> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/detect-and-respond/managed-detection-and-response-mdr.md).
# Managed Detection and Response (MDR)
*Round-the-clock protection, without running it yourself*
Managed Detection and Response (MDR) is the CybaVerse service that monitors your organisation 24 hours a day, investigates anything suspicious and acts to stop real attacks. You get continuous detection and response without having to build or run it yourself, and you can see everything that happens in CybaOps.
***
## Why It Matters
Attackers don't work office hours. Many attacks start at night, at weekends or over bank holidays. Every hour an attacker goes unnoticed gives them more time to steal data, move to other systems or launch ransomware.
Security tools on their own produce more alerts than most organisations can review. MDR deals with both problems. Real threats are found and contained quickly, the noise is filtered out before it reaches you, and you are only contacted when a decision from you is genuinely needed.
***
## 24/7 Monitoring
CybaVerse MDR monitors the security signals from your devices, user accounts, cloud services and the security tools you have connected, every hour of every day. That includes suspicious behaviour on devices, unusual sign-ins, attempts to gain extra access and known attacker techniques. When something looks wrong, it is investigated and a response is decided. Critical incidents are prioritised above everything else and escalated to you by phone.
To check that the right data is arriving, see [Monitoring and Data Health](/detect-and-respond/managed-detection-and-response-mdr/monitoring-and-data-health.md).
***
## From Alert to Resolution
Every potential threat follows the same clear path, so nothing is missed and everything is recorded.
{% stepper %}
{% step %}
### Detection
Your devices and connected tools generate security events all the time. CybaOps checks them against detection rules and raises an alert when something matches a known threat or looks out of place.
{% endstep %}
{% step %}
### Correlation and triage
Related alerts are grouped together, so one attack becomes one piece of work rather than dozens of separate alerts. CybaVerse MDR reviews it, gathers context and decides whether it's a real threat or a false alarm.
{% endstep %}
{% step %}
### Incident
If the threat is real, it becomes an incident with a severity, the evidence attached and a timeline of everything that happens next. You can see it straight away.
{% endstep %}
{% step %}
### Response
The first priority is to contain the threat and stop the attacker. Containment actions you've pre-approved, such as isolating an infected device, can be taken immediately. Anything you haven't pre-approved waits for your decision. Once the threat is contained, we work with you on the follow-on incident response, with the scope depending on your licence. Every change is recorded through the incident response, Immediate Actions or the case timeline.
{% endstep %}
{% step %}
### Close
Once the threat is dealt with, the incident is resolved with a clear record of what happened, how it happened, what was done and how to stop it happening again.
{% endstep %}
{% endstepper %}
***
## What CybaVerse MDR Can Do for You
Speed matters most in the first minutes of an attack. Pre-approved actions are immediate containment actions: they let you decide in advance what CybaVerse MDR can do to stop an attacker quickly, without waiting to reach you. Once the attack is contained, we work with you on the follow-on incident response, with the scope depending on your licence.
You can approve containment actions in three areas:
* **Network containment**: isolating a compromised device from the network, with separate approval for ordinary devices and business-critical ones such as servers.
* **Endpoint security**: running scans, stopping malicious processes, removing malware and the tricks it uses to restart, and blocking known bad IP addresses, domains and files.
* **User account management**: disabling a compromised account, signing it out of active sessions, resetting its password or MFA, and applying new conditional access rules. These need Microsoft Entra ID to be connected.
A tenant admin chooses them under **Pre-approved actions** in **Settings → Company Details → Response Management** and confirms they are authorised to approve them. CybaOps records who gave the approval. The more you approve, the faster an attack can be contained, especially out of hours. See [Pre-approved Actions](/detect-and-respond/managed-detection-and-response-mdr/pre-approved-actions.md).
The Pre-approved actions card in Response Management
***
## Call-outs and Escalation
When an incident needs your input, CybaVerse MDR gets in touch with the contacts on your escalation list. For each contact you set their phone numbers, the days and hours they can be reached and a priority for each period. The highest-priority contact who is available at that moment is called first, then the list is worked down.
