WE OWN THE R IN MDR
The World's Most Complete Threat Response Capability
To build a more responsive security operation, you need more than just alerts. You need a partner who goes further to prevent your business from ever being disrupted. When it comes to response, it’s how we do it that makes all the difference.
As part of our Multi-Signal MDR service we ingest signal sources that drive data correlation, cyber threat analysis and kill switch response capabilities. When combined we deliver full attack surface visibility, deep investigation, threat detection, and complete response.
Response + Remediation You Can Trust
- Our Atlas Extended Detection and Response (XDR) Cloud Platform ingests over 20M signals per day, makes sense of the data and then automatically blocks over 3M threats per day based on IOCs and malicious IPs known to eSentire.
- We add over 400 indicators of compromise daily to our machine learning models based on original research, proactive threat hunting and threat intelligence driven across our global customer base.
- When an automated response isn’t possible our 24/7 SOC and Elite Threat Hunters will perform rapid investigations and initiate response measures on your behalf. These are documented, pre-approved and customizable.
- Standard response procedures include:
- Preventing infected endpoints from spreading to other machines.
- Isolating ransomware, data exfiltration and hands-on keyboard attackers.
- Quarantining malicious files and terminating processes.
- Stopping/removing service and registry keys.
- Preventing compromised email accounts from forwarding compromised communications.
- Phishing attempts reported, investigated and remediated.
- Facilitated organizational retroactive email purges.
- Account and access suspension to stop compromised users from corrupting data or applications.
- Correcting critical misconfigurations across your multi-cloud environments.
- Preventing any devices on the network from communicating with known bad actors based on eSentire Threat Intelligence.
- Tactically disrupting network connections involved in investigations or incidents.
eSentire MDR goes beyond alerting and host isolation to deliver complete and robust response. We delve deep into the incident response life cycle, eradicating threats, and remediating security incidents as part of our standard multi-signal MDR service.
In the event that digital forensics evidence, litigation testimony or crime scene reconstruction is required, our Cyber Investigations team can provide complete Digital Forensics and Incident Response support capable of bearing scrutiny in a court of law.
How to Spot MDR Fact vs Fiction
With hundreds of Managed Detection and Response (MDR) service providers and every company saying the same thing when it comes to “Response”, you need to learn how to separate MDR fact from fiction to select the right MDR provider to secure your business.
Real MDR addresses five measurable components of your protection:
- Threat Intelligence - How is my organization keeping up with the evolving threat landscape?
- Visibility - How is my organization accounting for sensitive data and potential blind spots?
- Automation - How many threats am I able to automatically block?
- Human-led Threat Detection, Response, and Remediation - How fast is my organization able to investigate, respond, and remediate identified threats?
- Risk reduction over time - How is my provider leveraging data and lessons learned from ongoing MDR operations to reduce my risk over time?
Not All MDR Is Created Equal
How supported do you want to be across the Response spectrum?
Included Response and Remediation Actions
Why XDR Matters
The Atlas XDR Cloud Platform makes eSentire MDR possible. Patented machine learning and proprietary threat content from our Threat Response Unit (TRU) eliminates noise, enabling real-time detection & response, and automatically blocking over 3M threats per day.
Our XDR platform is capable of answering questions like:
- Which of these pieces of information are relevant?
- Which of these events are related?
- Which activities are obviously, clearly and demonstrably malicious?
- When is it appropriate to initiate an automated response workflow?
- What requires further analysis and human attention?
- How many IT assets do I have, where are they, and how has that number changed over time?
- Which of my assets might be the target of a cyberattack in the future?
- How does my external risk compare to my industry peers?
When there are very high-confidence answers to all of these questions, eSentire threat response can be fully automated. This entirely removes human effort from the process.
In cases where there’s some ambiguity and human intuition is required, the platform gives our 24/7 SOC Analysts and Elite Threat Hunters in-depth information that makes their jobs easier. It also allows them to be more creative, have more confidence in their effectiveness, and stop more threats.