Sophos Managed Threat Detection and Response (MTR) SERVICES

Do cyber threats keep you up at night?

Sleep better while the Sophos MTR dedicated team of experts works 24/7 to hunt down and detect threats for your organization.

WHY MTR Services?

Threat Notification Isn’t the Solution – It’s a Starting Point:

With Sophos MTR, your organization is armed with a 24/7 team of threat hunters and response experts who will:

Machine-Accelerated Human Response:

Built on Sophos Intercept X Advanced with EDR technology, Sophos MTR fuses machine learning technology and expert analysis for improved threat hunting and detection, deeper investigation of alerts, and targeted actions to eliminate threats with speed and precision. This fusion of Sophos’ consistently top-rated endpoint protection and intelligent EDR, with a world-class team of security experts results in what we call “machine-accelerated human response.

Complete Transparency
and Control

Sophos MTR features three response modes so you can choose the best way for our MTR team to work alongside you during incidents:

Highlights

What’s included with MTR?

Endpoint Detection and Response (EDR)

Take threat hunting and IT security operations to the next level with powerful querying and remote response capabilities.

Managed Threat Response

Elite team of threat hunters and response experts who take targeted actions on your behalf to neutralize even the most sophisticated threats.

Deep Learning Technology

Artificial intelligence built into Intercept X that detects both known and unkown malware without relying on signatures

Anti-Ransomware

Ransomware file protection, automatic file recovery, and behavioral analysis to stop ransomware and boot record attacks

Exploit Prevention

Deny attackers by blocking the exploits and techniques used to distribute malware, steal credentials, and escape detection

Active Adversary Mitigations

Active adversary mitigation prevents persistance on machines, credential theft protection, and malicious traffic detection

Peripheral Control

Monitor or controll access to peripheral and removable storage media.

Application Control

Monitor or control access to individual or categories of non-malicious applications.

Web Control

On-endpoint web filtering to monitor or control access to website and web services.

Windows Firewall Monitoring

Monitor or control the Windows Firewall network profiles

Server Lockdown

Prevent unauthorized software from running on your servers

Web Control

Monitor files, folders, register keys, and registry values for modifications.

Plan Comparison

24/7 Lead-Driven Threat Hunting

Confirmed malicious artifacts or activity (strong signals) are automatically blocked or terminated, freeing up threat hunters to conduct lead-driven threat hunts. This type of threat hunt involves the aggregation and investigation of causal and adjacent events (weak signals) to discover new Indicators of Attack (IoA) and Indicators of Compromise (IoC) that previously could not be detected.

Activity Reporting

Summaries of case activities enable prioritization and communication so your team knows what threats were detected and what response actions were taken within each reporting period.

Security Health Check

Keep your Sophos Central products–beginning with Intercept X Advanced with EDR–operating at peak performance with proactive examinations of your operating conditions and recommended configuration improvements

Adversarial Detections

Most successful attacks rely on the execution of a process that can appear legitimate to monitoring tools. Using proprietary investigation techniques, our team determines the difference between legitimate behavior and the tactics, techniques, and procedures (TTPs) used by attackers.

SOPHOS MTR: Advanced
(Includes all Standard features, plus the following)

24/7 Leadless Threat Hunting

Applying data science, threat intelligence, and the intuition of veteran threat hunters, we combine your company profile, high-value assets, and high-risk users to anticipate attacker behavior and identify new Indicators of Attack (IoA).

Dedicated Threat Response Lead

When an incident is confirmed, a dedicated threat response lead is provided to directly collaborate with your onpremises resources (internal team or external partner) until the active threat is neutralized.

Enhanced Telemetry

Threat investigations are supplemented with telemetry from other Sophos Central products extending beyond the endpoint to provide a full picture of adversary activities.

Direct Call-In Support

Your team has direct call-in access to our security operations center (SOC). Our MTR Operations Team is available around-the-clock and backed by support teams spanning 26 locations worldwide.

Proactive Posture Improvement

Proactively improve your security posture and harden your defenses with prescriptive guidance for addressing configuration and architecture weaknesses that diminish your overall security capabilities.

Asset Discovery

From asset information covering OS versions, applications, and vulnerabilities to identifying managed and unmanaged assets, we provide valuable insights during impact assessments, threat hunts, and as part of proactive posture improvement recommendations.

Sophos Managed Threat Detection and Response (MTR) SERVICES

Our Partners