What you are evaluating
The service investigates integrated EDR, cloud, and identity threats. Do not assume Zero Trust Exchange coverage without the order form. Ask which EDR classes are supported in the purchased SKU.
A useful evaluation context
Evaluation is for teams that want staffed investigation of integrated EDR, cloud, and identity threats under the current Zscaler MDR brand.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Around-the-clock investigation of integrated EDR, cloud, and identity threats.
- Customer portal and automations for cases the service raises.
- Test-threat validation (RCCAR) so buyers can rehearse detection without attacking production.
Where it fits in the work
- Onboard supported EDR classes and confirm whether Zscaler Zero Trust telemetry is actually in the SKU.
- Investigate service-raised threats and agree which automations may run without extra approval.
- Hand remaining identity or network changes that sit outside the MDR order to customer IT.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an authorized test environment, use the provider's supported test-threat validation method against a disposable host, then record acknowledge, investigation notes, and whether Zero Trust telemetry was actually in scope.
Evidence to look for
The investigation record names the EDR class used, the validation method, and that production hosts outside the test were not changed.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which EDR classes are supported, and is Zero Trust Exchange telemetry on the order form?
- Who owns the former Red Canary portal access and automations after the brand change?
- How are investigation records exported if the service later ends?
Names you may encounter: Red Canary. Historical names do not establish current availability or feature equivalence.