Managed detection and response, in your tenant

MDR without the black box

Head-to-head: traditional MDR provider vs ManySignal MDR.

Service level agreements

SLA credits applied automatically — no claim needed.

ManySignal MDR: frequently asked questions

Do we lose visibility into what the MDR team is doing?

Every action is recorded in your tenant's audit log with analyst identity, timestamp, and evidence reviewed. You see more than with a traditional MDR.

Can we keep our own detections?

Yes. Your detection library is yours. The MDR team operates on your rules, with detection-as-code co-authoring available so your engineers and our analysts collaborate in the same repo.

What is the exit path if we want to bring the SOC in-house?

Your data stays in your tenant. Your detection library, entity baselines, and case history come with you. Offboarding is removing MDR team access — no export project, no ransom pricing.

How is MDR priced?

Priced by monthly telemetry volume plus entity count — no per-alert charges. Enterprise volume discounts available. Talk to sales for a custom quote based on your environment.

Are SLA credits automatic?

Yes. If we miss a documented SLA for a confirmed incident, a credit is automatically applied to your next invoice. You do not need to file a claim.

What detection coverage do MDR analysts use, and can we influence it?

MDR analysts operate on ManySignal's 500+ shipped detection rules plus any custom rules your team has authored. Detection-as-code co-authoring is available: your detection engineers and ManySignal MDR analysts can collaborate in the same Git repository, propose new rules, and review each other's changes. Custom detection rules built during the MDR engagement are your intellectual property.

How does the MDR team handle an active incident at 3 AM?

When the triage agent escalates a P1 finding overnight, the on-duty MDR analyst reviews the pre-assembled evidence package and executes approved containment actions within the P1 SLA window — typically 15 minutes from initial escalation. You receive a Slack and PagerDuty notification simultaneously showing the analyst's actions in real time. For incidents requiring customer approval (higher-risk actions), the analyst pages your designated approver with a one-click approve/deny.

What certifications does the MDR team hold?

ManySignal MDR analysts hold industry-standard certifications including GCIH, GCIA, GCFE, and CISSP across the team. The team operates a documented incident response methodology aligned with NIST SP 800-61. Certification details and the MDR team's operational methodology are available for review under NDA as part of the vendor assessment process.

How does ManySignal MDR compare to traditional MDR providers like Secureworks, Arctic Wolf, and Rapid7 MDR?

Traditional MDR providers use proprietary tooling and deliver outcomes through a managed portal — you see summaries and recommendations, not the underlying investigation. ManySignal MDR operates inside your tenant: all investigation evidence, triage reasoning, and action records are in your environment, not a vendor-controlled portal. When you transition away from MDR or bring the SOC in-house, all evidence and detection logic travel with you. Traditional MDRs typically create data lock-in; ManySignal MDR is structured around data portability.