Critical incidents are escalated by phone. Less urgent incidents are handled by email and through comments on the incident. Every call-out attempt is recorded, so there's a clear record of who was contacted and when.
The **Escalation contacts** list is managed in the same **Response Management** tab, and a coverage banner shows how many of the 168 hours in the week are covered and where the gaps are. Closing any gaps means a decision-maker can always be reached, even at 3am on a Sunday. See [Escalation Contacts](/detect-and-respond/managed-detection-and-response-mdr/escalation-contacts.md).
{% hint style="info" %}
Priority escalation, with direct engagement and support from your technical account manager, requires CybaOne.
{% endhint %}
Escalation contacts with the coverage banner
***
## Working Together on Incidents
You and CybaVerse MDR work on the same incidents, so there is only ever one version of the truth.
You can see every incident as soon as it's raised, with its severity, status, evidence and findings. The timeline records every action, comment and status change with a time, giving a complete audit trail. When your input is needed, the incident is marked **Pending Customer** and tenant admins get an email. Reply with a comment and it goes straight back to CybaVerse MDR.
Internal working notes are kept separately, so the timeline you see stays clear and focused on what matters to you. Keeping every conversation in the incident, rather than in separate emails, means decisions and evidence stay together for audits and reviews.
***
## The Detect & Respond Dashboard
The Detect & Respond dashboard gives you a quick summary of incident activity. It shows the last 30 days by default, and you can change the date range to see a different period.
* **Threat Level:** a single score for the current health of your estate, shaped by open investigations and their severity.
* **Open Incidents:** a count of active incidents, with the highest severity first.
* **The Pipeline:** the flow from raw events to alerts to incidents. If many events become alerts that don't lead to real incidents, the detection rules may need tuning.
* **MITRE Radar:** current incidents mapped against the MITRE ATT\&CK framework, showing which tactics are most active.
* **Sentry AI:** a plain-English summary of current activity. See [Sentry AI](/detect-and-respond/case.md#sentry-ai).
Review the dashboard regularly. The Pipeline and MITRE Radar can show patterns that individual incidents don't.
***
## The Technology Behind the Service
The service runs on three parts of CybaOps working together:
* [**CybaAgent**](/detect-and-respond/endpoint-detection-and-response-edr.md) is the endpoint detection and response (EDR) tool, running on Microsoft Defender. It watches each device and lets a compromised device be isolated when needed.
* [**Investigate**](/detect-and-respond/investigate.md) is the SIEM. It collects security events from your agents and connected tools and stores them using the open OCSF standard, so data from different sources can be searched together.
* [**Case**](/detect-and-respond/case.md) is where incidents are worked, with their evidence, timeline and comments.
Because detection and correlation happen in CybaOps, you get detection normally associated with Microsoft Defender for Endpoint Plan 2 while licensing Plan 1. That means advanced protection without paying for the higher licence on every device.
***
## Extra Services
Some MDR features need a CybaOne licence. Each one has its own page, which says which licence it needs:
* [Threat Hunting and Intelligence](/detect-and-respond/managed-detection-and-response-mdr/threat-hunting-and-intelligence.md) searches proactively for threats that haven't triggered an alert.
* [Dark Web Monitoring](/detect-and-respond/managed-detection-and-response-mdr/dark-web-monitoring.md) warns you when your credentials or data are leaked.
The MDR widgets on your Dashboard, such as MDR Open Incidents and MDR Incidents by Tactic, appear when your organisation has MDR.
***
## Next steps
* [Pre-approved Actions](/detect-and-respond/managed-detection-and-response-mdr/pre-approved-actions.md): Decide what CybaVerse MDR can do without asking.
* [Escalation Contacts](/detect-and-respond/managed-detection-and-response-mdr/escalation-contacts.md): Make sure CybaVerse MDR can always reach someone in your organisation.
* [Responding to an Incident Ticket](/detect-and-respond/case/responding-to-an-incident-ticket.md): Know what to do when your input is needed.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.cybaops.com/detect-and-respond/managed-detection-and-response-mdr.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
