Managed Detection and Response (MDR) Buyer’s Guide

The answer will provide essential clues about the depth of the provider’s detection and response capabilities. MSSP and product vendors are likely to focus only on a limited set of telemetry, impairing their ability to trace a kill chain. In contrast, experienced MDR providers routinely monitor telemetry and alerts across the digital estate, including endpoints, networks, cloud systems, and Software-as-a-Service (SaaS) using a unified threat management platform.

An MDR platform should integrate seamlessly with your existing technology stack (SIEM, EDR, NDR, Cloud, etc.). MDR providers should preserve the value of your current security investments where possible while providing the flexibility to incorporate new tools and technologies as your business and IT infrastructure evolve.

Distinguishing whether an MDR provider will only go as far as containment rather than removing malware and understanding the root cause could make or break your business.

Under what circumstances will your MDR candidate take responsibility for actively containing and remediating an incident, or will they merely offer recommendations for you to implement? 

Critical response time can be squandered if solely you are responsible for executing and validating containment recommendations. Importantly, how does the provider support incidents that may involve unusual issues such as insider threats or mobile devices? Can the provider provide on-site or laboratory services for physical devices?

Equally, if the provider is sub-contracting incident response to a third-party supplier, what level of business understanding, communication and timing should be expected? Consider eliminating providers that only offer minimum response and focus on those who will go beyond containment to understand the root-cause and remediate the threat.

Today, many traditional providers rely on the default detection rulesets included by their preferred EDR and SIEM product vendors. Some make minor modifications to those rulesets in response to new threat advisories. 

Look for information around how the provider uses the MITRE ATT&CK framework and threat intelligence to tune these rules. Some will say they use this internally, but more proficient providers can provide you with a live mapping of your MITRE ATT&CK coverage to help you understand the scope of their services and demonstrate they are on top of your unique threat profile. 

A Real-Life Example 

Kroll has developed an agile process for continuously developing and tuning detection rulesets based on the latest threat intelligence. For example, on December 10, 2021, a critical vulnerability was discovered in a widely used Apache Log4j Java logging library that hackers could exploit to compromise tens of thousands of systems worldwide. That same day, the Kroll Applied Intelligence team notified clients of the vulnerability and provided recommendations to patch and ensure detection coverage. Shortly after, they had created 60 custom detection rules to ameliorate the threat for customers. 

You should be able to lean on your MDR provider for ongoing insight into the latest threats that may impact your business, while also turning this intelligence into active detection, hunting and response efforts. 

Threat intelligence needs to be wide enough as it is deep; wide enough to include a variety of organic, open-source, and proprietary sources but deep enough to identify not just known attacker indicators such as an IP address, internet domain, or file hash – referred to as Indicators of Compromise (IOC’s), but actual methods and behaviors used by attackers – known as Tactics, Techniques and Protocols (TTPs). This kind of intelligence requires access to dark web forums, live incident response and forensic analysis, and exposure to both cybercriminal and nation-state level activity.

Key to this is ensuring the MDR provider has an adversary-driven mindset, or has teams beyond their core SOC that are engaging with live attacker campaigns and using this information to frequently update detections. This requires tight integration between threat intelligence analysts, malware analysts and detection engineers. 

Many MDR services equate threat hunting with the reactive process of investigating high-risk alerts and incidents. In contrast, proactive threat hunting is a cyclical, hypothesis-driven process that assumes an undiscovered breach of an unknown type has already occurred. Threat hunters possess the experience and adversary mindset to ensure malicious activity and advanced persistent threats are surfaced, traced, and remediated efficiently. As noted in NIST Special Publication 800-53, public and private sector organizations should view proactive threat hunting as an “enhanced security requirement.” 

Ask your provider about the difference between ongoing threat monitoring across all of its customers and proactive, bespoke threat hunting tailored to your organization.

Your MDR partner should be providing you with a nominated team, acting as the point of contact for both strategic security advice and service-related queries. This will enable you to stay informed about the overall service quality as well as the provider’s view of your security posture. MDR providers should offer a service portal that acts as a unified view of alerts and incident activity across your digital estate, along with self-service features for tracking service requests, KPI-driven reporting and defined response playbooks.