Detection engineered.
Response in minutes.
Our SOC ingests telemetry from your endpoints, identities, email, network, and cloud, correlates it against MITRE ATT&CK-mapped detections, and acts on confirmed threats with pre-authorised containment, around the clock, every day of the year.
Alerts are not the same as detection
Most breaches are not zero-days. They are a phished password, an MFA prompt approved at 2 a.m., a legitimate admin tool run from the wrong host, or a VPN appliance one patch behind. Every one of those produces a signal somewhere, in Entra ID sign-in logs, in EDR process telemetry, in firewall sessions, in a mailbox audit, but the signals live in different consoles, and nobody is paid to read all of them at once.
MDR is the discipline of collecting those signals in one place, correlating them, and putting a trained analyst and an authorised playbook behind every confirmed detection. The outcome you are buying is not a dashboard. It is a bounded blast radius.
How the detection pipeline works
Six stages, each with a defined owner and a defined output. Nothing depends on someone noticing a red light.
Collect
- Endpoint: EDR/XDR agents stream process, file, registry, network, and script telemetry (SentinelOne, Microsoft Defender for Endpoint).
- Identity: Entra ID sign-in and audit logs, risky-user signals, Conditional Access outcomes, privileged-role activations, on-premises Active Directory events.
- Email: Defender for Office 365 and Sophos detections, mailbox audit, forwarding rules, OAuth consents, delegate changes.
- Network: FortiGate, Palo Alto, and Cisco session logs, IPS events, DNS and web-filter logs via syslog and APIs.
- Cloud: Azure Activity Log, AWS CloudTrail and GuardDuty, Google Cloud Audit Logs, and audit trails from your critical SaaS.
- Collectors run inside your environment and forward over TLS to our pipeline. Nothing is read from portals or screenshots.
Normalise & enrich
- Events are parsed to a common model (host, user, process, source, destination, action), so detection logic is written once and runs across every vendor.
- Each event is enriched with asset criticality, user role, geo-IP, and threat intelligence: known-bad infrastructure, CISA Known Exploited Vulnerabilities, and our own incident history.
- Retention is tiered: hot search for investigations, compressed long-term storage for compliance. Default is 12 months; longer by agreement.
Detect
- EDR, Defender, and NGFW IPS detections are consumed as signals and correlated, not forwarded to you as-is.
- Our correlation rules are mapped to MITRE ATT&CK techniques: impossible travel followed by a new inbox rule; LSASS access on a server that has never seen it; a service account authenticating interactively; outbound traffic to a domain registered this week.
- Behavioural baselines per user and host flag deviations without a signature: new admin tooling, volume spikes in file-sharing or DNS traffic, first-seen external destinations.
- Detection content is version-controlled, tested against replayed attack data, and reviewed every quarter.
Triage
- An analyst validates every High and Critical detection against context: is the host a server, is the user privileged, is this change ticketed?
- Severity is assigned using a published matrix (impact × confidence × asset criticality), not a vendor colour.
- False positives feed back into tuning the same week. The target is that nothing you receive from us is noise.
Contain & respond
- Isolate the endpoint from the network while preserving our connection, kill the process tree, quarantine files, revoke the user's sessions and refresh tokens, disable the account, block the indicator at firewall and DNS.
- Authority levels are agreed at onboarding per asset class, for example automatic isolation of workstations, analyst-confirmed isolation of production servers, a phone call before touching domain controllers.
- You are notified on the channel you chose (phone for Critical, ticket and email for the rest), with what happened, what we did, and what we need from you.
Recover & improve
- Root-cause analysis within two business days of containment: initial access, lateral movement, data touched, and the control that should have stopped it.
- Hardening recommendations are tracked to closure, not left in a PDF.
- Monthly reporting covers detections by technique, mean time to acknowledge and contain, tuning changes, and open risk items. Quarterly reviews re-baseline coverage against ATT&CK.
What the service covers
One contract, one team, one playbook across every plane an attacker can use.
Endpoint detection & response
Managed EDR/XDR on workstations and servers (Windows, macOS, Linux). Policy tuning, exclusions governance, agent-health monitoring, and remote forensic collection (memory, triage packages) when needed.
Identity threat detection
Entra ID and Active Directory monitoring for credential abuse: password spray, MFA fatigue, token theft and replay, suspicious OAuth consents, privilege escalation, dormant-account reactivation, and Conditional Access bypass attempts.
Email & collaboration security
Business email compromise and phishing response: malicious-mail purge across all mailboxes, inbox-rule and forwarding audits, impersonation and lookalike-domain monitoring, Teams and SharePoint sharing anomalies.
Network detection
NGFW, IPS, DNS, and flow telemetry correlated with endpoint and identity events to catch lateral movement, command-and-control beaconing, and data staging that no single sensor sees.
Cloud & SaaS monitoring
Control-plane monitoring for Azure, AWS, and Google Cloud (new IAM principals, policy changes, public exposure of storage, unusual API activity), plus audit-log monitoring for the SaaS that holds your data.
Threat hunting
Hypothesis-driven hunts scheduled weekly and triggered by new intelligence: an exploited CVE in a product you run, a campaign targeting your sector, or a technique our detections do not yet cover.
Vulnerability intelligence
Exposure is prioritised by exploitation in the wild, not CVSS alone. Internet-facing assets are monitored continuously; KEV additions matching your inventory trigger same-day verification.
Dark web & credential exposure
Monitoring of breach dumps and criminal marketplaces for your domains, executives, and client-facing accounts, with forced resets and session revocation when a live credential appears.
Incident response & forensics
A declared incident gets a named incident commander, a bridge, evidence preservation, and a documented timeline suitable for insurers, regulators, and counsel. Breach-notification support under PIPEDA and BC PIPA.
How we onboard and run the service
Most MDR failures are onboarding failures: sensors half-deployed, logs never connected, nobody sure who may isolate what. We front-load that work.
- Asset and identity inventory: what exists, what matters, who owns it
- Telemetry gap analysis per plane
- Crown-jewel and critical-process mapping
- EDR agents, log collectors, API integrations
- Identity and email connectors, firewall syslog
- Verification that every source is actually arriving
- Learn normal for users, hosts, and traffic
- Suppress environment-specific noise
- Table-top the response playbooks with your team
- 24/7 triage and response to the severity model
- Weekly hunts, monthly reporting
- Quarterly coverage review against ATT&CK and new threats
Platforms we operate
We work with the tools you already own where they are fit for purpose, and bring our pipeline and detection content on top.
Severity model and response targets
Every detection is classified with the same matrix. The targets below are our standard; the figures that bind us are set in your service agreement.
| Severity | Examples | Acknowledge | Contain / act | How you hear |
|---|---|---|---|---|
| P1 Critical | Active ransomware, confirmed domain-admin compromise, data exfiltration in progress | Immediate | Automated isolation at once; analyst actions within minutes | Phone call + bridge |
| P2 High | Confirmed malware on an endpoint, compromised user account, phishing with credential entry | ≤ 15 min | ≤ 1 hour | Phone or ticket, your preference |
| P3 Medium | Suspicious but unconfirmed activity, policy violations, risky sign-ins with MFA satisfied | ≤ 1 hour | Same business day | Ticket + email |
| P4 Low | Informational findings, hygiene issues, blocked attempts | Next business day | Tracked in monthly report | Monthly report |
Response times for Critical and High detections are reported to you every month in your service report.
Where this lands in your compliance programme
MDR is the operational evidence behind the detect-and-respond controls auditors and insurers ask for.