Managed Detection and Response: Finding the right balance for your business

In addition, there is SOAR for automatic responses and the newest member, XDR, which uses AI to detect and address threats.

Each of these technologies has its benefits but also requires an investment of time and effort to truly excel. Even when purchased as part of a service, you will still need to invest time with your provider to optimize threat detection and develop real-world scenarios tailored to your business.

Our recent research report Security Navigator 2024 provides an overview of how MDR helps you achieve your business goals and how quickly you can see results.

Find the right balance

To fully benefit from the power of MDR, the right setup is required. EDR requires a small piece of software to be installed on each device. This can be either simple or challenging depending on your IT situation. And you need to coordinate this with your privacy team and works council because you are monitoring devices. NDR needs to be physically installed and connected to network hardware, which can be complicated if your network is a maze of segments and switches.

Then there is SIEM, which requires your log files, but choosing which ones and ensuring they contain the right information is crucial. What do you want to watch for? Despite SIEM's experience in this area, older is not always better to start with. Be aware that SIEM solutions, such as Microsoft Azure Sentinel, often charge based on the amount of ingested log data, which can vary and potentially lead to unexpected, and sometimes high, costs.

Each of these technologies comes with default scenarios they are looking for, such as when your email server starts communicating with an online file-sharing service - that usually is not part of its duties. So, you get an alert, and then it's up to you to determine if it's a real problem or just a false alarm. Maybe your IT staff does indeed download files from the cloud once a month - that's normal for you, so no alarm. And if it's just someone from marketing downloading ad designs, then it's a false alarm. This is what we call "tuning" - adjusting the system to know what is normal for you.

Monitoring is also personal. Suppose you don't want outsiders to have direct access to your network but always have to go through a secure checkpoint. Your MDR service can then set up special rules to catch any violators. These special rules (use cases) will need to be created.

Dealing with alerts

In Security Navigator 2024, we analyzed large amounts of data to see how many alerts were actual incidents compared to false alarms. You want to keep the number of false alarms low because they are time wasters. It turns out that EDR is usually accurate and provides more precise alerts than the rest.

When it comes to your applications and network equipment, things are not so uniform. Your MDR may then be inundated with false alarms if it is monitoring those. And if your IT environment is constantly changing, your custom scenarios will require constant updates - that's a lot of work on your part.

You don't want to just hand over your SIEM to an MDR service and leave it at that. You'll need to roll up your sleeves and get involved, especially if your company is serious about cybersecurity, has a stable environment, and you have the time to collaborate with your managed security service provider.

Starting with EDR is less cumbersome. It requires fewer adjustments because operating systems like Windows, MacOS, and Linux are more standardized. You can further reduce the number of false alarms by deploying XDR with its AI intelligence. And if you combine EDR with NDR, even better!

Responding to alerts is another story. That's where SOAR comes in with its playbooks. These are like the manuals that precisely describe how to handle each type of alert. Again, this is entirely customized and dependent on how your business operates.

XDR and some EDR solutions that offer AI-driven responses introduce some ambiguity. Even with extensive testing, allowing AI to make important decisions, such as disabling a system, is something many are cautious about.

Conclusion

In summary, it's a good idea to start with EDR when you're new to MDR. Add XDR and AI to learn how to handle alerts. Bring in NDR later if you have devices where an agent cannot be installed. As you get better at this, add SIEM and SOAR.

Your ideal provider of Managed Detection and Response should be a guide that helps you grow in security. But also, a business partner that helps you accelerate digitally with confidence. Feel free to call us or send a message to create a roadmap together for MDR technology and services that align with your current and future organization.