MDR: what Managed Detection and Response is

In short

Tools such as SIEM, EDR and XDR produce alerts. MDR is the human part that makes them useful: people who read the alerts, discard the false positives, work out what is happening and act. It is the practical answer for companies that cannot afford their own SOC.

How it works

An MDR service usually includes:

• monitoring of the alerts coming from the tools installed at the customer's premises;
• triage and investigation: classifying alerts by severity and checking what lies behind them;
• response: agreed containment actions (isolating a machine, blocking an account) and coordination of incident handling;
• threat hunting: proactive searching for threats that have not triggered any alert;
• reporting: what was seen, what was done, what to improve.

Compared with the traditional MSSP, which often limits itself to managing devices and forwarding alerts, MDR puts the emphasis on investigation and response.

Why it matters

Attacks do not keep office hours, and an alert nobody reads is of no use. Before choosing an MDR service, it is worth clarifying in writing:

• during which hours the service is staffed (business hours or 24 hours a day, 7 days a week) and how you reach the provider in an emergency;
• which actions the provider can take on its own and which need your approval;
• who leads incident handling and who communicates with the authorities, for example for the notifications required by NIS2 or for a data breach;
• which data sources are covered and how long the logs are retained.

Example

On a Saturday morning the agent on a server reports that an unknown administrator account has been created. The MDR team checks: no request from the IT department, and the login came from a foreign address through the VPN. Following agreed rules, it disables the account, alerts the company's contact person and opens incident handling, which continues on Monday with an analysis of how the VPN credentials were obtained.

In the monthly report the episode appears with the actions taken and the recommendations: turn on multi-factor authentication for the VPN and review the suppliers' accounts. This is how an MDR service, as well as reacting, helps reduce the likelihood of the same event happening again.

Related terms

• SOC
• CSIRT
• XDR
• Threat hunting