# Identity Threat Detection & Response (ITDR)

> Scoped per engagement · Advisory / vCISO · https://cisomarketplace.services/services/identity-threat-detection-response-itdr

Identity-centric threat detection and response across Active Directory / Entra ID — privilege escalation, lateral movement, account takeover, and identity misconfiguration detection + response playbooks.

## In scope

- AD/Entra attack-path analysis
- Privilege escalation & lateral movement detection
- Account takeover detection
- Identity misconfiguration review
- IR playbooks for identity attacks

## Deliverables

- ITDR assessment report
- Identity attack-path map
- Detection gaps & recommendations
- Identity IR playbooks

## Tiers

### Essential: scoped

Point-in-time review for up to 1,000 users in 1 AD forest and 1 Entra ID tenant: identity misconfiguration review and attack-path analysis to privileged groups. Report with attack-path map and ranked fixes.

Limits: users 1000

Includes:
- 1 AD forest and 1 Entra ID tenant
- Identity misconfiguration review
- Attack-path map to privileged accounts
- Ranked remediation list
- 1 readout

Excludes:
- Detection rule engineering
- Identity incident response playbooks
- Review of existing detection coverage
- Ongoing monitoring

### Advanced: scoped

Assessment for up to 5,000 users across up to 3 AD forests and Entra tenants. Adds a detection gap review for privilege escalation, lateral movement and account takeover, detection logic written for the client's SIEM, and identity incident response playbooks.

Limits: users 5000

Includes:
- Up to 3 forests and tenants
- Attack-path analysis and misconfiguration review
- Detection gap analysis
- Detection logic for the client's SIEM
- Identity incident response playbooks
- Retest of fixed attack paths (1 round)

Excludes:
- Ongoing detection monitoring and tuning
- 24/7 response to identity alerts
- SIEM or ITDR product licences

### Enterprise: scoped

Managed ITDR program with continuous detection

Excludes:
- SIEM or ITDR product licences
- Hands-on remediation in AD or Entra ID

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=identity-threat-detection-response-itdr