MDR: managed detection and response, from alert to closure
Updated on
Managed detection and response combines continuous monitoring, expert investigation and coordinated action against threats. Loonar designs, deploys and sustains MDR with a 24/7 AI SecOps, a native SIEM and playbooks aligned with NIST SP 800-61. Teams receive practical training and defined escalation paths without having to build an internal AI SecOps.
In short
- An alert is the start of an investigation.
- Containment needs clear authority.
- Coverage depends on usable telemetry.
How do you know you need managed detection and response?
After-hours blind spots
Threat activity continues after staff sign off. Without someone reviewing signals overnight, suspicious events wait in a queue until the next shift. Delayed investigation gives intruders more time and makes it harder to establish what actually happened.
Alerts without ownership
Security tools produce notifications, but no team owns the investigation through closure. Repeated alerts compete with meaningful signals. Infrastructure staff must balance service availability against unfamiliar investigations, often without the context needed to make a defensible response decision.
An internal AI SecOps is hard to maintain
Running a AI SecOps requires recruitment, training, shift coverage and specialist knowledge alongside technology. When the operation relies on a small group, leave or staff turnover creates gaps. Simultaneous incidents can expose those dependencies precisely when continuity matters most.
Requirements without proof
Customers and insurers ask for continuous monitoring, but a dashboard alone does not demonstrate response capability. Without investigation records, named owners and documented decisions, teams struggle to show how controls operate or explain which gaps need attention next.
How does it work?
Analyst-led monitoring
Analysts review activity continuously, qualify suspicious signals and assign severity. Defined escalation rules and shift handovers keep investigation context available, so the next analyst can continue work rather than restart it.
SIEM collection and correlation
The SIEM collects agreed log sources and connects related events. Ingestion checks assess quality and availability, helping distinguish a quiet environment from a source that has stopped sending usable evidence.
Threat intelligence and hunting
Threat intelligence informs investigation hypotheses and proactive searches. Hunts use available telemetry and MITRE ATT&CK techniques to guide analysis, with explicit limits where the environment lacks relevant records or visibility.
Playbook-driven containment
Playbooks specify response conditions, ownership and authorization boundaries. Actions that could disrupt business services follow agreed approval paths, while the investigation records evidence and the rationale behind each containment decision.
Cross-layer integration
Endpoint, identity, cloud and network signals help analysts reconstruct attack activity. Integrations depend on available sources, connectivity and permissions; documented gaps become operational work items rather than hidden assumptions about coverage.
Executive reporting and evidence
Incident records capture timelines, actions and recovery dependencies. Executive reports connect coverage and operational findings to business priorities, while preserving the technical detail required for investigation, review and informed decisions.
How does Loonar deliver?
Assessment
We map critical assets, log sources and existing response procedures. The assessment identifies visibility gaps, retention requirements and operational dependencies to establish a realistic service scope and clearly documented starting limitations.
Service design
Loonar designs severity rules, service boundaries and response playbooks. Technical and business owners agree on containment authority, emergency contacts and closure criteria before the service takes responsibility for live investigations.
Deployment and integration
We connect sources to the SIEM, check event delivery and tune correlations. Controlled exercises validate detection, escalation and response paths before the agreed workflows move into continuous operational use.
Training
Loonar trains internal owners to interpret notifications, approve actions and preserve evidence. Exercises address unavailable contacts and containment choices that may affect critical services, so decisions do not depend on improvisation.
Operation and improvement
Loonar sustains the service, reviews incidents and updates detection logic as the environment changes. Regular reviews assign owners to visibility gaps, noisy rules and response improvements with explicit operational priorities.
Which technology does Loonar use to deliver it?
What results do we measure?
- MTTD
- Measures time from the agreed observable activity milestone to detection.
- MTTR
- Tracks time to the agreed response milestone, separating containment from recovery.
- Log source coverage
- Shows which planned sources provide usable investigation events.
- Incidents contained
- Counts incidents with evidence confirming successful containment.
- Customer notification time
- Measures elapsed time between incident classification and notification of the designated contact.
How does MDR compare with EDR, XDR and an internal AI SecOps?
Detection technology and operational ownership solve different parts of the problem.
| Aspect | EDR | XDR | MDR | Internal AI SecOps |
|---|---|---|---|---|
| Model | Endpoint technology | Cross-layer technology | Managed service | In-house operation |
| Scope | Endpoints | Integrated sources | Contracted coverage | Internally defined |
| Investigation | Customer team | Customer team | Service analysts | Internal analysts |
| Response | Endpoint actions | Integrated actions | Agreed playbooks | Internal processes |
Where do we apply it?
Financial services
A financial organization needs to connect suspicious access with infrastructure activity rather than investigate each in isolation. MDR correlates signals, coordinates escalation and records containment decisions. Internal owners retain authority over sensitive actions and receive evidence that supports control reviews, risk discussions and requests from auditors.
Retail and e-commerce
During busy trading periods, security alerts compete with storefront availability. MDR investigates endpoint, cloud and access activity while accounting for business constraints. Playbooks separate actions that are already authorized from decisions requiring approval, helping responders weigh disruption before isolating a system involved in active sales.
Healthcare
Care environments require caution around service interruption and sensitive information. MDR monitors the available sources and prioritizes incidents using the context of affected services. Technical and clinical owners participate when needed, while evidence preservation and documented exceptions maintain accountability even when urgent action limits the available choices.
Frequently asked questions
What is MDR?
MDR stands for managed detection and response. It combines analysts, telemetry and response procedures to investigate threats rather than simply forward alerts. Loonar designs coverage, deploys integrations, trains internal owners and sustains the service. A useful agreement states which sources are monitored, when analysts operate, who can authorize containment and where responsibility for business recovery remains after the immediate threat is contained.
What is the difference between MDR, EDR and XDR?
EDR provides endpoint visibility and response functions. XDR connects signals across security layers to support detection and investigation. MDR is an operating service that brings analysts and procedures together with those technologies. Buying EDR or XDR does not automatically provide continuous investigation. The right arrangement depends on existing coverage, available staff and ownership of each response step.
Does MDR replace an internal AI SecOps?
It can take on work otherwise handled by an internal AI SecOps or supplement an established team. The decision depends on business requirements, service scope and the level of control the organization wants to retain. Business decisions, recovery and governance still need internal owners. Clearly defined queues and responsibilities prevent duplicated investigations and disagreements about who approves containment or closes an incident.
What happens when a threat is detected overnight?
An analyst assesses the signal, gathers context and follows the workflow for the assigned severity. Previously authorized actions can proceed within agreed boundaries. When a decision requires approval or could materially affect services, the emergency contact is notified. Communication attempts, evidence and decisions are recorded. Keeping contacts current and testing approval paths is therefore part of incident readiness, not an administrative detail.
Does MDR help with LGPD and cyber insurance?
MDR can provide evidence of monitoring, incident handling and operational controls for privacy assessments and insurer reviews. It does not guarantee compliance with Brazil’s LGPD, insurance eligibility or claim payment. Notification duties and legal decisions depend on the incident, applicable requirements and policy terms. Security, legal and privacy teams should use investigation records together when assessing what action the organization must take.
Shall we design the next version of your operation?
Tell us the challenge. One conversation with a specialist gives you a clear path, even if it isn't time to buy yet.