Cortex XDR, monitored and managed 24/7
Our Global SOC handles your Cortex XDR detections day and night. Want to hand off the day-to-day management too? Then we take over policies, agents and exceptions. We do the same for Strata firewalls, Prisma Access and Prisma Cloud.
- 2005Founded in the Netherlands
- 300+Clients worldwide
- 24/7Global SOC in 5 shifts
- ISO 27001And SOC 2 Type 2
Good tools, too few hands
Cortex XDR sees a lot. But every alert also needs to be assessed, at night and over the weekend too. And policies, agents and exceptions need maintenance every week. That takes specialists who know the products well and are always available. They are scarce, so alerts pile up and the configuration falls behind.
The foundation, and one step further
We handle your alerts 24/7
We manage your policies and agents
MDR Detect™ is the foundation: 24/7 threat handling. MDR Prevent™ builds on top of that and also takes over the management of your environment.
A night at our Global SOC
- DetectionOn a laptop in the finance department, Cortex XDR sees a process that starts encrypting files.
- AssessmentEventFlow™ enriches the alert with threat intelligence and your context. This is genuinely suspicious, so it becomes a case.
- InvestigationAn analyst at our Global SOC works out what is running, how it got in and what it touches.
- ResponseWith MDR Prevent™, we isolate the laptop under the Rules of Engagement we agreed with you upfront. With MDR Detect™ only, we advise and you decide.
- The next morningYour IT manager opens AUXO™. The case, the findings and the advice to prevent a repeat are ready.
Example scenario. Times are for illustration.
Which products we support
| Product | Detect | Prevent |
|---|---|---|
| Cortex XDRPrevent and Pro | ||
| StrataFirewalls, Panorama and Strata Cloud Manager | ||
| Prisma AccessSASE for branch offices and mobile users | ||
| Prisma CloudAWS, Azure, Google Cloud and more |
Cortex XSIAM and Prisma SD-WAN are in development. Using them? Get in touch.
What you notice
No alerts left waiting
Every detection is assessed, at night and over the weekend too.
Peace of mind after hours
Your own team doesn't have to be on call at night. We are.
Insight in AUXO™
Real-time dashboards, a monthly service report and concrete improvement advice.
No extra cost per integration
Cortex XDR, Strata, Prisma Access and Prisma Cloud are included in the subscription.
Who is behind it
Behind both services is our Security Special Service Team. Specialists who pick up incidents 24/7, without escalation layers and without handovers.
Meet the team →365 days a year
Our Global SOC is always staffed and reachable by email and phone.
Reporting on time starts with seeing on time
Under NIS2, organizations in scope must give an early warning of a significant incident within 24 hours of becoming aware of it. In the Netherlands this has applied since 15 August 2026, through the Cyberbeveiligingswet. You can only make that deadline if someone also spots the incident at night and over the weekend.
How we make you audit-ready →- 24 hours
- Early warning after becoming aware
- 72 hours
- Notification with initial assessment
- 1 month
- Final report with cause and measures
What you want to know
What is the difference between MDR Detect and MDR Prevent?
MDR Detect™ is the foundation: we handle the detections from your Palo Alto environment 24/7 and the configuration stays with you. MDR Prevent™ builds on top of that and takes over management: policies, agents, exceptions and changes. Threat handling stays under MDR Detect, so you take MDR Prevent alongside MDR Detect.
What access does ON2IT get to our environment?
With MDR Detect we get read access to your Cortex XDR tenant and your Prisma Access and Prisma Cloud consoles, plus a secure connection to your firewalls to collect alerts. With MDR Prevent we get administrative rights. You always keep read access to everything.
Does each Palo Alto integration cost extra?
No. Cortex XDR, Strata, Prisma Access and Prisma Cloud are included in your MDR Detect or MDR Prevent subscription at no extra cost.
Talk to a Palo Alto specialist
We show you how we monitor and manage your Palo Alto environment, and what that means for your own team. In the demo you see: