Managed Security & Detection
Managed detection and response (MDR) and endpoint security
Endpoint protection, EDR/XDR and managed detection and response, deployed, configured and supported by Cenvox.
Key areas covered
- Technology
- Endpoint protection, EDR and XDR options, including Sophos solutions
- Cenvox delivers
- Requirement assessment, service coordination, deployment, policy configuration, onboarding and ongoing support
- Monitoring and response
- 24/7 monitoring, investigation and response according to the agreed service scope
- Suited to
- Organisations seeking round-the-clock coverage without staffing an internal monitoring function
Overview
About managed detection and response (MDR) and endpoint security
Managed detection and response combines endpoint protection with monitoring, investigation and response to help your team address security events promptly.
Cenvox can provide managed detection and response with 24/7 monitoring, investigation and response. As an official Sophos Silver Partner, we can deliver Sophos endpoint protection, EDR, XDR and MDR solutions, and we recommend the platform and service tier that best fits your environment. We scope the service around your environment and requirements, coordinate licensing, deployment and configuration, and provide ongoing support. Coverage, response options and responsibilities are agreed with you in writing before the service begins.
A typical starting point
You need laptops and servers protected, and qualified people watching for and responding to threats, without building your own SOC.
The security problem
The risks MDR helps you manage
Ransomware that spreads before anyone notices
Attackers often spend time inside a network before encrypting it. Without someone watching, the first sign is often the ransom note.
Alerts that nobody reviews
Security tools raise alerts at all hours. If they sit unread overnight or at weekends, an attacker gets hours of free time.
Misconfigured or unprotected devices
Devices that have stopped reporting, disabled protection or weak policies are blind spots that attackers look for.
Slow, uncoordinated response
When a threat is found, unclear roles and missing contacts turn a contained incident into a business outage.
What’s covered
What MDR and endpoint security include
Area 01
Endpoint and server protection
- Protection for Windows and macOS endpoints, and Windows and Linux servers
- Anti-ransomware, exploit prevention and machine-learning malware detection
- Web, application and device control policies
- Tamper protection, so attackers and users cannot simply switch protection off
Area 02
Detection and investigation (EDR and XDR)
- Continuous recording of endpoint and server activity for investigation and threat hunting
- Integration of other sources, such as firewall, email and cloud, where licensed and in scope
- Centralised management, alerting and reporting
Area 03
24/7 managed response
- 24/7 monitoring, investigation and threat hunting according to the agreed service scope
- Response actions, such as isolating a device or stopping a malicious process, according to the response mode you choose
- Incident notifications and case summaries when threats are investigated
- Service tiers that differ in the level of response included; we explain which fits your needs
Area 04
Cenvox services around the platform
- Service sizing, endpoint security options and licensing coordination
- Planned, staged deployment to your devices, including removal of conflicting security software
- Policy baseline aligned to vendor-recommended settings, plus exclusions for your business applications
- MDR onboarding: contacts, escalation paths and response mode
- Periodic health checks for coverage gaps, devices that have stopped reporting, and policy drift
Who does what
Who does what
| Activity | Cenvox | MDR operations team | Your organisation |
|---|---|---|---|
| Requirement assessment and product selection | Leads | Not involved | Provides information |
| Licensing and renewals | Coordinates as agreed | Not involved | Approves |
| Agent deployment to endpoints and servers | Plans and carries out | Not involved | Provides access and approves changes |
| Policy configuration and hardening | Configures and documents | Provides applicable guidance | Approves exceptions |
| 24/7 threat monitoring and investigation | Coordinates service and escalations | Monitors and investigates 24/7 | Sets contacts and response preferences |
| Threat containment actions | Coordinates as agreed | Carries out agreed response actions | Approves actions as agreed |
| Root-cause remediation (patching, rebuilding, account changes) | Advises and supports | Provides investigation details | Carries out, or engages us to |
| Health checks and policy reviews | Carries out periodically | Not involved | Reviews outcomes |
| Regulatory incident reporting (for example to CERT-In) | Helps prepare information | Provides relevant service details | Owns the obligation |
24/7 coverage, escalation paths, response authority and responsibilities are confirmed in the agreed service terms before the service begins.
Our approach
How MDR onboarding works
Step 1: Discovery
We review device numbers, operating systems, existing security tools, network layout and the threats you are most concerned about.
Step 2: Solution design and proposal
You receive recommended endpoint security options and service scope, licensing costs, Cenvox services, and the responsibility split in writing.
Step 3: Pilot deployment
We deploy to a small pilot group first to confirm compatibility with your applications, then tune policies and exclusions.
Step 4: Full rollout
We deploy to remaining devices in planned batches, remove conflicting products and confirm every device is reporting.
