HBSMANAGED SERVICES CATALOG
HBS Managed XDR Technical Requirements
Purpose
This document defines the technical, licensing, access, and configuration requirements necessary for HBS to deploy and operate Managed XDR.
Requirements may change as Microsoft services, supported technologies, security standards, or HBS architecture evolve.
Not all requirements apply to every Customer environment. Applicable requirements will be identified during onboarding.
HBS Management Boundary
HBS Security Operations personnel will directly administer and modify only Microsoft security capabilities specifically included in the Managed XDR service.
HBS-managed capabilities may include:
- Microsoft Defender XDR security investigation and response capabilities.
- Microsoft Defender for Endpoint security capabilities.
- Microsoft Sentinel security monitoring, detection, investigation, and response capabilities.
- HBS-managed Microsoft Intune security policies associated with Managed XDR, including supported Attack Surface Reduction (ASR) and Microsoft Defender Antivirus policies.
- HBS-owned or HBS-managed security components, analytics, automation, and integrations used to deliver Managed XDR.
Investigative Access
During security investigations, HBS Security Analysts may review and use security information available through other Customer-licensed Microsoft security capabilities when that information is relevant to the investigation.
Use of information from a Microsoft security capability for investigative purposes does not mean that HBS manages, monitors, configures, or otherwise assumes responsibility for that capability.
The Microsoft portals, interfaces, and administrative methods used to provide Managed XDR may change as Microsoft services evolve. Availability of a Microsoft service, data source, or administrative capability within a portal used by HBS does not mean that the service or capability is managed by HBS.
Customer-Managed Infrastructure
HBS will not directly modify other Customer-managed infrastructure as part of standard Managed XDR.
Customer is responsible for implementing changes to:
- Firewalls and network devices.
- Routing, proxies, and access controls.
- Virtual machines.
- Server operating systems and infrastructure.
- Azure infrastructure outside HBS-managed service components.
- Log collectors and forwarding infrastructure.
- Third-party security products.
- Applications and other Customer-managed systems.
Where such changes are required to support Managed XDR, HBS will provide applicable requirements, documentation, or configuration guidance.
Administrative permissions granted to HBS do not expand the Managed XDR management boundary.
Access and Authorization Boundary
HBS may possess administrative credentials, delegated permissions, or other privileged access to Customer systems through Managed XDR or other HBS services.
The existence or availability of such access does not expand the scope of Managed XDR or authorize HBS Security Operations personnel to perform actions outside the Managed XDR management and response boundaries.
HBS Security Operations personnel will use privileged access to perform changes or response actions only when the action:
- Is included within the scope of Managed XDR; and
- Is authorized under the Customer’s Managed XDR response configuration or otherwise approved by Customer.
Where an investigation identifies a recommended action outside the Managed XDR scope, HBS Security Operations will communicate or escalate the recommended action to Customer or the appropriate HBS service team for implementation.
Access provided through another HBS service does not, by itself, authorize HBS Security Operations personnel to use that access to perform Managed XDR response or administrative activities.
Microsoft Licensing
Customer must maintain the following Microsoft licensing necessary to support Managed XDR:
Capability | Requirement |
Workstations | Microsoft Defender for Endpoint Plan 2 or Microsoft Defender for Business |
Servers | Microsoft Defender for Servers Plan 1 or Microsoft Defender for Business Servers |
HBS External Identities | HBS requires two Microsoft Entra ID P2 licenses to support the identity-governance processes used by HBS for its external Managed XDR identities. |
SIEM | Azure subscription and Microsoft Sentinel |
Additional Microsoft security capabilities | Appropriate licensing for capabilities included in the Customer’s Managed XDR deployment |
The two Microsoft Entra ID P2 licenses are required to support identity governance for HBS external identities used to provide Managed XDR.
Microsoft Sentinel, Log Analytics, Azure Monitor, storage, and related Microsoft consumption charges may be billed separately based on actual usage.
HBS Access Requirements
HBS requires delegated and role-based access sufficient to configure HBS-managed service components and to monitor, investigate, maintain, and respond through supported Microsoft security services.
Required access may use:
- Azure Role-Based Access Control (RBAC).
- Granular Delegated Admin Privileges (GDAP).
- Microsoft Entra B2B.
- Other Microsoft-supported delegated-access methods.
Customer must maintain required HBS access for the duration of the Service.
Azure RBAC
Current required roles include:
- Azure Connected Machine Resource Administrator.
- Contributor.
- Log Analytics Contributor.
- Logic App Contributor.
- Microsoft Sentinel Contributor.
- Microsoft Sentinel Playbook Operator.
- Microsoft Sentinel Responder.
- Monitoring Contributor.
- Template Spec Contributor.
- User Access Administrator.
- Virtual Machine Contributor.
GDAP
Current required roles:
- Security Administrator.
- Security Operator.
B2B
Current required roles:
- Security Administrator.
- Security Operator.
HBS will identify applicable assignment scope and identities during onboarding.
