Managed detection and response: someone answers the 3am alert

Managed detection and response services (MDR) combine three things that are only worth anything together: telemetry from your endpoints and your cloud tenant, analysts working it around the clock, and the authority to act on what they find without waiting for business hours. It is the human layer of our managed cybersecurity and compliance stack: the layer that decides what every other layer’s alerts actually mean.

On the plans that include it — Advanced and up — that means:

• Real-time threat detection, triage and response, with a severity call made on every alert instead of a notification forwarded to you.
• Continuous monitoring of company systems, user accounts and sign-in behavior, in the cloud and on premises.
• EDR telemetry from managed endpoints, read alongside Microsoft 365 and directory activity so an alert arrives with context already attached.
• A phone call to your named escalation contacts once a threat is detected and confirmed, at whatever hour that happens.
• Containment on the spot: account locks, device isolation or shutdown, and threat quarantine.

Detection, triage, response: what happens at each step

Detection is the part software is good at. Agents on endpoints, sign-in logs in your tenant and mail flow events all produce signals, and the volume is the point. A few hundred devices generate more events in a day than any person could read.

Triage is where the value sits. Most of what looks alarming is not: an admin tool run by an admin, a login from a hotel, a script a vendor scheduled months ago. Most of what matters looks ordinary: a valid credential used at an odd hour from an unfamiliar network, a scheduled task that appeared overnight, a service account doing something it has never done. Telling one from the other is a judgment call made against context, not a rule you can write once.

Response is where security programs stall. Knowing an account is compromised at 2:14am is worth very little if the first action happens at 8:30am, so the response authority gets agreed before anything happens: which accounts can be locked without a phone call first, which devices can be pulled off the network, and who gets called regardless of the hour.

What around-the-clock actually takes

Continuous coverage is a staffing problem before it is a technology problem. One person covering nights and weekends is not coverage, it is one person’s sleep schedule with a pager attached. Coverage means a shift rotation, written playbooks so two analysts reach the same decision on the same alert, and an escalation path that ends with a human who answers.

That is the piece a company your size cannot reasonably build. The platform is buyable. Three shifts of trained analysts, retained and drilled, is not, and the attempt usually settles into alerts landing in a mailbox that gets read on Monday.

Managed against doing it in-house

Doing this yourself means buying the platform, tuning it and staffing it. The platform is the cheapest of the three. Tuning takes months of feeding false positives back in before the alerts are worth trusting, and staffing runs into the arithmetic above.

Managed means you inherit tuning that has already been done at platform scale, you get the shift rotation without hiring for it, and the response authority is written into the engagement instead of improvised during an incident. What you give up is direct console ownership, so settle the visibility question before you sign: agree what you get told after an event, and who tells you.

How we deliver it today

Detection and response runs on Blackpoint Cyber SNAP, with the vendor’s own staffed 24/7 SOC behind it. It is the “fully managed security operations center” line on our plan chart, included on UCONNECT Advanced plans and up.

In practice that means the containment action and the call to your named escalation contacts happen in the same few minutes, not the next morning.

Once things are stable you get it in writing: what was seen, what was concluded, and what was done.

Detection and response is the layer that reads what the others produce. Endpoint protection and EDR generates most of that telemetry and stops on its own what it recognizes, SIEM and security monitoring is where log data gets collected and retained for the environments that need it, and incident response and disaster recovery planning is the plan the SOC’s actions plug into once an incident is confirmed.

What a live detection looks like from your side, from the first call to the containment steps that follow it, is documented for clients in our managed detection and response guide.