Step 5: MDR onboarding
Escalation contacts, out-of-hours arrangements and your chosen response mode are set up with the MDR team.
Step 6: Handover and ongoing reviews
You receive deployment documentation and admin guidance. We then carry out health checks at the frequency agreed in your contract.
Response modes and references
- Notify
- The MDR team investigates and tells you what it found; your team carries out the response.
- Collaborate
- The MDR team works with your team, or with Cenvox, to respond.
- Authorise
- The MDR team takes response actions on your behalf and keeps you informed.
- MITRE ATT&CK
- The common framework used to describe detected attacker behaviour in investigations.
- CERT-In Directions (2022)
- Indian requirement to report specified cyber incidents to CERT-In within six hours of noticing them.
What you receive
What you receive with MDR
A configured management console
Your own tenant with hardened, documented policies. You keep administrative visibility at all times.
Discuss MDR requirementsDeployment record
Which devices are protected, with which products and policies, and any exceptions agreed with you.
MDR onboarding record
Contacts, escalation paths, out-of-hours arrangements and the agreed response mode.
Incident notifications and case reports
Sent by the MDR team when threats are investigated. We help you understand them and act on recommendations.
Health-check summaries
Periodic summaries from Cenvox covering devices not reporting, unprotected systems, policy drift and recommended changes.
Good to know
EDR, XDR and MDR are not the same thing
EDR (endpoint detection and response) is software that records and helps investigate activity on devices. XDR extends this to other sources, such as firewalls, email and cloud. MDR is a service: people who use those tools to watch for threats and respond for you.
Our guide to EDR vs XDR vs MDR explains which you need.
Good to know
Monitoring does not replace testing
MDR detects and responds to attacks in progress. A penetration test finds the weaknesses attackers would use to get in. Most organisations benefit from both, and the findings of one make the other more effective.
Before we start
What we need to deploy MDR
- An up-to-date list or estimate of endpoints and servers, with their operating systems.
- An IT contact or administrative access to deploy agents, through your device management tool, Group Policy or manual installation.
- Named contacts for MDR escalations, including out-of-hours contacts if your response mode needs them.
- A decision on how much the MDR team may act on your behalf (your response mode).
- Agreement on how existing endpoint security products will be removed or coordinated.
Not sure you have everything?
We confirm exactly what MDR and endpoint security needs from your side during the scoping call, before any work is agreed.
Book a scoping callFAQ
Questions about MDR and endpoint security
Still have a question?
Ask about scope, timing or cost for MDR and endpoint security, even if you are not ready to commission work yet.
Contact our teamCan Cenvox provide 24/7 managed detection and response?
Yes. Cenvox can provide managed detection and response with 24/7 monitoring, investigation and response. Coverage, response options, responsibilities and service terms are agreed with you in writing before the service begins.
Are you a Sophos partner?
Yes. Cenvox Global Solutions Private Limited is an official Sophos Silver Partner. Sophos endpoint protection, EDR, XDR and MDR are among the solutions we deliver and support, and we recommend the option that best fits your environment, existing tools and budget.
Which platform do you use?
We recommend endpoint security and service options suited to your environment, requirements and budget. Coverage, response capabilities, licensing and responsibilities are explained during scoping.
What is the difference between EDR, XDR and MDR?
EDR and XDR are technology: they detect suspicious activity and give investigators the data to work with. MDR is a service in which trained analysts use that technology to monitor and respond for you. See our guide to EDR vs XDR vs MDR.
What happens when a threat is detected?
The MDR team investigates. Depending on your response mode, they either notify you with findings and recommended actions, work with your team to respond, or take containment actions directly, such as isolating a device. You are kept informed throughout, and we help you with follow-up and root-cause fixes.
Do we need to replace our current antivirus?
Running two endpoint protection products on the same device usually causes conflicts, so the existing product is normally removed as part of deployment. We plan this so devices are never left unprotected.
Does MDR help us meet CERT-In incident reporting requirements?
It helps. CERT-In’s 2022 directions require specified cyber incidents to be reported within six hours of being noticed, which is hard to meet without detection in place. MDR helps you notice incidents quickly and gives you investigation details. The reporting obligation itself stays with your organisation, and we can help you prepare the information.
How is it priced?
Platform licences are priced annually, per user, device or server depending on the product and service tier. Cenvox’s deployment and support services are quoted separately, so you can see exactly what you are paying for. We provide a written quote after discovery.
Related services
Often combined with MDR and endpoint security
Talk to us about MDR and endpoint security
Tell us what has prompted the conversation. We will reply to arrange a short, no-obligation scoping call for MDR and endpoint security.