Managed Detection and Response

Alert Logic's Managed Detection and Response (MDR) addresses the core security challenge of comprehensive threat detection and response across diverse environments, including on-premises, public cloud, and hybrid cloud setups. The technical architecture of Alert Logic MDR is built around collecting and analyzing vast amounts of data from various sources such as log data, network telemetry, endpoints, and outputs from infrastructure and security systems.

This data is fed into the Alert Logic platform, which utilizes signature-less machine learning and threat intelligence from the Fortra Threat Brain to identify malicious techniques, ransomware, and zero-day attacks in real-time. The platform integrates with existing IT infrastructure, providing a 360° view of exposures and threats through real-time dashboards that track risks, vulnerabilities, remediations, and system health. This comprehensive coverage is enhanced by proactive threat hunting activities conducted by a designated team of cyber-risk experts who work closely with the customer's security team to advise on security posture, detect advanced persistent threats, and optimize detection and response capabilities.

Operationally, Alert Logic MDR involves continuous monitoring and analysis of over 140 billion log messages daily, which can pose scalability challenges but is managed through automated response mechanisms and embedded Security Orchestration, Automation, and Response (SOAR) capabilities. These features help reduce dwell time and the impact of attacks. However, the solution's effectiveness can be limited by the complexity of integrating with diverse environments and the need for ongoing tuning and optimization to minimize false positives and noise.

Key technical details include the platform's ability to handle large volumes of data, support for various compliance mandates like PCI, GDPR, HIPAA, and NIST, and the provision of detailed reports and visualizations to help prioritize and manage security threats. The solution is highly customizable to fit unique business needs, but this customization requires close collaboration between the customer and Alert Logic's cyber-risk experts to ensure optimal configuration and performance.