What is managed detection and response?

Gartner defines managed detection and response (MDR) services as those that provide customers with remotely delivered security operations center (SOC) functions. These functions allow organizations to perform rapid detection, analysis, investigation and response through threat disruption and containment. They offer a turnkey experience, using a predefined technology stack that commonly covers endpoints, networks, logs and cloud. Telemetry is analyzed within a provider’s platform using a range of techniques. The MDR provider’s analyst team then performs threat hunting and incident management to deliver recommended actions to its clients.

The mandatory features for this market include:

• A remotely delivered, provider-hosted and provider-operated shared technology stack that enables and coordinates real-time threat detection, investigation and active mitigating response. This technology stack can be developed by the MDR provider, or it can consist of an integrated set of commercial technologies that use modern techniques (like APIs) to exchange data and instructions. This capability can also be achieved through a combination of both approaches.

• 24/7 staffing that recognizes customer-specific cyber-risk-based use cases, engages daily with individual customer data, and has skills and expertise in threat monitoring, detection and hunting, threat intelligence (TI) and remote response.

• The availability of immediate remote mitigative response, investigation and containment activities (such as quarantining hosts), beyond alerting and notification, delivered and coordinated by service providers’ staff and preapproved by end users.

 

The common features for this market include:

• Telemetry coverage of identity and email/collaboration tools, as well as Internet of Things (IoT) and operational technology (OT) device monitoring, cloud services, particularly SaaS, and identity data from an array of common identity and access management (IAM) providers.

• Turnkey delivery, with predefined and pretuned processes and regularly evolving detection content. It includes a standard playbook of workflows, procedures and analytics; requires a minimum viable set of telemetry to deliver services; and offers integration with third-party detection and response technologies beyond provider-owned technologies.

• Additional contextual data sources providing details of security exposures such as vulnerabilities, attack surface visibility, and brand and reputational analysis, as well as security assessment and validation capabilities, such as breach and attack simulation (BAS), which analyze the efficacy of security controls and response processes, and provide clients with guidance on how to improve their defensive posture and remediate misconfigured security controls. 

• Digital forensics and incident response (DFIR) retainer capabilities offering call-off remote or deployable staff to carry out deep dive incident and root cause analysis.

• Incident management capabilities that track, measure and suggest improvements and automation opportunities for the remediation actions involved in response workflows.

• Hypothesis-driven threat hunting, where clients are able to identify specific threat hunt targets to determine if a threat actor was to blame. The focus would be on users of interest or where privileged data is known to have entered public circulation. This capability is different from threat hunting, which is included as part of MDR and hunts for known threat techniques.

• Triaging, investigating and managing responses to all discovered threats, regardless of priority and the provision of “incident tickets” that include likely objectives of attacks, degrees of success, impact on the business and remedial actions that the client must take. There must be no limitations on volumes or time dedicated to the discovery and investigation process.