What Is MDR (Managed Detection and Response)?

Learn about Managed Detection and Response (MDR), how MDR services work, and how visibility and threat detection capabilities improve efficacy of MDR services.

How does MDR service work?

Managed Detection and Response service providers deploy their technology stack in the customer environment and drive integration with existing technologies. Each provider's stack is different, but most include SIEM capability to aggregate and correlate security data.

• Some MDR providers use a fine-tuned commercial SIEM that is either bundled with the MDR service or a pre-existing SIEM in customer environments.
• Other MDR providers use their own proprietary SIEM-like tool that offers similar functionality.

Although SIEMs offer a centralized repository for alert correlation and curation, ingesting all the data across the environment into a SIEM can be expensive and may not scale for every organization.

Managed Detection and Response services typically include:

• Aggregation of security data: Security telemetry is gathered across environments, including endpoints, firewalls, networks, cloud deployments, email, etc.
• Threat detection: Alert correlation and curation, together with input from threat intel feeds and business context, help security teams determine whether anomalies and events are possible threats.
• Threat hunting: Skilled threat hunters use the detection data to form hypotheses and look for tactics, techniques, and procedures (TTPs) commonly used by cybercriminals and threats that may bypass various security tools.
• Investigation: Determine severity and scope of the detected threats to define next steps and response action.
• Response: Take remedial actions to contain and minimize the impact of threats.

There are three models for MDR service adoption:

1. Provider performs all the functions, from aggregation of security data to response.
2. Provider performs aggregation of security data, threat detection, and threat hunting, and the in-house team works on investigation and response based on provider’s recommendation.
3. Provider performs some response actions like host isolation and step-up authentication, while the in-house team engages in response actions (e.g., firewall rule changes and data backups.).

Irrespective of the model of adoption, to be effective in threat detection and response, the Managed Detection and Response service needs high-quality evidence derived from networks, systems, and other sources — evidence that makes it possible to reconstruct the mechanism of a breach and understand its severity and impact.

Why is network evidence integral to MDR service?

If the Managed Detection and Response service only deploys an alert-based strategy for threat detection, then it will only detect threats based on known attack types and rely on threat hunting for unknown threats. MDR services that rely on endpoint visibility but do not analyze network data (e.g., DNS, DHCP, and IDS), limit the visibility from an analyst’s perspective. Alerts are certainly necessary, but they only capture information about known variables. Alerts can be leveraged when responding to an incident, but this approach is reactive.

Although the majority of MDR providers highlight their solution’s network data aggregation and curation, SIEM-based tech stacks limit how much network data can be realistically ingested and analyzed. A full packet capture (PCAP) ingest is certain to test the ingest licensing and utilization of the SIEM. On the other hand, using an sFlow-based ingest approach optimizes bandwidth but limits the context needed for accurate threat detection.

An evidence-based strategy involves collecting and analyzing data across the network to identify and disrupt advanced attacks that don’t match known signatures or behaviors. The right network evidence can be helpful for comprehensive visibility, early detection of potential compromise, and adding context to investigations that can reveal how attackers entered or moved around a network.

How Corelight’s Open NDR improves the efficacy of MDR services

Corelight delivers a comprehensive suite of network security analytics that help MDR providers identify more than 75 adversarial TTPs across the MITRE ATT&CK^® spectrum. These detections reveal known and unknown threats via hundreds of unique insights and alerts across machine learning, behavioral analysis, and signature-based approaches. Corelight’s Open NDR platform leverages powerful machine learning and open source technologies that can detect a wide range of sophisticated attacks and provide analysts with context to interpret security alerts, together with LLMs such as ChatGPT.

Our use of Zeek^® and Suricata, as well as partnerships with Crowdstrike, Microsoft Alliance, and other security consortiums delivers the double benefit of maximized visibility and high-quality contextual evidence that has helped us expand our offerings of supervised and deep learning models for threat detection.

Corelight’s network evidence can be enriched and normalized before it is ingested into SIEM tools in the MDR tech stack. Incorporating network evidence in Managed Detection and Response services can help boost visibility from the perimeter to endpoints and across the network, optimize data ingestion in the SIEM, understand the ground truth faster, and improve investigation and response times.

Looking to improve the efficacy of your MDR service as a provider or security operations leader? Contact us