> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/modules/detect-and-respond-mdr/detect-and-respond-cybaone.md).
# Detect & Respond (CybaOne)
### 1. Introduction to Detect & Respond (CybaOne)
Detect & Respond in CybaOne delivers the full security operations capability of CybaOps, combining MDR, case management, investigation, and extended security services.
CybaOne builds on CybaEdge by adding proactive threat hunting, expanded intelligence, and strategic security oversight, while using the same Detect & Respond interface.
### 2. What’s Included with CybaOne Detect & Respond
CybaOne includes everything in CybaEdge, plus:
* Proactive threat hunting
* Extended Detection & Response (XDR)
* Dark web monitoring
* Penetration testing integration
### 3. How Detect & Respond Works in CybaOne
Security data from connected systems and intelligence services flows into Detect & Respond where:
* Alerts are correlated into incidents
* AI enriches data points
* Analysts investigate and enrich findings
* Proactive searches identify hidden threats
* Intelligence‑led alerts surface emerging risks
All outcomes are tracked in the platform.
### 4. Managed Detection & Response (MDR)
**MDR Capabilities**
* Continuous SOC monitoring
* Automated and analyst‑led detection
* Proactive threat hunting
* Intelligence‑driven alerts
**Customer Visibility**
* Standard alert‑based incidents
* Hunting‑generated incidents
* Intelligence‑driven findings clearly labelled
### 5. Case Management & Collaboration
Case management operates as in CybaEdge, with added depth:
* More detailed investigation notes
* Broader cross‑system context
* Longer historical visibility
* Pattern recognition across incidents
### 6. Notifications & Escalation
CybaOne customers benefit from:
* Priority escalation paths
* Direct SOC engagement
* TAM‑supported communications
* Executive‑level escalation when required
Critical incidents are escalated immediately via phone.
### 7. Schedules & Data Coverage
CybaOne typically includes:
* More integrated data sources
* Longer data retention
* Deeper investigative coverage
Health monitoring ensures consistent data ingestion.
### 8. Investigate – Advanced Usage
Investigate is a core capability in CybaOne.
CybaOne Use Cases
* Multi‑system attack tracing
* Retrospective threat hunting
* Intelligence validation
* Root‑cause analysis
SOC analysts actively use Investigate, and customers may use it alongside them.
### 9. Connectors
CybaOne uses the same connector library as CybaEdge.
The difference is **depth and scale**, not availability.
Connectors support endpoint, cloud, identity, and intelligence sources. \
Connector setup is documented in individual guides (refs 2500–2506).
### 10. CybaOne‑Exclusive Capabilities
**Dark Web Monitoring**
* Detects leaked credentials or data
* Creates trackable Detect & Respond incidents
* Enables early intervention
**Penetration Testing Integration**
* Critical findings tracked as incidents
* Remediation progress visible in Detect & Respond
### 11. Important MDR Topics – Documentation Gaps
The following should be included in future documentation:
* Formal SLA and priority definitions
* Post‑incident review process
* Role‑based access control
* Long‑term log retention policies
* Platform resilience and continuity
* Customer action expectations
These areas are managed operationally via onboarding and TAM engagement.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/modules/detect-and-respond-mdr/detect-and-respond-cybaone.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.