Phoenix Protect Active Response is a managed service using Microsoft Sentinel to monitor security events in real-time across on-premise and cloud environments. By analyzing log data from your systems, it proactively identifies threats and supports response management. Our cyber security analysts work with you to identify threats and provide targeted responses with guided remediation, using AI and machine learning from Microsoft alongside Phoenix's own internal threat intelligence sources Sentinel’s threat intelligence data enhances confidence by identifying potential incidents and their severities. The Threat Containment Service, an add-on to Phoenix Protect Active Response, allows the Phoenix SOC team to isolate devices managed by Microsoft Defender. This add-on requires the Phoenix Protect Active Response service and aligns its support hours with the main service.