ThreatDefend™ — Fully Managed mXDR · Powered by CrowdStrike
We Bring the Technology. You Stay Protected.
No license shopping. No vendor evaluation. No technology to manage. Vijilan deploys, manages, and defends with the world’s leading endpoint security platform across every domain. SOC actively contains threats on every tier — not just at premium.
Zero Complexity — What That Means
- Zero license purchasing — Vijilan manages all Falcon licensing
- Zero vendor evaluation — Vijilan has already vetted the best tools
- Zero implementation — Vijilan deploys and configures everything
- Zero ongoing management — Vijilan tunes, updates, and optimizes
- Identity protection included at Core — not gated behind Advanced
ThreatDefend™ — At a Glance
Zero
License management required from client
Every
Tier — SOC actively contains threats
Core
Includes identity protection — not gated
24/7
Global human SOC + OverWatch at Premium
TD Modules — All Vijilan-Managed
- TD EDR — Falcon MSSP Defend Bundle
- TD SIEM — CrowdStrike LogScale
- TD ITDR — Falcon Identity Protection
- TD XPM — Falcon Exposure Management
- TD Hunt — Falcon OverWatch (Premium+)
Two Products. One Partner Program.
Choose the Right Path for Each Client
ThreatRespond and ThreatDefend cover the same six domains. The difference is who brings the technology.
ThreatRespond™
Your clients' technology.
We monitor it. We respond to it.
Vendor-agnostic. Vijilan’s SOC wraps around whatever tools the client already runs — any EDR, any firewall, any cloud. No rip-and-replace. Active containment on existing tools at Premium tier.
You Are Here
ThreatDefend™
Vijilan's technology.
We bring it. We manage it. You stay protected.
Vijilan deploys and manages the full CrowdStrike Falcon stack. Zero procurement complexity. Zero license management. SOC actively contains threats on every tier from Core — including identity lockdown and endpoint isolation.
The ThreatDefend Technology Stack — TD Modules
Hand-Selected. Fully Vetted. Enterprise-Grade.
Every technology in ThreatDefend was selected because it is the leader in its domain. Vijilan manages all licensing, deployment, configuration, and tuning. Partners and clients never touch it.
Endpoint Domain
TD EDR — ThreatDefend EDR
CrowdStrike Falcon MSSP Defend Bundle
Falcon Prevent (NGAV) + Falcon Insight XDR (EDR) + Firewall Management + Device Control + Threat Graph Standard. Charlotte AI drives agentic detection workflows at machine speed. SOC: host isolation, process termination, file quarantine, eradication + recovery assist on every tier.
✓ Vijilan manages all licensing & deployment
SIEM Domain
TD SIEM — ThreatDefend SIEM
CrowdStrike Falcon Next-Gen SIEM / LogScale
High-speed log management and real-time cross-domain correlation. Powers Vijilan’s ViSH SIEM platform. Vijilan absorbs all ingest costs — partners and clients never see data volume charges. 90-day hot + 7-year cold at Core. 1-year hot + 7-year cold at Advanced+.
✓ No data volume charges — ever
Identity Domain — Included at Core
TD ITDR — ThreatDefend Identity
CrowdStrike Falcon Identity Threat Protection
Full ITDR across Active Directory, Entra ID, and Okta. Detects credential abuse, impossible travel, privilege escalation, BEC precursors, Golden Ticket attacks in real time. Deploys via lightweight identity sensor — independent of endpoint agent. No EDR conflicts. SOC-authorized: account disable, session revoke, MFA enforce.
✓ Included at Core — no tier upgrade required
Exposure Domain — Advanced+
TD XPM — ThreatDefend Exposure
Falcon Exposure Management (Combined SKU)
CrowdStrike’s combined exposure SKU — includes Falcon Spotlight (vulnerability prioritization), Falcon Discover (asset inventory + shadow IT), and external attack surface management in a single module. Runs on existing Falcon agent — zero additional endpoint deployment. Risk prioritization based on active threat context, not just CVSS scores.
