
Cases
Case Router
Notifications
Settings
Reports
Core alerts and case work remain available. Access follows the license and permissions.
- Customer
- Northstar
- Routing
- Off by default
Marketplace
Microsoft SentinelSIEM connection
Northstar
CrowdStrike FalconEndpoint security connection
Harbor RetailServiceNowService management connection
JuniperOktaIdentity connection
NorthstarTenant Profiles hold separate endpoints and credentials. Configure and test each connection.
Cases
NS-104Privileged account activity
NorthstarCase PrioritizerAvailable case signals
HighCase RouterRouting mode
Recommend
A. RiveraIdentity skills and available workload
Awaiting choiceRecommend leaves assignment to a person. Routing defaults to Off.
AI agents, Agent Studio, playbook automation, detections and endpoint collection are outside The Portal's default module set.
The Portal defaults include Multi-Tenant, Case Prioritizer and Case Router, alongside the core workspace.
Analysts use Alerts and Cases. Case Router has its own sidebar entry on The Portal.
Connect supported tools in Marketplace. Tenant Profiles give customers separate endpoints and credentials.
Review the case priority and a routing recommendation. Routing defaults to Off; Recommend leaves assignment to a person.
Illustrative customer workflow
01 - What it does
Add the provider layer to the stack you keep.
Coordinate customer work without replacing the tools that supply it. The Portal is a distinct edition for providers that already run their security stack.
Keep the tools. Bring the work together.
The Portal combines Multi-Tenant with Case Prioritizer and Case Router. Analysts work in the core workspace, with Alerts and Casebook available alongside Notifications and the Approval Center. The MSSP Unified Dashboard brings customer health and open work into a provider view. Tenant Architecture holds the teams, connectors and service settings for the selected customer. Supported integrations connect the tools you retain; their configuration and permissions determine the data and actions available.
Add the provider layer without replacing the stack your customers already paid for.
The Portal: defaultsExample
- Modules
- Multi-Tenant, Case Prioritizer, Case Router
- Core
- Alerts, Cases, Approval Center
- Marketplace
- Connectors, Webhooks, Ingestion
- AI agents
- Outside the defaults
Edition defaults shown. Your issued license determines enabled modules.
License the provider layer
Choose The Portal when coordination is the capability your existing stack needs.
02 - How it works in the product
Set up the service around each customer.
Start with the licensed modules, then configure the customer context. Bring in supported tools before using the case and routing workflows.
- 01License & Support
Confirm The Portal edition and its enabled modules.
- 02Multi-Tenant
Enable multi-tenant mode and organize customers in the hierarchy.
- 03Marketplace
Configure a Tenant Profile for each customer connection and review the connection test.
- 04Cases
Review the priority and routing mode before deciding who takes the work.
Integration depends on supported connectors, customer configuration and permissions. Routing defaults to Off.
03 - How it connects
Choose the layer your service needs.
The Portal coordinates provider work on an existing stack. SecOps Platform adds the AI and operational modules when your service needs a broader estate.
Works with
In the editions
The PortalEdition
This edition: the provider layer for your own stack.
Autonomous SOCEdition
The AI tier: native agents and investigation pipelines.
SecOps PlatformEdition
The full estate: Autonomous SOC plus operational modules.
04 - What it means for your service
Keep the stack. Add the provider layer.
Customer oversight and case coordination share the same provider layer. The selected tenant stays in view while the team works the case and considers its next owner.
A provider view of the work
Use tenant health and open work to decide which customer needs attention.
An informed assignment
Review routing recommendations against analyst skills and workload.
Existing tools keep their role
Configure supported connections instead of replacing the stack to coordinate cases.
Start with one customer
- 01Choose a customer
Map its existing tools to supported connectors.
- 02Review the case workflow
Check the priority signals and leave routing in the intended mode.
- 03Confirm the package
Agree the enabled modules and capacity in your proposal.
Questions about The Portal edition.
1Does Imperum replace our SIEM or EDR?
Imperum can work alongside an existing SIEM or EDR through configured integrations. Those connections can supply alerts and make supported actions available to investigations and playbooks. Coverage depends on the connector, credentials and configuration, so validate the tools and workflows you want to retain.
2Is The Portal the same thing as the customer portal?
The Portal is a product edition whose default modules include multi-tenant operations, Case Router and Case Prioritizer. The self-service customer portal is a separate feature for submitting requests and following permitted cases. Distinguish the edition you license from the customer-facing access and workflows you configure.
3What is in The Portal edition?
The Portal defaults include Multi-Tenant, Case Prioritizer and Case Router, alongside core alerts and case work. AI agents, Agent Studio, playbook automation, detections and endpoint collection are outside its default module set. Additional module access can vary by agreement.
Have any other questions? Talk to our team
Keep your stack.
Coordinate the customer work.
Review The Portal against the tools and case workflow your service already runs.