Automated incident response for security teams on Microsoft Defender XDR and Sentinel
Reviewed by ContraForce team
Cover every alert, around the clock.
With the team you have.
ContraForce puts Security Delivery Agents on your Microsoft Sentinel and Defender XDR, triaging, investigating, and responding under standard operating procedures (SOPs) you set. Your analysts lead the calls; the agents carry the volume.
The alerts never stop.
The team can’t scale
to match them.
Sentinel and Defender surface more signal every quarter. Your team triages what it can, chases the loudest alerts, and quietly lets the rest age out. The gap between what fires and what gets worked is where breaches live.
The usual fixes don’t hold. Hiring analysts is slow and expensive, the market is dry, and every hire still needs sleep. Bolting on SOAR automates the paths you already thought of and breaks the moment reality doesn’t match the script. Outsourcing to an MDR hands your environment to someone else’s black box.
There’s another way: keep the work in-house, and put agents on it.
From alert to resolution,
without waking anyone up
Agents that do the work, not just summarize it
Security Delivery Agents run the tasks that eat your analysts’ day: triage, investigation, enrichment, evidence-gathering, documentation, and ticketing. They work every alert in Sentinel and Defender, not just the ones the team had time for, 24/7.
Your runbooks, actually enforced
Gamebooks turn your SOPs into executable, governed workflows. Every incident is handled the same way, high-risk actions gate on human approval, and every decision lands in an audit trail your auditors can actually read.
Works on your data, where it lives
ContraForce connects to your Sentinel and Defender XDR through federated access. Your logs stay in your environment, agents act only with the access you grant, and nothing is duplicated into a third-party data lake.
Built for the team
that can’t hire its way out
Coverage without night shifts
Agents work every alert around the clock, so 2 a.m. gets the same rigor as 2 p.m., without an on-call rotation or a follow-the-sun team you don’t have the headcount for.
MTTR measured in minutes
Triage and investigation start the moment an alert fires. Analysts open a case that’s already enriched, correlated, and documented, and spend their time deciding, not gathering.
Your stack, your data, your control
Native to Microsoft Sentinel and Defender XDR, with nothing to deploy. No rip-and-replace, no logs copied out of your environment, and no vendor sitting between you and your own environment.
Results your CISO
can take to the board
6
Stages in the complete delivery loop
Triage through customer-ready report.
0
Duplicated customer log stores
Federated access keeps security data in the customer environment.
1
Multitenant control plane
Operate customer environments from one governed workspace.
1
Attributable audit trail
Evidence, decisions, approvals, and actions stay reviewable.
Every alert worked.
Every action logged.
Small team, big surface
A handful of analysts covering thousands of endpoints? Agents work the full alert queue so your team stops triaging and starts investigating what actually matters.
Nights, weekends, and holidays
Coverage doesn’t lapse when the office empties. Agents run continuously against your SOPs and escalate to a human only when your gates say so.
Audit and compliance
Every incident produces exportable evidence, what fired, what the agent did, who approved what. Audit prep stops being a fire drill.
Native to Microsoft.
Connected to the rest.
ContraForce runs natively on Microsoft Sentinel and Defender XDR and connects to the tools your SOC already lives in, so incidents close the loop without another console to babysit.
- Microsoft Sentinel
- Microsoft Defender
- Microsoft Entra ID
- SentinelOne
- CrowdStrike
- ServiceNow
- Microsoft Teams
- Jira
Three ways to close the gap.
One that scales with you.
| Hire more analysts | Outsource to MDR | Run it with ContraForce | |
|---|---|---|---|
| Time to impact | Months to hire + ramp | 4–8 weeks | Days |
| 24/7 coverage | Needs a full rotation | Yes, their SOC | Yes, agents around the clock |
| Who runs your environment | You | The vendor, in practice | You |
| Handles the unscripted | Yes, if staffed | Yes | Yes, agents investigate |
| Where your data lives | Your tenant | Third-party lake | Your tenant |
Live in days,
not quarters
Connect
Connect Sentinel and Defender XDR to ContraForce. Nothing to deploy, no new endpoint agents, and no logs copied out of your environment.
Configure
Load your runbooks into Gamebooks. Set approval thresholds, escalation paths, and the actions agents can take on their own.
Activate
Security Delivery Agents start triaging, investigating, and documenting every alert across your environment, 24/7.
Approve
High-risk actions wait for your analysts’ sign-off. Everything else runs autonomously against your SOPs.
Go live
Turn coverage on across the full estate. Same SOPs, same rigor, no new headcount.
Most teams are fully operational in under a week.
Keep Exploring
Go deeper
Microsoft Defender XDR integration
How incidents, evidence, approvals, and response actions move through the delivery loop.
Microsoft Sentinel integration
How Sentinel incidents connect to governed security delivery.
Security Delivery Margin Calculator
Model the analyst hours and cost per incident ContraForce takes off your team.
What is a Security Delivery Agent?
The worker that investigates, decides within your guardrails, executes, and documents.
What is Agentic Security Delivery?
The operating model behind the platform.
Frequently asked questions.
Does ContraForce run in our own environment?
There is nothing to run in your environment: ContraForce hosts and operates the platform. It connects to your Sentinel and Defender XDR through federated access, so your logs stay in your environment, agents act only with the access you grant, and nothing is duplicated into a third-party data lake.
Do we need to replace Sentinel or Defender?
No. ContraForce runs natively on Microsoft Sentinel and Defender XDR, it operates the stack you already own. No new endpoint agents, no data duplication, no migration.
Does it replace our analysts?
No. It replaces the repetitive work your analysts shouldn’t be doing, triage, enrichment, documentation, ticketing. Your team focuses on complex investigations and the decisions that need judgment. Agents escalate to a human wherever your approval gates require it.
How does 24/7 coverage work without an on-call rotation?
Security Delivery Agents run continuously against your standard operating procedures (SOPs). Off-hours alerts get the same triage and investigation as business hours, and only escalate a human when your gates say so, so you get around-the-clock coverage without a follow-the-sun team.
What about high-risk actions like isolating a device or disabling an account?
Those gate on human-in-the-loop approval by default. You decide which actions agents can take autonomously and which wait for sign-off, and every action is logged and attributed.
How is this different from SOAR?
SOAR automates the paths you scripted and stalls when reality does not match the script. Security Delivery Agents investigate, they gather evidence, correlate, and reason toward a conclusion on alerts nobody scripted, while still enforcing your standard operating procedures (SOPs) and approval gates.
How fast can we be live?
Most teams are operational within a week: connect Sentinel and Defender, load your runbooks into Gamebooks, and activate agents.
Your stack. Your data.
Agents on the alerts.
See how ContraForce works on your Microsoft Sentinel and Defender XDR. No rip-and-replace and nothing to deploy; validate readiness in your environment.