What the CyberSentry Overview shows, and where each page takes you
See which clients need a human, which have no sign-in monitoring and who to harden first across your clients, then drill into triage, posture, response rules you test before they act, and security awareness training with records an auditor can read.
Fleet security stats
Four tiles: Needs human review, High Severity, Filtered by Elise and Sign-in Monitoring. Sign-in Monitoring counts the in-scope clients that have Microsoft 365 Business Premium (Microsoft Entra ID P1), the license the strongest sign-in detections need. Click any of the first three tiles to open Triage: alerts that need a person first, then what Elise cleared.
Security coverage gaps
The clients that are in scope for CyberSentry monitoring but have no sign-in threat monitoring active yet, with a count and a Configure coverage link. Which clients are in scope is set under Settings > Clients > Client Boards.
Top at-risk clients
Your managed clients ranked by open alert count, so a fleet review starts with the client that needs attention first. When no client has an open alert it reads No open alerts across any client.
Recent high-severity alerts
The most severe recent findings across all clients, so a fleet-wide check does not mean opening every client one at a time. When there are none it reads No high-severity alerts.
Triage
Elise's investigation view of the Microsoft 365 sign-in and directory signals CyberSentry sees: the alerts that need a person, and everything she cleared as noise, each with the confidence math behind the call. Triage is where you investigate. It sends no alert notification of its own. When Elise's verdict on an open alert is escalate, she opens that alert's ticket, one ticket per alert, on the security board you set in the CyberSentry settings. A cleared alert opens nothing.
Posture
Microsoft Secure Score for every managed client side by side, read from each client's own Microsoft 365 connection, not a number the portal invents. A client appears once its Microsoft 365 integration is connected and synced. The fixes themselves happen in that client's Microsoft security center, so use this page to decide which tenant to harden first.
Response Rules
Where you write IF/THEN security automation, with the always-on Confidence Engine row at the top, which scores every finding from 0 to 100. The row shows Monitor, Disabled or Live. Its On switch arms it into Monitor or turns it off, and Promote to Live is on the engine's own page. Each rule is Disabled, Monitor or Live. In Monitor a rule only records what it would have done. What a rule does on a match is whatever its author puts in its actions: notify, open a ticket, revoke sessions, lock the account, or any mix. You can test a rule against a client's history before you switch it on.
Awareness
Security awareness training for your clients: an annual course written for each client's industry and jurisdiction, automatic enrollment, reminders until it is done, and a completion record you can hand to an auditor. The program ships off. Until you turn it on, nothing is generated, nobody is enrolled and clients see no Security Training page. A wizard on this same page teaches the program and turns it on.
Browse
On this page
Why it works this way: What the CyberSentry Overview shows, and where each page takes you
Triage sends no real-time alert notification for any alert, however severe it looks. It opens a ticket only when Elise's verdict on an open alert is escalate, and then just one ticket for that alert. Beyond that, only two doors act on a pattern: an armed Response Rule with the matching action, or the Confidence Engine promoted to Live.
The Confidence Engine row sits above your own rules on purpose. It scores every finding, and its bands decide what fires. Your rules are the specific IF/THEN responses you layer on top. The Confidence Engine arms into Monitor first and goes Live only through Promote to Live, and a new rule starts Disabled, so you watch what they would have done before anything acts.
Under the tiles, Live monitoring health lists each consented client with a status: Monitoring, No recent events, Overdue, Erroring, Paused, Consent missing or Pending first sync, plus any client you excluded on purpose, shown as Ignored (excluded). It flags any client whose feed has gone quiet, stopped or lost its consent, so an all-clear means we are still watching. It shows once clients are consented. An Endpoint Protection (EDR) card with endpoints protected, executions blocked this week and secure-mode coverage shows when there is endpoint protection data.
Ask Elise to author a client's annual awareness training: "Write this year's security awareness training for Bluebird Dental." She starts the authoring job and the training lands in generating; it needs the program on and one tap to approve, and the permission to create awareness training. Then "Assign Bluebird Dental's training and make it due in 30 days" assigns the published training to everyone at that client with a due date, again for one-tap approval and with edit permission.
Awareness has three parts: Security Awareness Training, one annual course per client, framed in that client's regulatory language, with every employee at that client enrolled automatically once it is published. Micro-Trainings, a short industry-specific nudge generated once a week, which your team sees and clients do not. Training Records, the completion records, exportable for an auditor or a cyber-insurance renewal.
