Inside the Managed XDR Suite

No. The suite is vendor-neutral by design. If you already own an enterprise-grade EDR, an email security gateway, or a cloud posture tool, we usually integrate the existing product into the correlation layer rather than rip and replace. The 24/7 SOC, the SOAR playbooks, the SIEM correlation, and the threat-intel enrichment are always Petronella-operated. The detection sensors can be a mix of yours and ours.

The exception is when an existing tool is a known dead-end, such as a discontinued product, a license you are about to retire, or a platform we have benchmarked as substantively underperforming for your use case. We will tell you up front in the scoping call; we do not run engagements on stacks we cannot defend.

Two different angles on the same engagement. The Managed XDR service overview answers "what is the methodology, what is the operating discipline, why is your SOC different." This page answers "what is in the bundle, how do the components fit together, what does the wiring diagram look like." Read both before a scoping call; they complement each other rather than overlap.

Two reasons. First, we tune the stack per engagement; the EDR engine we deploy for a 50-person law firm is rarely the same one we deploy for a 5,000-endpoint healthcare system. Second, we maintain the ability to swap a component out without disturbing the customer relationship if a vendor's product trajectory degrades. Naming the brand in marketing copy creates customer expectations that constrain future engineering decisions. We share the specific vendor list under NDA during the scoping call.

The Petronella enterprise private AI cluster runs on hardware we own and operate, located in North Carolina. Customer alert metadata, threat-intel enrichment, and forensic-investigation queries process on that cluster. We do not send customer alert content to third-party large-language-model APIs. The "private tenant" model that several competitors pitch involves a slice of a public-cloud-hosted LLM with a contractual data-handling promise; ours is a physically separate inference platform with a different and stronger boundary.

API-integrated. The email security layer connects via the native Microsoft 365 and Google Workspace administration APIs and sits in addition to your existing inbound mail flow, not in line. That means no MX-record changes during onboarding, no mail-delivery delays, no operational risk to your business mail. We process audit logs, sign-in activity, conditional-access events, and SharePoint or Drive sharing events directly. Post-delivery clawback removes a phishing message from recipient inboxes after the threat-intel feed updates.

Yes. Petronella Technology Group consults across all CMMC levels, including Level 1, Level 2, and Level 3. The technical control coverage in the suite is identical across levels; what changes is the depth of documentation, the rigor of the System Security Plan, and the involvement of a C3PAO at higher levels. We are CMMC-RP certified and operate as a CMMC-AB Registered Provider Organization, RPO #1449. For Level 3 engagements we coordinate with the assessing organization throughout the readiness window.

The Managed XDR Suite handles contained incidents up to and including ransomware encryption attempts, business email compromise, and credential-theft chains as part of the steady-state subscription. When an incident escalates to a major breach requiring forensic-grade investigation, legal hold, regulatory notification, or insurance-carrier coordination, the case transfers to the Incident Response Services team. The transfer is internal; you do not contract with a new vendor mid-incident.

No. The identity-protection layer integrates with Entra ID, Okta, Active Directory, and most major identity platforms. We tune your existing identity provider with conditional-access policy, MFA enforcement, and just-in-time elevation. Privileged access management deploys as a vaulted broker on top of your existing identity stack; admins check out elevated credentials per-session.

If you suspect or have confirmed an active threat in your environment, do not start with the standard Managed XDR Suite onboarding. Call (919) 348-4912 immediately. We will dispatch our incident response team first to contain and investigate, then transition you into the steady-state suite once the active incident is resolved. The two engagements run in sequence, not in parallel, during a crisis.

Yes. We run live demos from a sanitized customer-consent environment, walking through real-world alert triage, SOAR playbook execution, and the analyst console. We do not show prospective customers another customer's live data. Demos last 45 minutes and include time for technical Q and A with a senior SOC analyst, not a sales engineer.

Contracts are one-year terms with month-to-month thereafter and a 60-day notice provision. On exit, we provide the last 90 days of raw event data, the full SIEM rule library, the SOAR playbook source, and a transition runbook for your incoming vendor or in-house team. We do not hold customer data hostage; we operate on the premise that good service retains customers, not contract gotchas.

The Managed XDR Suite includes a SOC-as-a-Service capability, but it is more than just outsourced analyst staffing. A pure SOC-as-a-Service engagement typically expects you to bring the tooling stack; ours bundles the tooling with the analysts. Both models work; the bundled model trades vendor flexibility for reduced integration burden and a single accountable owner.