✓ One SKU covers Spotlight + Discover + external ASM
Threat Hunting Layer — Premium+
TD Hunt — ThreatDefend Threat Hunting
Falcon OverWatch — CrowdStrike Elite Threat Hunting
CrowdStrike’s 24/7 elite threat hunting team operating inside the Falcon platform — AI-powered hunting across endpoint and identity telemetry at machine speed. At Premium+, operates alongside Vijilan SOC threat hunting — two independent layers covering different domains simultaneously.
✓ Augments Vijilan SOC — not a replacement
Data Pipeline — All Tiers
Cribl Stream — Universal Ingestion
Cribl Stream — Data Pipeline & Routing
Connects and normalizes data from any source — firewalls, cloud platforms, email gateways, SaaS applications, and any other technology in the environment. Routes all signals into TD SIEM with proper formatting and enrichment. Vijilan manages the full Cribl deployment and all data pipeline configuration.
✓ Connects any data source — Vijilan configures all pipelines
Why Identity Is Included at Core
Identity is the #1 attack vector. 80%+ of breaches involve compromised credentials. Making identity monitoring a paid upgrade is a Toyota decision. We include TD ITDR at Core because every client’s Entra ID and Active Directory needs to be watched from day one — not after they’ve been breached.
What Partners Never Have to Do
- Evaluate security vendors
- Purchase or negotiate technology licenses
- Deploy or configure security platforms
- Manage software updates or renewals
- Track license counts or renewals
ThreatDefend™ Service Tiers
Core → Advanced → Premium → Elite
Every tier includes 24/7 active SOC containment, full white-label, PSA integration, and zero license management. Pricing available exclusively through your Channel Manager.
🔒 Pricing available exclusively through your Channel Manager or Partner Portal. Never on this page.
Core
EDR + identity + SIEM — day one
“Endpoint, identity, M365 — all managed. SOC acts immediately.”
⚡ SOC Acts — Every Tier
TD EDRTD SIEMTD ITDR
- ✓TD EDR — Falcon Prevent + Insight XDR + Firewall Mgmt + Device Control + Threat Graph
- ✓TD SIEM — LogScale, no data volume charges, 90-day hot + 7-year cold
- ✓TD ITDR — Falcon Identity Protection — full ITDR on Entra ID, AD, Okta
- ✓M365 + Entra ID monitoring — included at Core
- ✓Charlotte AI agentic detection
- ✓SOC: host isolation, process kill, file quarantine, account lockdown
- ✓SOC-assisted eradication & full recovery
- ✓PSA integration + full white-label
- —TD XPM (Exposure Mgmt) — Advanced
- —TD Hunt (OverWatch) — Premium
Vijilan manages all licensing for
⭐ Most Popular
Advanced
Exposure + asset intelligence
“Adds full exposure — every asset, every vulnerability, every risk.”
⚡ SOC Acts + Exposure Intelligence
TD EDRTD SIEMTD ITDR+ TD XPM
- ✓Everything in Core, plus:
- ✦TD XPM — Falcon Exposure Management (combined SKU: Spotlight + Discover + external attack surface) — Vijilan manages the license
- ✦Asset inventory + shadow IT visibility
- ✦Vulnerability prioritization by active threat context
- ✦External attack surface discovery
- ✦1-year hot + 7-year cold SIEM retention
- ✦HIPAA, PCI DSS 4.0, NIST CSF 2.0, CMMC L1
- ✦Zero licensing complexity across all modules
Adds at this tier — Vijilan manages
Premium
Dual threat hunting · Full mXDR
“OverWatch inside Falcon. Vijilan SOC across all 6 domains.”
⚡ SOC Acts + Dual Hunt Layer
TD EDRTD SIEMTD ITDR+ TD XPM+ TD Hunt
- ✓Everything in Advanced, plus:
- ✦TD Hunt — Falcon OverWatch — CrowdStrike’s elite 24/7 threat hunting inside Falcon — endpoint + identity telemetry
- ✦Vijilan SOC threat hunting — network, email, cloud, apps, IoT/OT — domains OverWatch cannot reach
- ✦Two independent hunting layers operating simultaneously
- ✦CMMC L2 + SOC 2 audit evidence packages (ready for assessors)
- ✦Dedicated named SOC concierge
- ✦Cross-domain coordinated response
- ✦Monthly threat intelligence briefing by vertical
Adds at this tier — Vijilan manages
By Invitation
Elite
Enterprise MSSPs · Bespoke
“Makes Premium the obvious rational choice.”