Who is in the awareness program is a billing decision. A client is in when a service plan they subscribe to includes Security awareness training, set on Billing > Service Plans. The wizard also asks you to set each client's Industry and, if you want assignment and reminder email, connect a training mailbox (optional). The same switch lives at Settings > Security > CyberSentry if you ever turn the program off.
CyberSentry is part of the MSP module. On an instance set up for a different module this whole area stays hidden.
Questions this page answers
What does the Security Overview page show?
CyberSentry → Overview is your top security page. It covers every client you manage. It shows alerts to review. It shows high-severity counts. One tile, "Filtered by Elise" by default, shows how much noise the assistant already cleared - the name follows whatever you call your assistant. It also shows sign-in coverage, coverage gaps, at-risk clients, and recent severe alerts.
How do I get from an overview stat to the actual alerts?
Click any top stat tile: Needs human review, High Severity, or Filtered by Elise. Each one opens CyberSentry → Triage, filtered to that set. The lists below link straight to a client or an alert.
Why don't I see a Security area at all?
CyberSentry is a feature for the MSP module. On an instance set up for a different module, this whole section stays hidden. It never shows and fails.
What is Security Triage?
Security Triage shows what Elise decided about your Microsoft 365 security signals. It lists the cleared noise and the escalations, with the math for each. Use it to look into an alert. If Elise escalates an open alert, she opens its ticket, and your team gets the new ticket bell and email. A cleared alert opens nothing. Elise sends no alert push of her own: only an armed Response Rule or the AUTO engine, set to Live, can do that.
Why are most alerts marked "cleared"?
Most sign-in and directory activity is benign or expected, and Elise clears it so it doesn't drown the real signal. A cleared alert isn't hidden - it's recorded with the confidence it scored and the factors behind it, so you can audit the decision. Only activity that reaches an escalation band surfaces as something to act on.
How does a security alert become a ticket?
Three things can turn an alert into a ticket. Elise does it when her verdict on an open alert is escalate. A Response Rule you armed with the "Open ticket" action does it for the pattern it matches. The AUTO confidence engine, once promoted to Live, can open one from a band. Whichever fires first, the alert gets just one ticket, on the security board you set in the CyberSentry settings. A cleared verdict opens nothing, and the two rule doors open no tickets on a fresh instance until you arm one.
Why didn't anyone get a real-time notification for this alert?
Elise's triage sends no alert push of its own. If her verdict on an open alert was escalate, she opened its ticket, and your team got the new ticket bell and email. Any other real-time alert push comes from a Response Rule armed with the "Notify" action. The AUTO engine, once promoted to Live, can also add Notify to a band. A fresh instance, or one with the engine still in Monitor, sends none until you arm one of those. A cleared alert notifies no one, but it stays visible here and in the Cleared-by-Elise digest.
What does Security Posture show?
Microsoft Secure Score for every managed client, side by side. It's a fleet-wide read of how well each tenant's Microsoft 365 security controls are configured - a fast way to spot the clients most in need of hardening.
Where does the score come from?
Directly from Microsoft Secure Score via each client's Graph connection - it's Microsoft's own measure, not a number this portal invents. A client only appears with a score once its Microsoft 365 integration is connected and has been synced.
How do we raise a client's score?
By applying Microsoft's recommended improvement actions in that tenant (MFA coverage, legacy-auth blocking, admin-role hygiene, and so on). Posture is the scoreboard; the specific actions live in the client's Microsoft security center. Use the fleet view to prioritise which tenants to harden first.
What are Response Rules?
Operator-authored IF/THEN security automation (SOAR-lite). A rule watches CyberSentry's event stream and, when a sequence of conditions happens in order, runs one or more "effects" - lock the account, revoke sessions, open a ticket, notify. You build them as a map: WHEN these steps happen → THEN run these actions. Rules ship inert (Monitor + disabled) and only act when you deliberately arm them.
What is the "Confidence Engine" row at the top of this page?
It's the always-on detection spine, the "glass box." Every security signal is scored into a 0 to 100 confidence, and thresholds decide what that confidence fires. It sits ABOVE the hand-written response rules on purpose: it is the primary automatic detection, and the response rules below are specific IF/THEN overrides you author on top. On this page it appears as a single row, marked "Auto," with a Monitor on/off toggle - the toggle only ever arms Monitor, never Live. Open the row to reach the Confidence Engine page, where its two parts live under the "Auto Response Thresholds" section: Factor Weights (how a signal becomes a number) and Confidence Bands (what that number does). Arming it for real is a separate, deliberate "Promote to Live" step on that page.
What is the difference between Monitor and Live mode?
