Raise
A product posts a finding, or a person sends an e-mail, or opens a ticket directly.
A service desk built for security work. Products raise tickets into it, people raise tickets by e-mail, service levels are measured against a calendar, changes wait for their approvers, and when the ticket closes the product that raised it is told.
A product posts a finding, or a person sends an e-mail, or opens a ticket directly.
Related findings gather into one problem with a child per affected host.
Assignment, SLA, approvals where the change needs them, and a timeline that records what happened.
On resolve or close, the product that raised it receives a signed update.
A product posts a finding with its own key; the ticket remembers which product raised it, so when the work is resolved, reopened or closed, that product is told over a signed callback.
A finding that affects fifty machines does not become fifty unrelated tickets: a correlation key gathers them into one parent problem with a child incident per host, so the work is tracked once and closed everywhere.
A mailbox is polled and turned into tickets; replies thread back onto the right ticket by key or by message reference, and the same message is never turned into two tickets.
A change ticket carries risk, window and plans, and cannot move into progress until every approver has approved it.
Policies set due times per tenant, a scanner marks breaches, and notifications go to the people the policy names — into a personal inbox or one of fourteen external channels, with retries and a dead-letter state rather than silent loss.
One instance per customer, and inside it every record carries its tenant. A provider sees across tenants, a tenant user sees only its own, and every query is filtered rather than trusted.
Findings from every product, e-mail requests and human-raised tickets, in one queue per tenant.
Due times from policy, breaches detected by a scanner rather than noticed late, and reports by volume and by agent.
Who did what and when, including approvals on a change and every automated step on the timeline.
An incident shows its state and priority next to the actions that move it on — escalate, mark as a duplicate or a false positive, declare a major incident — with activity, tasks and attachments one tab away.
Documentation capture. Ticket titles, tenants and people are blurred.
Deployment is one instance per customer rather than a shared platform, so a service provider can run it for its own downstream tenants under its own brand without those tenants sharing a database with anyone else's.
SDefender products post findings directly and are told when the work is done. E-mail intake covers everything else, and the web interface is always there for work that starts with a person.
This is not a shared multi-customer service. Each customer runs its own instance, which is what makes white-label tenants safe.
Indicator enrichment and the approval workflow are in place. An action that reaches into another product waits for an analyst and is never fired silently.
Desk does not find anything by itself. It receives what the products find and carries it to a conclusion.
Connect one product or one mailbox, let the tickets land, then widen and add service levels.
One instance for your organisation, with tenants defined if you serve several.
Give one product an API key, or point the intake at a mailbox.
Set service levels, approval rules and who is notified about what.
Turn on callbacks so the product that raised the work learns when it is done.
Choose one product, one environment and one measurable outcome. We define success criteria before the engagement begins.
Tell us a bit about your environment and we'll get back to you shortly.
Your message has reached us; a member of the SDefender team will be in touch shortly. You're always welcome to reach us directly at info@sdefender.com.