thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Managed Detection and Response (MDR)

An outsourced service providing 24x7 threat detection, investigation and active response using the provider's tools and analysts.

Definition

MDR providers deploy or use EDR/XDR telemetry, hunt for threats and take response actions such as isolating hosts on the customer's behalf. They differ from traditional MSSPs by emphasizing investigation and response rather than device management and alert forwarding. Examples include CrowdStrike Falcon Complete and Palo Alto Unit 42 MDR.

Example

An MDR analyst isolates a ransomware-infected laptop at 3 a.m. and notifies the customer.

Exam tip

MDR = detection plus hands-on response; MSSP = broader management, often notify-only.

Don't confuse it with

Related terms