Also known as: MDR
A security service in which an outside team monitors detections, investigates activity, and performs or coordinates agreed response work for the customer.
Managed detection and response is an ongoing service rather than only a software product. The provider monitors security signals, investigates suspicious activity, communicates findings, and performs or coordinates response according to the contract.
MDR scope varies. Buyers should confirm coverage hours, data sources, response authority, escalation, tuning, reporting, incident support, and the work that remains with the internal team.
MDR may use a SIEM, XDR, EDR, or several platforms underneath. The service responsibility is the defining feature.