Catalyst Citadel is a Managed Extended Detection and Response (MXDR) service with 24/7 SOC coverage, built on Google Security Operations. It is designed for organizations that need continuous security monitoring and incident response without maintaining an in-house SOC team. Citadel unifies SIEM, SOAR, and XDR capabilities into a single Google-native managed service. It ingests telemetry continuously via Bindplane and native Google sources, applies AI-driven detection and alert correlation, and uses automated response playbooks backed by named security analysts. The service incorporates Mandiant Threat Intelligence for forensic analysis, proactive threat hunting, and adversary-informed detections. Analysts provide SLA-backed containment and real-time tuning to reduce false positives and alert fatigue. Citadel is one module within Foresite's broader Catalyst platform, which also includes: - Bridge: Fully managed Google SecOps platform - Nexus: Automated compliance and GRC enforcement - Command: AI-driven threat intelligence and forensics - Adapt: AI security and model protection Key use cases include: scaling security operations without in-house staffing, reducing alert fatigue through machine learning-based correlation, and accelerating threat containment via real-time response workflows.