MANAGED DETECTION & RESPONSE

The foundation of our MDR offering is MDR|Endpoint. We partner with the best EDR technology on the planet, CrowdStrike. We will deploy, optimize, and maintain CrowdStrike across your IT infrastructure. With MDR Endpoint, we specifically look for and evaluate threats that interact with endpoint systems. Endpoints can include end-user devices such as laptops and workstations, as well as server infrastructure, whether physical servers in data centers or virtual servers in cloud environments. Across these systems, CrowdStrike will detect and prevent a wide variety of attacks. CrowdStrike is the most comprehensive technology for detecting and preventing known threats. It is also effective at detecting suspicious activity that might be a threat but requires additional analysis. In these situations, the RADICL vSOC will investigate further on our customers' behalf to determine if the suspicious activity is actually a potential security incident.

With MDR|Identity, we collect data from Microsoft O365 or Google Workspace and analyze activity pertaining to what users are doing within the environment. This includes analyzing authentication activity, activity around what data and files users are accessing, and email activity. We deploy custom detection analytics to detect indicators of account, data, and inbox compromise. This is critically important, as one of the first things threat actors do when they compromise an environment is gain access to legitimate users' credentials. They use these credentials to impersonate a user within the environment and use the access to burrow deeper into the IT infrastructure to obtain data or access of interest. MDR|Identity is an essential layer of defense that helps ensure Identities are secured and that attackers are not operating from within, impersonating a legitimate employee or user.

With MDR|Network, we collect alarm and threat data from network security devices like firewalls, threat management platforms, and intrusion detection systems. These systems provide visibility into network-borne threats that might be interacting with external systems but also inform us of suspicious activity occurring within the IT or cloud environment. When alarms or threat indicators are raised, they will be investigated by the RADICL vSOC. Our vSOC will also leverage visibility obtained through MDR|Endpoint and MDR|Identity to thoroughly investigate the information raised by the network security device. MDR|Network provides another defensive layer of visibility into the environment to ensure that no indicator of threat goes unnoticed.