MDR | Managed Detection & Response – Managed Threat Detection and Response

MDR (Managed Detection and Response) — 24/7 monitoring and incident response for organisations that cannot afford an in-house SOC

A ransomware attack does not wait for business hours. According to Verizon DBIR and ENISA reports, most serious incidents — payload execution, privilege escalation, data exfiltration — happen outside the IT team’s working hours: at night, on weekends, during public holidays. An EDR platform generates alerts, but someone must read them, assess them and make a decision — in minutes, not hours. Managed Detection and Response (MDR) solves exactly that problem: an external SOC analyst team monitors your infrastructure 24 hours a day, 7 days a week, takes initial response actions and escalates incidents to your team with a concrete recommendation — not just a raw alert list.

Virtline delivers MDR in three variants: Co-Managed SOC (your EDR/SIEM console, our on-call duty and analysis), Full Managed SOC (the entire stack on our side) and a hybrid with vendor-managed platforms (WithSecure Co-Monitoring/MDR, ThreatDown MDR, Sophos MDR, ESET MDR). Every variant includes: 24/7 alert monitoring, classification and triage, initial response actions within agreed playbooks (endpoint isolation, account block, IP block), notifications via agreed channels (phone, e-mail, MS Teams, ServiceNow), quarterly management reports and an audit trail meeting NIS2, ISO 27001 and DORA requirements.

MDR variants — Co-Managed, Full Managed and vendor hybrid

There is no single universal MDR model. The choice depends on your IT team’s maturity, the tools you already have, and how much responsibility you want to transfer outside the organisation. The models we most commonly recommend:

 Co-Managed SOC (Co-Monitoring) — the client retains their own EDR/SIEM console (Defender for Endpoint, WithSecure Elements, Wazuh), Virtline provides on-call analyst duty, triage and recommendations.

Most common choice for clients with an existing toolstack.

 Full Managed SOC — the entire stack on Virtline’s side: EDR agent, SIEM, SOAR, on-call duty, reporting and compliance.

The client receives a ready-made service with a monthly per-endpoint fee, zero CAPEX outlay.

 WithSecure Elements MDR + Co-Monitoring — vendor-managed service based on the WithSecure Elements EDR agent, supplemented by our initial EN-language contact and response process.

 ThreatDown MDR by Malwarebytes — 24/7/365 managed service with strong behavioural detection, with a Managed Threat Hunting option in the premium tier.

 ESET MDR / Sophos MDR — options for clients already using ESET PROTECT or Sophos Intercept X platforms; integration with the existing fleet without replacing the agent.

 Integration with SOC (SIEM+SOAR) — in the Full Managed variant all events flow into our SIEM, and SOAR automates repetitive responses (endpoint isolation, IP block, account block).

How we deploy MDR in your organisation — 4 stages

Launching MDR is not just about connecting an agent to a console. Without a response process, escalation contacts and playbooks, the service is reduced to “sending an alert e-mail.” We work in a framework where every change in the client’s environment is documented, and from day one the client knows who, when, and what will happen in the event of an incident.

1. Onboarding and environment mapping — endpoint inventory, identification of critical systems (DC, ERP, databases, OT), collection of escalation contacts, agreement on client team working hours and maintenance windows.

2. Technology deployment — EDR agent installation (or integration of existing platform), connection of log sources to SIEM (firewall, AD, M365, helpdesk), correlation rule calibration, end-to-end alert testing.

3. Playbooks and SLA — development of response playbooks for typical scenarios (ransomware, phishing-as-initial-access, lateral movement, exfiltration), agreement on detection SLA (MTTD) and response SLA (MTTR), decision matrix (what we do autonomously, what requires client approval).

4. Go-live and first exercise — production launch, controlled purple-team exercise in the first month (verifying that alerts actually reach on-call and are handled correctly), first management report after 30 days.

MDR in NIS2, ISO 27001 and DORA requirements

Three key regulations affecting the European market require organisations not only to deploy detection tools, but also to have an incident handling process — with specific requirements for notification timing, documentation and reporting. MDR is the practical way to meet these requirements without building an in-house SOC.

• NIS2 Art. 21(2)(b) — incident handling. Requires measures ensuring detection, analysis and response to incidents. MDR delivers the full set of operational capabilities: detection, classification and first-level response.
• NIS2 Art. 23 — incident reporting obligation. Early warning of a significant incident within 24 hours, full report within 72 hours. MDR generates a documented incident timeline that forms the basis for these notifications.
• ISO/IEC 27001:2022 A.5.24 — incident management planning. Requires defined roles, procedures and communication channels — MDR delivers this operationally through documented playbooks.
• ISO/IEC 27001:2022 A.5.25–A.5.27 — assessment, response and lessons learned. MDR’s cyclical reporting (monthly, quarterly) fulfils the entire Deming cycle from detection through to lessons learned.
• DORA Art. 17–23 — ICT incident management and reporting. Financial entities must classify, report and analyse incidents; MDR delivers documented artefacts in a format consistent with EBA/ESMA/EIOPA requirements.
• KSB 3.15 — monitoring and incident handling. The National Cybersecurity Standard requires continuous monitoring and incident management — MDR is the most straightforward way for smaller public entities without their own SOC to satisfy this requirement.