Respond: Incident Management

CrowdStrike Falcon Complete is the #1 managed detection and response (MDR) leader and pioneer — delivering 24/7 expert-led protection worldwide with investigation of every alert (low/medium/high/critical) and the industry’s only active, hands-on remediation capability capable of carrying out the entire response for you, including full cleanup without costly reimaging or downtime.

With Falcon LogScale, achieve enhanced observability across distributed systems while eliminating the need to make cost-based concessions on which logs to ingest and retain. CrowdStrike Falcon Next-Gen SIEM revolutionizes threat detection, investigation and response by bringing together unmatched security depth and breadth in one unified platform to stop breaches. Falcon Next-Gen SIEM extends the industry’s most dominant EDR, threat intelligence and expert services to all data sources for complete visibility and protection.

Managed Detection and Response: The unique combination of SentinelOne®’s AI-driven threat detections working in conjunction with First Watch’s proprietary detections elevates your data security and significantly reduces false positives. This combination, along with First Watch’s human element differentiates us from the competition. Our MDR solution provides Next-Gen Anti-Virus, Endpoint Detection and Response (EDR), 24/7/365 Managed Threat Detection and Response, Rapid Response & Remediation, Active Threat Hunting, Proprietary Behavior Detections and Ransomware Rollback. Services start as low as 10 endpoints.

Managed Detection and Response Pro: In addition to the features of MDR described above, MDR PRO includes an instant communication channel (Slack or Teams) for real-time interaction with the First Watch team. We also provide comprehensive reports, dedicated resources, and support for Incident Response investigations.Services start as low as 10 endpoints.

Managed Extended Detection and Response: Building on the MDR Pro service, MxDR expands monitoring to additional data sources beyond endpoints, including Office 365 Management logs, Email Tracing logs, Google Reports, and more. The data is correlated using a Next-Gen SIEM (Devo), which supports multi-tenancy. With MxDR, the First Watch team can effectively identify, detect, and remediate Business Email Compromise (BEC) attacks and additional attacks beyond the endpoint while protecting your cloud assets.Services start as low as 10 endpoints.

PhishER Plus is the key ingredient of an essential security workstream. It’s your lightweight Security Orchestration, Automation and Response (SOAR) platform to orchestrate your threat response and manage the high volume of potentially malicious email messages reported by your users. And, with automatic prioritization of emails, PhishER Plus helps your InfoSec and Security Operations team cut through the inbox noise and respond to the most dangerous threats more quickly.

Sophos MDR is the world’s most trusted Managed Detection and Response service, securing more organization against advanced ransomware attacks and breaches than any other provider. Top-rated by customers on Gartner Peer Insights and G2 alike, it includes:

• 24/7 real-time threat monitoring and response across your full environment using Sophos and third-party products
• Expert-led threat hunting
• Full-scale managed incident response
• Root cause analysis to prevent recurrence of future threats
• $1 million breach protection warranty
• Direct call-in support to seven global Security Operations Centers (SOCs)
• Weekly and monthly activity reports
• Monthly intelligence briefings
• Regular health checks