Endpoint and Server Requirements
Supported endpoints and servers must be properly licensed, onboarded to applicable Microsoft Defender services, and actively reporting.
Standard endpoint deployment methods may include:
- Microsoft Intune.
- Group Policy.
- Microsoft-supported standalone deployment.
- Other HBS-supported Microsoft deployment methods.
Unless separately purchased, Customer is responsible for endpoint and server deployment.
HBS will provide supported deployment documentation and reasonable onboarding guidance.
Customer is also responsible for maintaining:
- Supported operating systems.
- Device connectivity.
- Required Microsoft agents.
- Server and operating-system health.
- Required Azure Arc or Defender for Cloud infrastructure where applicable.
HBS may directly manage supported Defender security capabilities within the HBS Management Boundary.
Network and Connectivity Requirements
Customer must provide connectivity required for Managed XDR services, including where applicable:
- Microsoft Defender.
- Microsoft Sentinel.
- Azure Monitor.
- Azure Arc.
- Log Analytics.
- Microsoft Entra ID.
- HBS-supported collectors and integrations.
HBS will identify required ports, URLs, destinations, and other connectivity requirements where needed.
Customer is responsible for all firewall, routing, proxy, TLS inspection, network access-control, and other network configuration changes.
These controls must not interfere with required Managed XDR communications.
Data Sources and Log Collection
- Microsoft Entra ID.
- Microsoft Defender XDR services.
- Microsoft 365 security telemetry.
- Windows endpoints and servers.
- Supported Linux and macOS systems.
- Microsoft Azure security services.
- Network perimeter firewalls.
- Supported Syslog/CEF security devices.
Supported collection methods may include Microsoft-native connectors, APIs, Syslog/CEF, Azure Monitor, and HBS-supported collectors.
HBS determines the telemetry used by Managed XDR based on security value, platform capabilities, HBS detection content, and other service requirements.
Customer is responsible for source-system configuration necessary to enable telemetry.
Additional Customer Data Sources
Customer may ingest additional data sources into its Microsoft Sentinel environment beyond those used by HBS Managed XDR.
The presence of a data source in Microsoft Sentinel does not mean that HBS monitors, analyzes, or develops security detections for that data source.
Unless otherwise agreed:
- HBS does not guarantee that Customer-added data will be used for security detection, alerting, investigation, threat hunting, or other Managed XDR activities.
- HBS is not responsible for developing or maintaining custom analytics, detection rules, workbooks, automation, or other security content for Customer-added data sources.
- Customer-added data may increase Microsoft Sentinel ingestion, retention, storage, or other Azure consumption charges.
HBS may use additional available telemetry during an investigation when an analyst determines that it is relevant and useful; however, such use does not make the data source a standard monitored source or create an ongoing monitoring obligation.
Requests for HBS to develop detection or monitoring capabilities for non-standard data sources will be evaluated separately and may require additional services.
Customer-Managed Collectors
Where a Customer-hosted collector, forwarder, VM, or supporting system is required, Customer is responsible for:
- Provisioning and maintaining the infrastructure.
- Operating-system health and patching.
- Required connectivity.
- Firewall configuration.
- Infrastructure availability.
HBS will provide required architecture and configuration guidance.
Microsoft Defender Security Configuration
Where authorized, HBS may configure Microsoft security capabilities included within the Managed XDR management boundary and HBS-managed Microsoft Intune security policies.
Capabilities may include:
- Microsoft Defender Antivirus.
- Endpoint Detection and Response.
- Attack Surface Reduction.
- Automated Investigation and Response.
- Automatic Attack Disruption.
- Other supported Defender security controls.
Exact settings, exclusions, audit periods, and configuration values are maintained within HBS internal security standards and may change over time.
Customer must identify business or technical requirements that prevent implementation of an HBS-recommended security configuration.
Customer Administrative Support
Customer must provide personnel capable of performing Customer-owned implementation and troubleshooting activities, including:
- Licensing.
- Endpoint and server deployment.
- Firewall and network changes.
- Azure infrastructure changes.
- Log-forwarder infrastructure.
- Third-party product configuration.
- Testing and validation.
Customer must notify HBS of material changes that may affect telemetry collection or Managed XDR operation.
Technical Exceptions
- Unsupported operating systems.
- Systems unable to deploy required security agents.
- Missing or insufficient licensing.
- Restricted HBS access.
- Unavailable data sources.
- Network limitations.
- Customer-requested security configuration exceptions.
These exceptions may reduce HBS visibility, detection, investigation, or response capabilities.
HBS will document material exceptions and recommended corrective actions.
Changes to Technical Requirements
- Microsoft product or licensing changes.
- Deprecated technologies.
- Security improvements.
- New Managed XDR functionality.
- HBS architecture changes.
- Operational reliability.
HBS will communicate material changes requiring Customer action.
Updates to these Technical Requirements do not, by themselves, modify the fundamental Managed XDR service purchased by Customer.
