MDR

Managed Detection and Response (MDR) is a service that detects and actively contains threats. The focus is on endpoints and identities, often based on a specific EDR product.

How it works

The MDR provider monitors EDR telemetry around the clock. If it detects an attack, it isolates the device, terminates processes or locks accounts. Unlike pure monitoring, the work does not end with an Alert but with containment.

For example, an Office document starts an obfuscated script on a laptop. The MDR analyst sees the process chain and isolates the laptop. They then search for the same pattern on other devices. IT receives a handover with the affected systems and next steps.

What to look out for

• Scope of visibility: Many MDR services only monitor the EDR. Attacks via cloud accounts or the network can remain invisible.
• Vendor lock-in: Check if the service only works with a specific EDR product.
• Response permissions: Define in advance which actions are permitted without consultation.
• Business context: Does the provider understand your critical systems and processes?

How it differs from a SOC

A SOC as a Service usually covers more sources like network (NDR), identity and cloud, consolidated in the SIEM. MDR is often a component of this service. MDR can be sufficient for smaller environments. It is usually not enough for regulated organisations.

Questions to ask a provider

Ask the provider what specifically happens at three in the morning. Who assesses the Alert and who is authorised to isolate a device? Request an anonymised Case to see the process from Alert to handover. Also clarify whether the service includes threat hunting in addition to reacting to Alerts. A good MDR service also provides recommendations to prevent similar future incidents.

How we implement it

For us, Managed EDR is one component of the SOC, alongside SIEM, NDR and Identity. This allows analysts to view an attack across all sources within a single Case.