What is it all about?
MDR (Managed Detection & Response) is a cybersecurity service that combines advanced technology with human expertise to help organizations:
Continuously detect threats across endpoints and identities.
Investigate and triage alerts to separate real attacks from noise and false positives.
Respond to incidents in real time, containing or remediating them before damage spreads.
Provide 24/7 monitoring, so organizations aren’t left exposed outside of business hours.
Please note:
MDR is only available for customers on the Ultimate plan.
MDR service models
Guardz provides MDR services that can be delivered in two primary models. Both models are powered by the same dedicated SOC team, ensuring consistent monitoring, triage, and incident handling.
1. MDR as Part of the SentinelOne Managed Package
Customers purchase and deploy SentinelOne agents directly through Guardz.
Once deployed, the Guardz SOC team provides continuous monitoring of all endpoint activity and security alerts.
Any suspicious activity or confirmed incidents are investigated and handled directly by the MDR team as part of the managed service.
2. MDR on Top of ITDR
In this setup, the SOC team monitors incidents detected by Guardz ITDR services
The MDR team performs full incident response, investigation, and escalation as needed, ensuring security incidents are actively managed rather than left unattended.
Activating the Service
Customers don’t need to take any special action to enable MDR. As soon as they purchase the Ultimate plan and have either SentinelOne agents deployed or the Response ITDR app installed, the service is activated automatically. The only requirement is to provide basic policy preferences and contact details, which allow the Guardz SOC team to tailor responses and escalation paths to the organization’s needs.
Policies Configuration
1. Provide emergency contact information:
Go to the ‘Security Controls’ tab and open the ‘MDR’ section
Click on the edit button under the ‘Emergency Contact & Preferences’ section and provide the relevant information
Click ‘Save Globally’
To change the settings for a specific customer, select the relevant tenant and override the global information by entering different contact details at the customer level
2. Set the preferred emergency approval process (managed by the MDR team)
Admins are required to provide the MDR team with their preferred method of response once an incident or issue is detected:
Take action immediately
Wait for admin approval
Go to the ‘Security Controls’ tab and open the ‘MDR’ section
Click on the edit button under the ‘Emergency Contact & Preferences’ section and provide
Select your preferences