Managed detection and response (MDR) is an outsourced service that assists SOCs in monitoring and responding to cyber threats. Its core technologies are extended detection and response (XDR) and security information and event management (SIEM).
Responding to increasingly sophisticated cyber attacks requires both preventive measures and the ability to quickly identify and respond to threats after they occur. SOCs (Security Operation Centers) must enhance their ability to monitor networks, analyse logs, and swiftly address cyber attacks and incidents.
Since detecting and responding to cyber attacks requires specialised skills and 24/7/365 vigilance, many companies choose to outsource these services to security experts. This service is known as Managed Detection and Response (MDR).
MDR covers a range of areas. Some providers focus on monitoring known threats like malware or unauthorised access, while others address advanced, targeted attacks that exploit legitimate tools. By outsourcing detection and initial response, the organisation’s own staff can focus on higher-priority tasks, such as reviewing post-incident policies.
Managed security service (MSS) is often cited along with MDR. Looking at trends in the services offered by providers, MDR is often built with threat detection/response as the core of the service. MSS, on the other hand, often focuses on security product monitoring and hardware maintenance.
While most MDR services focus on EDR, there is another type of service called Managed NDR (MNDR), which has network detection and response (NDR) at its core. Compared to MDR, which often focuses on EDR, MNDR differs in that it detects and responds to threats based on telemetry and logs on the network.
Recently, MXDR (Managed XDR), which has XDR (Extend Detection and Response) as its core service, has also emerged. In the Detection and Response philosophy, the greater the sensor coverage, the richer the telemetry and the better the threat detection.