Monitor records what the rule WOULD do every time it matches, nothing is locked, revoked, or notified. It is a safe dry-run you can watch in the run history. Live actually runs the effects on real accounts. The rule's state is one three-way switch, Disabled / Monitor / Live: always start in Monitor, watch the run ledger (or use "Test against history"), and only switch to Live once you trust it. Switching to Live also asks you to confirm, because it then acts automatically.
What do the Disabled / Monitor / Live states mean?
Every response rule (and the automation as a whole) has three states. DISABLED - the rule does nothing; it does not even evaluate. MONITOR - the rule evaluates live and records what it WOULD have done in the run history, but never touches an account (a safe dry run). LIVE - the rule runs its actions for real: sessions revoked, accounts locked, tickets opened. Always ride a new rule in Monitor, watch the run ledger, and switch to Live deliberately - the page asks you to confirm because Live acts with no human approval.
How should I roll out thresholds safely?
Calibrate in Monitor, then arm. Leave new detection in Monitor and watch the run history / backtest against a client's real recent activity to see the blast radius and what the guards would block. Once the confidence math and bands behave the way you expect, promote to Live one step at a time. This "calibrate-in-monitor-then-arm" order is the whole point of the three states - you never guess in production.
What is Security Awareness?
The CyberSentry Security Awareness program for your clients' employees. It has three parts, shown as three tiles. Each tile shows a count and opens its page. Security Awareness Training is the annual course for each client. AI writes it in the client's regulatory language. It is assigned to everyone there, reminded, and recorded. It covers phishing, credential hygiene, data handling, device security and incident reporting, and ends with a quiz. Micro-Trainings are weekly. Each is a 2-minute read plus a short quiz for a client industry. They run alongside the annual course and are not part of the completion record. Training Records is the per-user completion evidence for the annual course. You hand it to an auditor or a cyber-insurance underwriter.
How do I turn the program on (or off)?
Security Awareness ships switched off. While it is off, nothing runs. No training gets written. No weekly Micro-Training is generated. Nobody is enrolled or reminded. Your clients see no Security Training page. This landing shows the "Turn on Security Awareness" wizard instead of the pillars - run it. The wizard explains how the program works. Then it walks you through three things: put Security awareness training on the service plans that should include it, since that decides who is in the program; set each client's Industry; and connect a training mailbox for assignment and reminder email. The last step flips the switch on. You can also flip it at Settings, then Security, then CyberSentry, if you need to turn the program off again. Turning it off stops all of the above, but it never deletes a completion record.
Which of my clients are in the awareness program?
The ones whose service plan includes it. Open Billing > Service Plans, open a plan, and turn on "Security awareness training" under Included functions: every client with an active subscription on that plan is then in scope. Coverage follows what the client bought, so it changes the day their plan does, and a client can be Managed without being in the program. While no plan carries it, nobody is in scope, and that is deliberate: the New Training picker lists no clients, the weekly micro-trainings generate nothing, and the daily sweep enrolls and reminds no one. Training Records is the one exception, and it is unscoped on purpose: a completion already written is historical evidence, so it stays on the record even if the client later drops the plan.
How is the content tailored to each client?
Two fields on the client's edit page (Clients > the client > Edit > Company Information): the billing Country, under Billing Address, and the Industry. Leave Country on 'Use instance default' and it follows your Default Client Country under Settings > Company > Company Profile, so an MSP whose clients are all in one country sets it once rather than per client. Country comes first, because it decides which body of law applies at all, and the industry then picks the frameworks within it. A US insurer maps to GLBA, the NAIC Model Law and HIPAA; a Canadian insurer maps to OSFI Guideline B-13 and PIPEDA; an Ontario clinic maps to PHIPA and PIPEDA. Every generated training is framed in that language and is explicitly told not to cite another country's statutes. A client with no country set gets vendor-neutral content (ISO 27001, SOC 2, NIST CSF) rather than American law, and a client with no industry set gets that country's general baseline.
What are Micro-Trainings and who sees them?
Every Monday the weekly job generates one short lesson plus a 1-2 question quiz per distinct client industry (and one generic set). Right now they are an internal surface - your team can read them and take the quiz here; a client-facing door is a planned follow-on. Generate This Week re-runs the job on demand; it is idempotent, so an existing week/industry is never regenerated.
What is this page, and how do I export it?
Every annual-training completion across all clients, newest first - the compliance artifact. The tiles count the whole table; the list shows the most recent 500. Use Export on the list to download the full set as CSV for an audit or insurance renewal. Records are kept even after a client is offboarded or deactivated - they are historical evidence.
Was this helpful?