What you are evaluating
Package names are not proof of automatic containment. Digital forensics and incident response may be separate from the MDR SKU. Ask which signals sit in the chosen package.
A useful evaluation context
Evaluation is which Atlas package matches the telemetry the organization will actually provide, not the longest package name.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Around-the-clock hunt, investigate, and respond against the signals in the chosen Atlas package.
- Endpoint, network, log, cloud, and identity packages under Essentials, Advanced, or Complete names.
- Microsoft-ecosystem managed XDR listed in Azure Marketplace as an ecosystem-specific packaging.
Where it fits in the work
- Onboard only the signals in the chosen Atlas package and name the customer contacts for each.
- Investigate provider hunts and confirm which containment acts the package actually performs.
- Hand confirmed compromise that needs digital forensics to the DFIR terms, which may be a separate SKU.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an authorized test tenant, enable only the package signals under evaluation, raise a supported harmless detection, and record whether containment happened or only a hunt note was delivered.
Evidence to look for
The case names the Atlas package, the signals used, and that systems outside that package were not treated as in-scope.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which signals are in the chosen package, and which are sold as add-ons?
- Is unlimited IR marketing language the MDR SKU or a separate DFIR engagement?
- How are hunt notes and evidence exported if the package later changes?