Does this service require an M365 E5 licence?
No. The platform does not require E5, but it works best with it. E5 includes the Defender product suite that feeds the highest-value signals into the SIEM. On E3, the platform can be added as a standalone Azure service — however, some connector scope is narrower and additional Defender add-ons may be needed. IT Partner assesses your current licensing during scoping and recommends the most cost-effective path.