> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/modules/detect-and-respond-mdr/detect-and-respond-cybaedge.md).
# Detect & Respond (CybaEdge)
### 1. Introduction to Detect & Respond
Detect & Respond is the security operations capability within the CybaOps platform. It brings together **SIEM, SOAR and Case Management** into a single, unified experience.
For CybaEdge customers, Detect & Respond provides continuous monitoring of your security environment, with expert analysts reviewing alerts, investigating suspicious activity, and guiding response when action is required. The platform is designed to reduce alert noise and give you clear, actionable visibility into real security events.
### 2. What’s Included with CybaEdge Detect & Respond
CybaEdge customers receive:
* 24/7 Managed Detection & Response (MDR)
* Centralised alert and incident management
* SOC‑led investigation and triage
* Customer‑visible case management
* Investigate (Full SIEM tool)
* Access to all supported connectors
* Email and escalation‑based notifications
* Flexible reporting
### 3. How Detect & Respond Works
Detect & Respond continuously ingests security data from your connected tools and services. These inputs are analysed and correlated to identify genuine threats.
When an issue is detected:
1. Alerts are received from connected systems.
2. Related alerts are grouped into a single incident.
3. SOC analysts investigate and validate the activity.
4. Incident updates are recorded in the platform.
5. You are notified when awareness or action is required.
This approach ensures clarity, reduces duplication, and keeps investigations structured.
### 4. Managed Detection & Response (MDR)
**What MDR Provides**
* Continuous security monitoring
* Investigation of suspicious alerts
* False‑positive reduction
* Escalation for confirmed threats
* Clear documentation of findings and outcomes
**What You See in the Platform**
* Incidents created and updated in real time
* Analyst investigation notes
* Status changes as incidents progress
### 5. Notifications & Escalation
Notifications are based on incident severity and required input
* Email notifications for when attention is needed on an incident
* Phone escalation for critical incidents
* Full visibility within the CybaOps portal
Notification recipients are defined during onboarding and a telephone escalation matrix is applied for critical incidents.
### 6. Schedules & Data Health
Schedules control how often data is collected and validated. You can view your Schedules by clicking on your username and then Schedules.
From a customer perspective:
* Connectors typically sync every few minutes
* Health checks confirm data flow
* Integration issues surface as visibility warnings
### 7. Connectors
Connectors integrate your security tools with Detect & Respond.
**Key Characteristics**
* One‑way data flow into Investigate
* Supports alert ingestion and enrichment
* Enables cross‑system correlation
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/modules/detect-and-respond-mdr/detect-and-respond-cybaedge.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.