Managed service
Overview
Section titled “Overview”A monitoring provider (Shield360 Managed Services, or a partner) can watch your organisation for you and tell you what needs attention. You decide who from the provider is let in and until when. They read; you act.
Provider staff can:
- read alerts, AI analyst findings, security cases (the people a case is about stay pseudonymised), costs and budgets, the AI inventory, policies, risks and compliance status;
- write findings: what they saw, how serious it is and what they recommend.
Provider staff can never:
- see prompts, responses, request contents, logs or code written by agents;
- reveal the name behind a pseudonym, or see your members, invitations, roles, SSO or SCIM settings, the people directory or one person’s data;
- export or download anything;
- change a setting, rule, policy, budget or channel, or acknowledge, snooze or resolve an alert;
- use an API key.
The server enforces every one of these on every request. They are not hidden buttons.
Give a provider access
Section titled “Give a provider access”You need the Grant managed service access permission. Administrators and owners have it.
Name the provider’s staff by email. Only addresses at the provider’s own domains are accepted, so a grant can never be used to let in somebody else. Access ends at the end of the day you choose, at most 366 days away.
Staff who already have an account are added at once. Everyone else gets an invitation and is added when they accept it.
You can extend or shorten the end date, add or remove people, or Revoke the grant at any time. Revoking removes everyone on it at once.
Provider staff:
- hold no seat;
- are not held to your organisation’s SSO, because they sign in under their provider’s own policy;
- cannot be given another role.
Findings
Section titled “Findings”Findings appear under Alerts → Provider findings, and each new one raises a managed.finding alert. You can route that alert to Slack, Teams or email like any other.
For each finding you can:
- Acknowledge it once you have seen it;
- Resolve it when it is dealt with;
- Dismiss it if it does not apply;
- Reopen it later.
You can add a note to any of these. Provider staff cannot change a finding’s status.
Everything provider staff do is recorded in your audit log under their own name and marked on behalf of the provider. That includes the grant being given, changed and revoked, a daily record of each person’s access, and every finding they report.
Self-hosted installs
Section titled “Self-hosted installs”The same grant works on a self-hosted install. Provider staff sign in to your install directly, and nothing leaves your network. If your provider signs in with addresses at other domains, set SHIELD360_MANAGED_PROVIDER_DOMAINS to a comma-separated list of those domains.