Active Threat Advisory
Iranian state-sponsored APT activity is escalating. Vijilan is offering ThreatRespond free to qualifying MSP/MSSP partners.
NextDefend™ · Managed Falcon Next-Gen SIEM
Most teams deploy Falcon NGSIEM. We operate it.
The umbrella for all Vijilan-managed CrowdStrike Falcon Next-Gen SIEM. Three independent offerings — Deploy, Sustain, Operate. Buy one, two, or all three.
In short: NextDefend™ is the umbrella for all Vijilan-managed CrowdStrike Falcon Next-Gen SIEM, in three independent offerings: Deploy (one-time onboarding), Sustain (annual engineering retainer for detection content and parser evolution), and Operate (fully managed — onboarding plus a 24/7 SOC and cross-source threat hunting). Operate sits alongside Falcon Complete and OverWatch rather than duplicating them. Vijilan has stood up 50+ Falcon NGSIEM environments since becoming a CrowdStrike NGSIEM subcontractor in 2023.
50+
Falcon NGSIEM environments stood up since we became a CrowdStrike NGSIEM subcontractor in 2023.
Across logistics, healthcare, financial services, government (Mexico), forestry (Chile), browser security, and critical infrastructure — three languages, five team certifications, every implementation a reference call away.
CCSC · CCFA · CCFR · CCSE · Cribl User Certified · EN / ES / PT
The architecture
Three independent tiers. Pick what you need.
Each is a complete, standalone offering — nothing is required to unlock anything else. They compose cleanly when you want more.
One-time project
NextDefend™ Deploy
Stand it up correctly the first time. SOC not included
- Data source onboarding — endpoint, identity, cloud, SaaS, network
- Custom parser development for non-standard sources
- Dashboard configuration mapped to your use cases
- Initial detection content tuning and baseline rules
- Cribl Stream pipeline setup where applicable
- Knowledge transfer to your internal team
Annual retainer
NextDefend™ Sustain
Keep it tuned. Keep it current. SOC not included
- Ongoing detection content development
- New data source onboarding throughout the year
- Parser maintenance and updates
- Dashboard and use-case evolution
- Quarterly tuning sessions and content reviews
- 10% discount when bundled with Deploy
Fully managed
NextDefend™ Operate
We build it. We run it. We hunt in it. 24/7. SOC included
- Everything in Deploy + everything in Sustain
- 24/7 Vijilan SOC on Vijilan-authored detections
- Cross-source threat hunting on non-Falcon telemetry
- Custom IOAs and scheduled searches
- Cribl Stream operations and pipeline tuning
- Joint remediation across systems Falcon Complete can’t reach
Falcon Complete + NextDefend Operate
We don’t replace Falcon Complete. We complete it.
Two complementary layers, one clean division. Operate sits alongside Falcon Complete and OverWatch — never duplicating them.
| Capability | Falcon Complete | NextDefend Operate |
|---|---|---|
| Falcon-native detection triage | Owned | — |
| Endpoint containment / isolation | Owned | — |
| OverWatch hunting on Falcon telemetry | Owned | — |
| Vijilan-authored detection rules | — | Owned |
| Custom IOAs & scheduled searches | — | Owned |
| Third-party data parser development | — | Owned |
| Cribl Stream pipeline operations | — | Owned |
| Cross-source threat hunting | — | Owned |
| Remediation across non-Falcon systems | — | Owned |
| NGSIEM platform health & uptime | Owned | Owned |
Deploy. Sustain. Operate.
Sold through partners or direct to mid-market enterprise when no partner exists. Tell us your environment and current state, and we’ll recommend the right tier — or combination.