SocGenie Security for Microsoft 365, Run as a Loop

SocGenie is our security operations platform, built by Red Dome for UK managed service providers and the SMEs they look after. AI agents do the reading and the legwork across your Microsoft 365 estate — assessing posture, deploying baselines, mapping detections and enriching incidents. A person approves anything that changes a tenant.

The SocGenie Loop

What SocGenie Does

Posture Assessment

Continuous scanning against five open security frameworks

Baselines as Code

Intune, Conditional Access and Entra RBAC, version controlled

Detection & Triage

Defender detections mapped to MITRE ATT&CK techniques

Approved Response

Agents investigate. People decide and sign off every change.

Inside the Platform

The capabilities your team gets from day one, across every tenant you manage.

Framework Assessments

  • Maester automated test suite
  • CIS Microsoft 365 Benchmarks
  • CISA SCuBA secure configuration
  • EIDSCA for Entra ID
  • ORCA for Exchange Online

Baselines as Code

  • Intune configuration and compliance policies
  • Conditional Access policy sets
  • Entra RBAC role assignments
  • Drift detection against what was deployed
  • Full change history per tenant

MITRE ATT&CK Coverage

  • Defender detections mapped to techniques
  • Coverage gaps made visible, not assumed
  • ATT&CK Navigator layers for reporting
  • Detection tuning tracked over time

Incident Enrichment

  • Sentinel incidents pulled in automatically
  • Sign-in, device and mailbox context attached
  • Threat intelligence lookups on observables
  • A written summary before anyone opens the console

Cross-Tenant SOC Queue

  • One queue across your whole client fleet
  • SLA tracking per incident and per tenant
  • Posture scores side by side
  • Reporting you can hand straight to a client

Approvals Where You Work

  • Approve or reject from Slack or Microsoft Teams
  • Full detail in the SocGenie portal
  • PagerDuty escalation for out of hours
  • Decision rationale stored with every action

How You Can Buy It

Start with a free posture scan and move up only when it earns its place.

Free

Posture scanning, no card required.

  • Up to four tenant scans a month
  • All five assessment frameworks
  • Prioritised findings and remediation guidance
  • Read-only — nothing is changed

Zerotouch

Self-service baselines and detections, run by your team.

  • Unlimited scanning and drift detection
  • Deploy baselines as code
  • Detection content and ATT&CK mapping
  • Your team holds the approvals

Managed MDR

Everything in Zerotouch, with our SOC on the queue.

  • Red Dome analysts triage and investigate
  • Incident response led by our team
  • 24/7 monitoring and escalation
  • You still approve tenant changes

Why It Matters

UK-hosted on Azure with per-tenant data isolation

Least privilege access, no standing admin rights

A complete audit trail of every approval and action

Fleet-wide visibility across every tenant you manage

Agents Investigate.
People Decide.

Run a free posture scan on your own tenant, or talk to us about rolling SocGenie out across your client base