MKCS SIEM
Azure-first security operations

Your cloud.
Your security team.
One clear workspace.

Connect supported Azure Activity sources, explore recorded evidence and coordinate investigations in your organization’s own security workspace.

Open secure workspace → Explore cloud coverage
Tenant-scoped workspaces Separate enterprise identities Controlled security operations
MKCS SECURITY OPERATIONS RELEASE CANDIDATE — No tenant health claims
Security Operations.
Unified. An enterprise workspace for controlled cloud onboarding, evidence review, and guided security investigations.
Azure ActivityControlled validationConsent-led Event Hubs connections
AWSIntegration plannedFuture security-source onboarding
Google CloudIntegration plannedFuture security-source onboarding
Customer SOCAnalyst-guidedEvents, signals, incidents and team follow-up

This public overview describes platform development—not a live connection dashboard. Source health is customer-specific and must be checked after authenticated access. Review-signal processing requires an authorized source and enabled policy; automated containment and external notifications are not provided.

ONE CLIENT CENTER / TWO CONNECTION PATHS

Bring your resources.
Keep control of every decision.

01

Connect what you have

Select a compatible existing Event Hub. Review the receiver and network changes before authorizing the connection.

Connect an existing resource →
02

Prepare a dedicated stream

Review the proposed Azure Activity export and dedicated resources. MKCS performs the authorized setup after platform prerequisites pass.

Review managed setup →
AuthorizeObserveInvestigateCollaborate

Azure authorization is separate from your workspace sign-in. Supported connector: subscription Administrative Activity Logs. Entra, Defender, Log Analytics and Storage ingestion are not available in this release.

Microsoft AzureAdministrative Activity LogsAuthorized setup required
Amazon Web ServicesCloud source integrationPlanned · Not available
Google CloudCloud source integrationPlanned · Not available
On-PremisesCustomer infrastructureFuture · Not available
Evidence before assurance.

Customer-owned investigations, a personal in-app SOC inbox and explicit collection observations. Supported Azure Activity sources only. External paging, automatic containment and full-spectrum coverage are not included.