What you are evaluating
Buying Managed EDR does not automatically include identity or log coverage. Define the purchased services and confirm any specialist forensics or incident-response support instead of inferring it from the managed stack.
A useful evaluation context
Evaluate the available managed endpoint, identity and log services against the staffing needs of an IT team or managed service provider.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Managed EDR with a staffed SOC that still keeps humans in control of complex cases.
- Identity threat detection and response for Microsoft 365 and Google Workspace as a separate layer.
- Optional Managed SIEM and posture-management modules have separate coverage that should be confirmed alongside the endpoint and identity services.
Where it fits in the work
- Onboard the SKUs actually purchased (EDR, identity, or SIEM) and the MSP or IT contacts.
- Investigate SOC-raised cases and keep humans in control of complex containment decisions.
- Document how cases requiring specialist forensics or recovery are escalated, including which customer and provider teams own the next steps.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an authorized lab endpoint and a disposable Microsoft 365 test tenant, enable only Managed EDR, raise a supported harmless detection, and confirm identity signals were not treated as in-scope.
Evidence to look for
The case is limited to the EDR SKU, complex actions show human control, and the disposable identity tenant was not monitored unless ITDR was purchased.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Does the order include Managed EDR only, or also identity and log coverage?
- Who in the MSP or customer IT executes actions the SOC is not authorized to take?
- How are cases exported if the MSP later changes platforms?