What is MDR?
Managed detection and response (MDR) is a security service, not a piece of software. An MDR provider supplies people, process and usually technology: analysts who watch an organization's security alerts around the clock, investigate them, hunt for threats and take or direct response actions. The provider typically deploys or connects to EDR or XDR tools in the customer's environment and runs them from its own security operations center (SOC).
Organizations buy MDR because staffing a 24/7 security team is expensive and the skills are hard to hire. Attacks such as ransomware often run overnight or on weekends, when an internal IT team is not watching.
What an MDR service usually includes
- Continuous monitoring of alerts from endpoint, network, email, cloud or identity tools.
- Triage: separating real threats from false positives so the customer is not flooded with noise.
- Investigation: working out what happened, which accounts and devices are affected and how the attacker got in.
- Threat hunting: searching the collected data for attacker activity that did not trigger an alert.
- Response: pre-approved actions such as isolating a host, killing a process, disabling a user account or blocking a file, plus guidance for the customer's team on cleanup and recovery.
- Reporting: incident summaries and recommendations to reduce future risk.
What to agree on with a provider
An MDR contract should state which actions the provider may take on its own and which need the customer's approval, how quickly it must respond (often written into an SLA), whom it contacts after hours and how it escalates. Traditional managed security services often focus on monitoring and forwarding alerts to the customer; MDR is defined by also taking or directing the response.
MDR compared with EDR, XDR, SIEM and a SOC
| Term | What it is |
|---|---|
| EDR | A tool: agents on endpoints that record, detect and respond |
| XDR | A platform: detection and response across endpoints, email, network, cloud and identity |
| SIEM | A tool: central log collection and correlation from many sources |
| SOC | A team and facility that performs security monitoring, either in-house or outsourced |
| MDR | A service: an outside SOC that runs detection and response for you |
How MDR affects the help desk
When an MDR provider isolates a laptop or disables an account in the middle of the night, the internal IT team handles the follow-up the next morning: contacting the user, cleaning or reimaging the device, resetting credentials and restoring access once the provider confirms the threat is contained. Technicians should know the provider's contact process and should not reconnect an isolated device or re-enable a disabled account without coordinating with the security team.
MDR on the CompTIA A+ exam
MDR is on the shared A+ acronym list and is mainly Core 2 security material. The key distinction is product versus service.
- If a small company with no security staff hires an outside firm to monitor and respond to threats 24/7, think MDR.
- If the answer choice is software installed on each PC, that is EDR, not MDR.
- EDR, XDR and MDR all detect and respond. The first letter tells you the focus: the endpoint, an extended set of sources, or a managed service.