With eSentire MDR you get SOC-as-a-Service that provides the 24/7 coverage you need to investigate and respond to threats before they impact your business. Our 24/7 Security Operations Center (SOC) Cyber Analysts are an extension of your team and will pick up the phone to provide immediate expertise, peace of mind, and hands-on assistance to remediate threats on your behalf when and where you need it.

Detect

A SOC Analyst receives an XDR-enriched output and cross-references detection and signal properties for event validation. They conduct a comprehensive review of the metadata, including endpoint processes, file downloads, and network traffic summaries related to the event.

Next, they conduct a preliminary investigation, including the reputation check of the involved public IP. They use various tools to establish data points and assess the domains leveraging the IP for hosting purposes.

Evaluate

The SOC Analyst then examines business-specific information (e.g., work-flow handling notations, IP notations, and common knowledge notes) to determine if there are any considerations that could influence how the investigation should be handled.

Investigate

The SOC Analyst will investigate to determine if the detection triggered was rule noise, a malicious attack, a suspicious incident, or initiated by a benign actor. The success of the attack is determined based on:

• IOCs and/or IOAs for the intrusion
• Details of the intrusion
• Level of access the attacker achieved
• Related malicious activity
• Indications of lateral movement

Inform, Respond & Remediate

The SOC Analyst will determine if the incident requires customer notification, complying with the documented escalation and containment procedures for email and phone call communication. Simultaneously, our SOC team will isolate and contain the threat, and initiate threat response measures, which align with our response processes based on signal type and customer preference.

If the SOC Analyst determines there is a hands-on-keyboard attacker or ransomware attack unfolding, the analyst will engage our Incident Handling Team that is on staff for every shift. They will take command of the incident at that point, and they become the main point of contact for the customer. Our Incident Handling Team will also work cross-functionally with eSentire’s Threat Response Unit to scope the intrusion, identify threat actor activity in the environment and to ensure full remediation.

Continuously Improve

Our SOC team collaboratively enhances your overall security posture over time and becomes an extension of your security team. We leverage insights gained from each investigation in our SOC, providing ongoing improvements in your MDR service to bolster your organization's cyber resilience.