FAQs
Have Questions?
What is managed detection and response?
MDR is a service that monitors your endpoints, identities and cloud around the clock, investigates alerts with human analysts and contains confirmed threats, such as isolating an infected device or revoking a hijacked session. It combines the tooling with the people who act on it.
What is the difference between MDR, a managed SOC and SIEM?
SIEM is the system that collects and correlates logs. A SOC is the team watching. MDR is the service that includes detection tooling such as EDR, the monitoring team and the response actions. At CinchOps they are delivered together; the names describe layers of the same service.
Is MDR different from antivirus or EDR?
EDR is the sensor on the device. MDR is EDR plus identity and cloud monitoring plus people investigating and responding 24/7. EDR without anyone watching it only tells you afterward what happened.
What can the MDR team do without asking us first?
Whatever you agreed in advance. Most clients approve isolating a device, revoking a session, forcing a password reset and blocking a source IP immediately, with anything larger requiring a call to your on-call contact. The playbooks are written down before service starts.
Do cyber insurance carriers require MDR?
Many now ask specifically for EDR on all endpoints with 24/7 monitoring and response, and some price the policy on it. CinchOps MDR provides the capability and the reports that answer the question.
