Why it matters
Few organisations can staff skilled analysts 24 hours a day. MDR closes that gap, but only works if responsibilities between provider and client are clear.
What to get right
- Agree exactly which actions the provider may take on its own, such as isolating a device.
- Define escalation contacts and response times for nights and weekends.
- Make sure the telemetry you send covers identity, endpoints and cloud, not just the network.
- Measure the provider on time to detect and contain, not on alert volumes.
Common questions
Is MDR the same as a SIEM?
No. A SIEM is a platform that collects and correlates security logs. MDR is a service delivered by people, which may use a SIEM or other tools.
Can MDR help with CERT-In's six-hour reporting?
It can speed up detection and investigation, but the duty to report stays with your organisation. Plan who files the report.