Detection Engineering and Security Operations
Managed Detection and Response (MDR)
We monitor your environment using your existing security stack, investigate suspicious activity and respond when necessary. Scope, hours and authority are clearly defined in the contract.
What it is
Managed Detection and Response (MDR) is the delivery of detection and response as a service by a specialist team. It does more than forward alerts; it investigates suspicious activity and determines its scope. In situations approved in advance, it applies containment steps such as isolating a device from the network.
Scope
- Monitoring and prioritizing alerts from EDR, SIEM and cloud sources
- Investigating suspicious activity and providing the finding to you with a recommendation
- Applying containment steps approved in advance
- Escalation to the incident response team when an incident grows
- Regular service report covering alerts, incidents and recommendations
The need
When organizations need it
- When building an in-house SOC team for continuous monitoring is not feasible or cost-effective.
- When your existing SOC team cannot cover after-hours periods or certain technologies.
- When early detection of a breach is important for your reporting obligations under data protection law.
Method
How we work
-
Onboarding
We define log sources, access rights and the contact chain with you.
-
Response authority
We document which steps we may take without waiting for approval and under which circumstances.
-
Monitoring and investigation
We monitor alerts during the contract-defined hours and investigate suspicious activity.
-
Reporting and improvement
We share trends in regular reports and provide rule and tuning recommendations based on recurring alerts.
Outcome
What you have at the end
Your environment is monitored under a service with written scope and authority. Suspicious activity is reported to you already investigated and, where necessary, contained.
Frequently asked questions
What are the monitoring hours?
Monitoring hours and response times are defined in the contract based on your risk profile.
Do we need to replace our existing EDR and SIEM products?
The service is primarily built on your existing stack. Which products are integrated is clarified during the scoping discussion.
How is your access to our systems restricted?
Access is limited to what the service requires and is provided through accounts you manage. All access is logged.
Detection Engineering and Security Operations
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting