Overview
Unlock the full power of your Microsoft technology
In partnership with Kroll Responder MDR, Microsoft’s email, cloud and endpoint technology provides an outcomes-driven solution to reduce cyber risk by identifying and stopping threat actors before they lead to costly damage. Kroll Responder managed detection and response for Microsoft provides enriched telemetry, frontline threat intelligence and complete response capabilities to enable you to maximise your native endpoint and cloud technology.
Kroll Responder MDR enhances Microsoft’s technology by applying frontline threat intelligence from thousands of cyber incidents handled by our investigators every year, enabling deeper and more effective threat hunting across your organisation’s mailboxes, networks and endpoints.
Microsoft partnership
Microsoft and Kroll: the perfect partnership
After four decades of global threat investigations and over 3,000 incidents handled every year, we know a strategic response is the best way to successfully mitigate any incident.
Kroll Responder MDR unifies your security telemetry across the Microsoft ecosystem (as well as third-party endpoint detection and response (EDR), network, cloud and SaaS providers) to deliver enhanced visibility and rapidly shut down cyber threats. Kroll Responder simplifies your cyber security telemetry to draw out meaningful and actionable data and rapidly detect and close cyber events.
Benefits
MDR for Microsoft Security benefits
Find out more
Get in touchPackages
Microsoft MDR: Product Overview
| Package | Outcomes | Platform Coverage |
|---|---|---|
| Responder for MS 365 | • Unified alerting and reporting of O365 security controls • Monitoring of sensitive SharePoint and OneDrive files • Monitoring for account misuse or unauthorized access • Reduction in risk for BEC type compromises • 24x7 threat monitoring, triage, investigation and response • Integration of Kroll’s applied threat intelligence |
Microsoft Defender for 365 Microsoft Defender for Identity Microsoft Azure Active Directory |
| Responder for MS Endpoint | • Containment and remediation of infected endpoint(s) • Prevention and isolation of malicious files and processes • Identification of persistence and eviction of the adversary • Major incident report, root cause analysis for major incidents • 24x7 threat monitoring, triage, investigation, remediation • 24x7 remote digital forensics and incident response (DFIR) • Integration of Kroll’s applied threat intelligence • Robust account management |
Microsoft Defender for Endpoint |
| Responder for MS Cloud Networks | • Centralized log collection and long-term log storage • Visibility into IaaS, PaaS and SaaS workloads • Coverage across Azure and hybrid cloud environments • Advanced correlation rules and behavioural analytics • Identity and access monitoring across Azure AD • Proactive threat hunting and intelligence enrichment • 24x7 threat monitoring, triage, investigation and response • Advanced correlation rules and behavioural analytics • Proactive threat hunting • Integration of Kroll’s applied threat intelligence |
Microsoft Defender for Cloud Microsoft Log Analytics Microsoft Sentinel IaaS, PaaS, SaaS On-Premise, hybrid and cloud environments |
What our customers say
Microsoft MDR FAQs
Frequently asked questions
- What is MDR?
-
Managed Detection and Response is a specialist type of security service designed to help organisations rapidly detect and respond to cyber threats across their network and endpoints. MDR services adopt a fully turnkey approach – providing the people, technology and intelligence as part of one overall service.
- How does Kroll MDR work in conjunction with Microsoft?
-
Kroll Responder Microsoft MDR unifies your security telemetry across the Microsoft ecosystem (as well as third-party endpoint detection and response (EDR), network, cloud and SaaS providers) in order to draw out meaningful and actionable data to deliver enhanced visibility and rapidly shut down cyber threats.
- What are the benefits of this approach to MDR?
-
Kroll Responder MDR for Microsoft helps businesses to achieve more from their investment in native endpoint and cloud technology. It provides them with enhanced threat visibility in one single view and comprehensive response capabilities. This approach also keeps your security team more up to date and better prepared to respond to potential security threats.
- Which Microsoft technology does Kroll Responder work with?
-
Kroll Responder MDR for Microsoft Security is available in three packages: Responder for MS O365, Responder for MS Endpoint and Responder for MS Cloud Networks. Specific features, outcomes and coverage will vary according to your choice of package. For more insight into the different options, view the Product Overview table above.
- What are the security outcomes of Kroll Responder Microsoft MDR?
-
Security outcomes of Kroll Responder for MS O365 include unified alerting and reporting or O365 security controls, and a reduction in risk for BEC-type compromises, while the outcomes of Responder for MS Endpoint include the identification of persistence mechanisms and eviction of the adversary and 24×7 threat monitoring, with triage, investigation, analysis and remediation. Outcomes for Responder for MS Cloud Networks include proactive human-led threat hunting and threat intelligence enrichment and 24×7 threat monitoring, with triage, investigation, analysis and response. View the table above for details of all outcomes for the three different options.
Meet some of our MDR team
Get in touch
Complete the form for a prompt response from our team.
Resources