What Managed Detection and Response Is
Written by MSP Outpost.
In Short
MDR and managed SOC services put a vendor's analysts to work watching your clients' endpoints, identity and cloud services around the clock, then investigating and responding when something looks wrong. You resell or bundle the service, so your clients get overnight cover without you hiring a night shift. It differs from a SIEM, which is software you run yourself, and from EDR alone, which raises alerts but needs someone to act on them.
What It Does
- Round-the-clock watching. Analysts review alerts at night and at weekends, when your own team is off.
- Triage. Sorts real threats from noise so your team sees a handful of cases, not a flood of alerts.
- Response. Isolates a machine, disables an account or blocks an address, within limits you agree in advance.
- Identity and cloud cover. Watches sign-ins, mailbox rules and cloud activity as well as endpoints.
- Investigation. Explains what happened, what was touched and what to do next, in terms you can pass to the client.
- Reporting. Gives you per-client summaries of what was seen and handled, ready for reviews and renewals.
- Threat hunting. Some services also search for signs of an attacker who has not set off an alert.
When You Need One
You cannot staff nights and weekends yourself, and this is the cheapest way to cover them. Pick a service that works with the endpoint tools you already run, so you are not redeploying everywhere.
Clients now have cloud services, remote staff and insurance questionnaires that ask who watches for attacks. Choose a service that covers identity and email as well as endpoints, and agree which actions the analysts take alone.
You may run some detection in house, but covering every night of the year is still the hard part. Decide clearly which alerts the vendor handles and which come back to you, and keep that split in writing.
How It Is Priced
Most vendors quote rather than publish a price. Services are usually priced per user or per endpoint each month, and some add a per-client minimum or a setup fee. Check whether incident response hours are included or billed on top, whether the price covers identity and cloud sources or only endpoints, and what the minimum term is.
Switching
Changing services usually means redeploying agents or reconnecting integrations at every client, and rebuilding the rules about who gets called and what the analysts may do alone. Case history and tuning rarely come with you, so ask what you can export. Settle the term and the notice period before you sign, since some contracts run for several years.
Questions to Ask a Vendor
- Which response actions will your analysts take without asking me, and which do they only recommend?
- Do I have to use your agent, or can you work with the endpoint tool I already run?
- Are the analysts watching my clients your own staff, or a subcontractor?
- How many cases per client per month should I expect to be handed to my team?
- What is included in the price, and at what point does incident response become billable?
- How do you reach me out of hours, and how quickly after you confirm a real threat?
- Which identity and cloud services do you watch, and are they in the base price?
- What reports can I give a client, and can I put my own name on them?