Can I resell security monitoring to my clients?

Agencies and MSPs do exactly this, and the arrangement is scoped as a Custom Engagement rather than bought from the standard checkout:

• You hold the client relationship - billing, reporting and advice stay with you.
• Scope is agreed up front - how many domains and hosts, which categories, and whether you need white-label integration or API access.
• It suits a retainer - monitoring is continuous, so it fits alongside hosting or maintenance rather than being a one-off project.

Start with the number of client domains and hosts you would want covered; that is the first thing a Custom Engagement is scoped against.