⚡ Bespoke mXDR + Custom Engineering
- ✓Everything in Premium, plus:
- ✓Custom YARA detection rules for third-party sources in TD SIEM
- ✓vCISO advisory hours — board-ready reporting, risk register
- ✓IR retainer — 1-hour SLA
- ✓Forward-deployed Vijilan engineer
- ✓Custom compliance — CMMC L3, DORA, NIS2
- ✓Cribl data pipeline optimization
Pricing anchor — Elite makes Premium look like the rational choice. And Premium still costs less than most competitors’ base packages.
Active Containment — Every Tier
The SOC Acts. On Every Tier.
ThreatDefend is not a monitoring service that sends tickets. It is an active defense operation. Vijilan’s SOC detects, investigates, and contains threats — on every tier, without waiting for partner or client approval.
Endpoint Isolation
SOC isolates infected hosts from the network — immediately, without waiting for approval. Powered by CrowdStrike Falcon’s real-time response capabilities.
Identity Lockdown
SOC disables compromised accounts in Entra ID and AD, revokes active sessions, and enforces MFA — all in real time. Available at every tier including Core.
File Quarantine & Process Kill
SOC quarantines malicious files and terminates active malicious processes across all Falcon-protected endpoints — immediately upon confirmation.
Eradication & Recovery Assist
After containment, the SOC assists through complete threat eradication and system recovery — not just detection and a ticket. Full post-incident report included.
TD Hunt — Two Independent Hunting Layers at Premium+
Falcon OverWatch
CrowdStrike’s elite threat hunting team operating inside the Falcon platform. Hunts across endpoint and identity telemetry using CrowdStrike’s global threat intelligence — 2.7M+ detections monthly.
Vijilan SOC Threat Hunting
Vijilan’s SOC hunts across all 6 domains — firewalls, network, email gateways, cloud, SaaS, applications, IoT/OT, and mobile. Domains OverWatch cannot reach. Client-specific context and history.
At Premium+: Both operate simultaneously as independent layers. They complement each other. They do not overlap.
SOC Actions by Tier
Available to ThreatRespond Partners
Add Individual TD Modules Without Switching Products
ThreatRespond clients can purchase individual ThreatDefend modules that run independently alongside their existing tools. No product switch. No tool replacement.
Managed Identity Threat Detection
TD ITDR — Falcon Identity Protection
Full ITDR across AD, Entra ID, and Okta. Deploys via lightweight identity sensor — completely independent of any existing EDR. Works alongside SentinelOne, Defender, or any other endpoint agent without conflict.
Compatible with: Any existing EDR — Falcon Identity deploys independently, no conflicts
Standalone — no product switch required
Managed Exposure Management
TD XPM — Falcon Exposure Management
Asset inventory, vulnerability prioritization, shadow IT visibility, and external attack surface management in a single combined SKU. Vijilan manages the license. Risk prioritization based on active threat context.
Compatible with: Any environment — works alongside any existing EDR or endpoint tool
Standalone — no product switch required
Managed SaaS Security
Falcon Shield — SSPM
SaaS Security Posture Management across 150+ applications including M365, Google Workspace, Salesforce, Slack. Misconfiguration detection, shadow SaaS discovery, GenAI governance. API-based — no endpoint agent required.
Compatible with: Any environment — pure API-based monitoring, no endpoint agent needed
Standalone — no product switch required
TD Browser (Falcon Secure Access / Seraphic) is also available — browser protection across Chrome, Edge, Safari, and Firefox. Available à la carte outside standard tiers. Subject to minimum requirements. Contact your Channel Manager.
Frequently Asked Questions
Everything Partners Need to Know
Why is identity protection included at Core and not Advanced?
Because identity is the #1 attack vector and making it optional is a mistake. 80%+ of breaches involve compromised credentials. Every client’s Entra ID and AD should be monitored from day one — not after they’ve been breached. No competitor includes full ITDR at their entry tier. We do, intentionally.
Do clients need to purchase any CrowdStrike licenses?
No. Vijilan manages 100% of Falcon licensing — TD EDR, TD SIEM, TD ITDR, TD XPM, and TD Hunt. Clients pay one managed service fee. Vijilan handles all CrowdStrike licensing, deployment, configuration, tuning, and renewals. Zero procurement complexity.
