MANAGED DETECTION & RESPONSE: Security monitoring with a clear path to action.
Managed detection and response (MDR) combines security monitoring, investigation and authorised action across your connected systems during the agreed coverage hours. Subdux examines suspicious activity, connects related events and carries out response actions within its authority, keeping you informed about findings, actions taken and unresolved concerns.
Signal detected
An identity signal requires review.
Correlated
Related identity and endpoint signals are grouped.
Investigating
Scope is reviewed and an agreed containment action is applied.
Contained
The affected endpoint is isolated; monitoring continues.
Start with the activity you need to see.
Endpoint protection, cloud platforms and identity systems each show part of an event. The useful question is whether those records let someone recognise a problem, investigate it and act. We establish the systems that matter, the evidence they produce and the gaps that could limit an investigation.
Tools without follow-through
Security alerts reach your team, but competing operational work leaves limited time to examine them properly.
An environment that has changed
New cloud services, remote access or suppliers have expanded what needs monitoring beyond the original setup.
A team that needs additional capacity
You have security capability and want defined responsibilities taken on without losing visibility or decision control.
Coverage that reflects how your systems are used.
We select monitoring sources and investigation priorities around the environment, rather than assume every available log is equally useful.
Identity activity
Sign-ins, privilege changes and other available account records that help distinguish expected access from potential misuse.
Endpoints and servers
Detection events and system activity available through the agreed security tools.
Cloud and business services
Relevant administrative, security and audit records from the platforms included in the service.
Connections between events
Related accounts, devices and actions that may explain the extent and significance of suspicious behaviour.
A case should explain the concern and the response.
When activity needs investigation, we assess what the evidence supports, identify affected systems and explain any important gaps. Where action is warranted, we follow the agreed authority to contain the activity, escalate a decision or coordinate further work. This can include isolating a device or restricting an account where the tooling and permissions support it.
Before monitoring begins, you know the coverage hours, how urgent findings will reach you and which actions we can take directly. We also establish who can authorise changes that may affect business operations.
See what is being handled and what still needs attention.
Investigation records
What was observed, the evidence considered, the conclusion and the action taken.
Decisions and follow-up
Items needing your approval, another provider or additional technical work.
Coverage review
Gaps in logging, changes to systems and adjustments that could make future activity easier to detect or investigate.
What hours does the service cover?
Coverage hours are agreed with each client. Before the service starts, we set the hours and days monitoring will cover, how urgent findings reach you and who can authorise response actions, based on what your environment needs.
Can you work with our existing IT or security team?
Yes. We can take on agreed operational responsibilities or work within an existing response arrangement. We define who investigates, who approves decisions and who carries out each type of action.
Does MDR include every system and every incident?
The service covers the systems, data sources and response activities defined for the engagement. Major recovery work or an investigation extending beyond that scope may need a separate incident response engagement.
What if our logging is incomplete?
We identify the effect on coverage and agree which improvements matter before representing the service as ready. Missing or short-lived records can limit both detection and later investigation.
Put a workable monitoring arrangement in place.
Tell us which systems you use, what is already monitored and where responsibility is unclear. We can define the coverage and operating model around those needs.
Related services: Incident Response.