Features
Everything a security team watches, in one place.
Multi-tenant portfolio
One provider. Any number of partners. Every customer.
Model your real business. You sit at the top, resellers and regional partners sit under you, and their customers sit under them, as many levels deep as you need. Each partner sees only its own customers.
- List or cards. A compact list that stays readable with hundreds of customers, grouped by folder, partner, plan or risk.
- A risk score for every customer, so the riskiest customer is always first.
- Roles that follow the structure. Admin, analyst and viewer, granted at any level and inherited by everything below it.
Threats, ranked
What needs attention, in the order it needs it.
Kagemori reads incidents, alerts and failed sign-ins from Microsoft Defender and Entra ID every few minutes and ranks them. Response still happens in Defender, one click away, so nothing is duplicated and Microsoft stays the source of truth.
- Triage that the whole team can see. Mark items as acknowledged, investigating or closed, and the audit log records who did what.
- Password spray and brute-force detection from Entra sign-in failures.
- Devices explained. High-risk, inactive and unprotected machines, with their open alerts and vulnerabilities on one page.
- CRITNewIncident · Defender XDRRansomware behaviour detected on NW-FIN-LT0423 alerts · 1 device · opened 18 min ago
- HIGHInvestigatingSign-ins · Entra IDPassword spray against 14 accounts212 failures from 3 addresses in 30 minutes
- HIGHOpenDevice · Defender for EndpointNW-WH-PC07 not seen for 9 daysLast user: warehouse.kiosk · sensor inactive
- MEDOpenRecommendationTurn on attack surface reduction rulesAffects 38 devices · raises Secure Score by about 4 points
Example data.
Zero-days in the wild
Know within minutes when an actively exploited flaw is on a customer's devices.
Kagemori checks the vulnerabilities on every device against CISA's catalogue of Known Exploited Vulnerabilities and FIRST's exploit prediction scores. When a new match appears, it alerts once per customer and names the affected devices.
- Ransomware links highlighted where CISA has recorded ransomware use.
- CISA deadlines tracked, with an overdue badge after the remediation date.
- Telegram alerts to your SOC chat and, optionally, to the customer's own chat.
CVE-2023-36884Known ransomware useIn CISA KEVOffice and Windows HTML remote code execution. Exploited in targeted phishing campaigns.
Example data. The CVE is real; the devices are fictional.
Posture
Secure Score and exposure, over time
Microsoft Secure Score with industry and peer comparison, Defender exposure and configuration scores, and trends you can show in a quarterly review.
Alerts
Urgent alerts only, never twice
Telegram messages for what is genuinely urgent, with deduplication, an immediate update when severity rises, and reminders until the item is resolved in Defender.
Threat intelligence
What is happening in the wider world
A daily briefing from the Microsoft Security Blog, Microsoft's security update guide, SANS ISC, The Hacker News and Krebs on Security, next to the zero-days that affect your customers.
White-label
Your brand, or each partner's
Logo, accent colour and product name for every partner. Their customers see their brand on the console, in emails and on every PDF.
Licence-aware
Explains gaps instead of showing errors
If a customer lacks Defender for Endpoint, Defender XDR or Entra ID P1, Kagemori says which licence is missing and what it would unlock. That makes it a natural upsell conversation.
Accountability
Every action in the audit log
Sign-ins, changes, exports, reports and every alert message are recorded and attributed to an organisation, for your ISO 27001 or SOC 2 evidence.
Put a guardian on every tenant.
See Kagemori with your own Microsoft 365 tenant in a 30-minute demo. Connect a test tenant during the call and see real data before it ends.