Buying EDR Is the Easy Part: Who Monitors Alerts and Responds After Hours?

Installing endpoint detection and response (EDR) software is a technical job you can finish in an afternoon. Running it is a commitment that never ends. The hard questions start once an alert fires: who sees it, who investigates, who is allowed to isolate the machine, and what happens at 2 a.m. on a Saturday?

EDR Produces Signals, People Produce a Response

EDR collects endpoint activity, flags suspicious behaviour, and can help contain a device. It still needs a process around it. For every alert category, decide:

• Who does the first review
• What evidence they check
• How urgency is assigned
• When an alert becomes an incident
• Who may isolate a device or disable an account
• How staff and leadership get contacted
• Where decisions and evidence are recorded

Without those answers, a good alert can sit in a dashboard while the activity behind it carries on.

Self-Managed EDR: Control, and the Staffing That Comes With It

Running it yourself can suit a company with qualified internal people, clear coverage, and real time to tune and investigate alerts. Be honest about whether your team can handle initial configuration and tuning, enrolment and health monitoring, false-positive review, investigations that span users, devices, and identities, containment and recovery decisions, after-hours escalation, product updates, and incident write-ups.

Don't leave this to whoever happens to notice the notification first.

MDR: Monitoring and Response Bought as a Service

Managed detection and response (MDR) puts an outside security team around the technology. What's included varies a lot, so compare the contract and not the label. Ask each provider:

• Which endpoints, identities, cloud services, and networks do you watch?
• Is that around the clock, or only certain hours?
• Do analysts investigate, or just forward alerts?
• Can they isolate devices or accounts, and under whose authority?
• How do urgent incidents get escalated?
• What response and communication commitments are written down?
• What reporting and recommendations come with it?
• Which actions stay with us?

A managed service should make ownership clearer. If it adds another vague handoff, you've paid for more confusion.

Build an Escalation Matrix

Keep it simple and tie severity to action.

Low or Informational

Review during normal hours, tune out repetitive noise, and keep an eye out for patterns that keep coming back.

Suspicious

Assign a qualified investigator, contact the user or system owner, look at related identity and endpoint activity, and decide whether containment is needed.

High-Confidence or Active Threat

Start the incident process. Contain using authority you approved in advance, revoke compromised access where appropriate, notify the named technical and business contacts, and keep evidence and a decision log.

Set the severity labels to match your own environment and business impact. A vendor's default score won't know that the "low" server is the one that runs payroll.

Decide Containment Authority Before the Alert

Fast containment limits damage, but isolating the wrong server, or the owner's laptop in the middle of a client call, can stop real work. Settle these ahead of time:

• Which kinds of devices can be isolated automatically
• Which systems need a business sign-off first
• Who can disable user and privileged accounts
• How to treat servers, kiosks, and operational technology
• What happens when the approver can't be reached
• How you confirm containment worked and how you reverse it

Walk through one made-up alert on paper and the gaps show up quickly.

Make After-Hours Coverage Real

An unattended mailbox isn't an after-hours plan. Check that:

1. Alerts land in a channel someone actually watches.
2. The on-call person has secure access to the tools they need.
3. Escalation contacts are current.
4. There are backup contacts.
5. The responder has documented authority to act.
6. The business can still communicate if normal systems are down.
7. Every exercise or incident ends with corrective actions.

Measure Whether It Works

A few numbers tell you if the process is real: how much of your fleet is enrolled and reporting, how many alerts are waiting for triage, how long it takes to get from detection to a human looking at it, how long from a confirmed threat to containment, which false positives keep repeating, how many contact attempts failed, and how many corrective actions are still open after incidents.

EDR pays off when a detection leads to someone qualified investigating and acting quickly. Whether that's your staff or an MDR provider, the owner has to be named for every hour of the week.

Related Reading

This continues the thread from our ransomware defense guide. Detection tools only help when an accountable team can act on what they report.