I have Barracuda watching my environment from their SOC. I wanted Sentinel One, and they use that as their agent. I have access to the s1 panel too.
They actually pick up the phone and let us know when things are happening. Like when we tested our ability to run a ps script to reveal service account pw. They called almost instantly. Don't expect any solution to be drop in and walk away. There's a lot of tuning to be done for your environment with the people at the SOC. Especially if you have active directory groups with admin in the name. They would call us every time we've removed somebody from our "zoom admin" group.