Detection and response capabilities without building everything internally.
The MDR model supports the organization with analysts, procedures and tools dedicated to detection and response. It does not replace the role of IT or business leaders: it defines a shared model in which each escalation has an owner and an expected action.
Scopes of service
- onboarding and verification of telemetry sources;
- endpoint, identity, cloud, network and mail monitoring;
- triage and investigation of alerts with contextual enrichment;
- search for correlated indicators in the environment;
- pre-authorized recommendations or containment actions;
- escalation towards technical contacts, management or DFIR;
- periodic reports, service review and tuning.
Operational model
Coverage, severity, contacts, permissions, times and out-of-hours procedures are agreed before launch. High-impact actions, such as isolating systems or disabling critical accounts, require explicit rules to balance security and continuity.
Quality of service
NESQ measures availability of sources, quality of alerts, times, outcomes of escalations and improvements introduced. The service evolves with the environment: new applications, cloud changes, incidents and penetration tests fuel new use cases and fixes.