In your SOC
Partner-operated
Host Fusion XDR in your own SOC and deliver it as a managed service.
Fusion XDR for partners: architecture, modules and deployment
An overview for partners evaluating Fusion XDR, the sovereign AI XDR and SIEM platform developed by AI MSP 365. Buying for your own organisation? See the Fusion XDR platform at AI MSP 365.
Ways to deploy for your customers
At the customer
On-premise
Install the full platform and private AI in the customer's data centre, operated by them or by you.
Isolated networks
Air-gapped
Offline installation and updates for classified and CNII environments. Internet-facing modules stay switched off.
How data moves through Fusion XDR
Four stages, one case record. Nothing leaves the deployment boundary unless an outside-in module is enabled.
- 01 · Collect
Sensors & intelligence
Agents, network sensors, edge and WAF logs, plus optional outside-in feeds.
- 02 · Correlate
Fusion XDR / SIEM core
Events are normalised, enriched with MITRE ATT&CK context and joined into cases.
- 03 · Decide
Private AI + analyst
Cases are ranked by risk; the AI drafts triage, and an analyst or playbook decides.
- 04 · Respond
Contain & record
Automated or approved actions, with every step written to the case timeline.
Fusion XDR module overview
| Module | Collects | Produces | Air-gapped |
|---|---|---|---|
| Fusion XDR / SIEM | Events from every module and supported log sources | Correlated cases, hunts, dashboards and reports | Yes |
| Fusion Agent | Windows and Linux host, OS and database logs | Host detections, integrity and configuration events | Yes |
| Fusion NTA | Network traffic in IT and OT/IoT segments | Anomaly and lateral-movement detections | Yes |
| Defender Edge | Inline perimeter traffic | Filtering, access enforcement and block actions | Yes |
| Web Application Firewall | HTTP(S) requests to protected applications | OWASP Top 10 and bot blocking, access logs | Yes |
| Exposure Management | Your customers' public domains and IP ranges | Asset inventory, exposure findings, risk ranking | Needs internet |
| Dark Web & Credential Monitoring | Your customers' domains and brand terms | Leaked-credential and data-leak alerts | Needs internet |
| Vulnerability Assessment | Web and network targets the customer approves | Prioritised vulnerability reports | Yes |
| SafeChecks | Host configuration | Misconfiguration and hardening findings | Yes |
Response actions
- Block attacker IPs at the firewall or Defender Edge
- Isolate a compromised host
- Quarantine malicious files
- Open, assign and close cases with a full evidence timeline
Framework mapping
- Cyber Security Act 2024 (Act 854)
- NACSA CNII codes
- ISO/IEC 27001
- PDPA 2010
- BNM RMiT
- MITRE ATT&CK
Questions from partners
Who develops Fusion XDR?
Fusion XDR is developed by AI MSP 365 Sdn Bhd in Malaysia. AmplifySec works with the partners who resell, operate or white-label it.
Does Fusion XDR need an internet connection?
No. The core platform and its private AI run fully offline, including on air-gapped networks. Exposure management and dark-web monitoring need outbound access and can be left disabled.
Where does the AI model run?
Inside the deployment boundary, on hardware that you or your customer control. Telemetry and evidence are never sent to a public AI service.
Can I sell Fusion XDR under my own brand?
White-label and OEM arrangements are available to qualified partners. Contact us for partnership and tell us how you want to deliver it.
Which compliance frameworks does Fusion XDR map to?
Detections carry MITRE ATT&CK context, and evidence maps to Malaysia's Cyber Security Act 2024 (Act 854), the NACSA CNII codes of practice, ISO/IEC 27001, PDPA 2010 and BNM RMiT.
Evaluate Fusion XDR with your team
Contact us for partnership to arrange a technical briefing for your team.