What is TD XPM and what does it include?
TD XPM maps to Falcon Exposure Management — CrowdStrike’s combined SKU that includes Falcon Spotlight (vulnerability prioritization), Falcon Discover (asset inventory + shadow IT), and external attack surface management in a single module. Runs on the existing Falcon agent — zero additional endpoint deployment.
How does TD Hunt work with Vijilan's SOC threat hunting?
They are two independent, complementary hunting layers. TD Hunt (Falcon OverWatch) hunts inside the Falcon platform — endpoint and identity telemetry using CrowdStrike’s global threat intelligence. Vijilan SOC hunts across all 6 domains — including firewalls, email, cloud, applications, and IoT/OT, which OverWatch cannot reach. At Premium, both operate simultaneously.
Can ThreatRespond clients add ThreatDefend modules?
Yes. ThreatRespond clients can add TD ITDR, TD XPM, or Managed SaaS Security without switching products. TD ITDR deploys completely independently of any EDR — no conflicts with SentinelOne, Defender, or any other endpoint agent. All modules are licensed and managed by Vijilan.
What does Elite include and why is it "By Invitation"?
Elite includes everything in Premium plus custom YARA detection engineering, vCISO advisory hours, 1-hour IR retainer SLA, and a forward-deployed Vijilan engineer. It is By Invitation because it is designed as a pricing anchor — it makes Premium look like the rational, obvious choice for most clients. Both serve different client profiles.
We Bring the Technology. You Stay Protected.
Zero license management. Zero vendor evaluation. SOC actively contains threats on every tier. Identity included at Core.
Become a Partner
No minimums. No lock-in. 30-day opt-out. NFR licenses at Silver and Gold.
Pricing via Channel Manager
Pricing exclusively through your Channel Manager or Partner Portal. Never on this page.
Talk to Jen AI
Instant answers about ThreatDefend, TD modules, tiers, and CMMC — 24/7.
Praxis AI Engine
The AI Brain Behind Every Response
Praxis is Vijilan’s proprietary AI detection and investigation engine — the intelligence layer running inside our SOC on every alert, across every domain, before a human analyst acts.
What Praxis Does
Machine Speed. Human Judgment. One Minute to Contain.
Every alert from every security domain passes through Praxis before a human analyst sees it. Praxis doesn’t replace the human SOC — it makes our analysts operate at a speed and fidelity no purely human team can match. It’s the engine behind Vijilan’s 1-minute median time to contain.
Investigation
Multi-agent LangGraph pipeline automatically investigates every alert — correlating signals across all six domains simultaneously before presenting findings to the analyst.
Enrichment
IOC enrichment from threat intelligence feeds, MITRE ATT&CK technique mapping, and severity scoring derived from real adversary behavior — not just CVE scores.
Triage
Automated alert triage separates confirmed threats from false positives before they reach a human analyst — reducing noise and ensuring every escalation is a real threat.
Context
RAG-powered threat context retrieves relevant historical patterns, similar incident precedents, and client-specific environment data to inform every investigation decision.
Praxis Capabilities
LangGraph Multi-Agent MITRE ATT&CK Mapping IOC Enrichment Auto-Triage Cross-Domain Correlation RAG Threat Context Behavioral Scoring Human SOC Amplifier
What Praxis Is Not
Praxis is not an autonomous agent that replaces human judgment. It is a force multiplier — the AI layer that enriches, correlates, and prioritizes so that human analysts spend their time on confirmed threats, not alert noise. Every containment decision is made by a trained human analyst informed by Praxis — not by an algorithm acting alone.
The Result
1-minute median time to contain.
Partners benefit from Praxis automatically — on every tier, both products. No configuration. No additional cost. Praxis is built into the Vijilan SOC, and the Vijilan SOC is what partners are buying.
Pricing — User-Based, Transparent, No Surprises
ThreatDefend is priced per endpoint and per user per month — no flat fees, no data volume charges on SIEM, no hidden costs. Pricing scales with the client, not against them. Exact pricing is available exclusively to verified Vijilan partners through the Partner Portal or your Channel Manager.