Managed Cybersecurity Services
Investigate the Alert and Decide What Happens Next
An unusual sign-in needs checking. It could be legitimate activity, or the first visible sign of unauthorized access. Axelris Technologies investigates suspicious activity in your monitored environment and takes response actions within the permissions agreed with your business.
MDR combines around-the-clock monitoring with analyst investigation, giving your IT team findings it can use to act.
Illustration only, not live coverage data
Your IT team may already manage user support and business systems. Investigating a security alert adds different work: checking the activity against other records, establishing whether access was authorized and deciding what needs restricting.
MDR supports that investigation. It gives your team a documented basis for remediation while keeping response decisions within the boundaries set for your environment.
Coverage is defined during onboarding. Identity records, email activity and endpoint evidence can support an investigation when those sources are connected and included in the service.
Review sign-in records and multifactor authentication events for signs of unauthorized account use.
Examine relevant mailbox activity, message authentication and suspicious links or attachments.
Use available device evidence to check for related activity and assess whether isolation is needed.
Relevant sources can include VPN logs, Windows Active Directory, Microsoft Entra ID and Microsoft 365. Available logs and access permissions determine what can be examined. Network or cloud coverage needs to be specified for the systems involved.
An alert starts an investigation; it does not by itself prove compromise. An analyst reviews the available records and checks whether the activity has a legitimate explanation. For an account alert, this can include the source IP address and authentication events, followed by related mailbox or device activity.
The review can also examine application permissions and privilege changes. Where the evidence supports unauthorized access, the analyst assesses the incident’s severity and the action warranted. Related records help establish whether other accounts are involved.
Automation can help bring relevant events together for review. The response still follows the customer’s runbook, including the points where human review or customer approval is required.
Where email-security controls are included, a high-risk message can be quarantined before it reaches an inbox. MDR investigation also addresses suspicious activity that becomes visible when a threat gets past prevention. Monitoring does not mean every attack will be stopped before any harm occurs.
The onboarding runbook records what Axelris Technologies can do and when it must seek approval. For a confirmed compromise rated high or critical, containment depends on the findings and available controls.
Where explicitly authorized, actions can include revoking active sessions and tokens, blocking sign-in or temporarily disabling an affected account.
An involved device can be isolated through endpoint detection and response. Blocking a specific attacker IP also requires the relevant authorization.
Changes outside the runbook go to your designated contact. Changes involving VIP, shared, service or emergency-access accounts require customer approval. Shared-server or production-critical system isolation also requires approval.
The same applies to wider firewall or tenant-wide blocks, device wiping or reimaging, and mailbox-rule or application-permission changes beyond the agreed scope.
An account or device restriction can affect business activity. Agreeing on these boundaries in advance gives analysts a basis for action without treating every system as safe to disconnect.
Axelris Technologies notifies the designated contact and documents the findings, timeline and response actions. Your IT team handles remediation on its systems with guidance, which may include password resets or removing unauthorized changes before access is restored.
Analysts check the monitored environment for related suspicious activity. Wider incident response and digital forensics follow the agreed scope. Rebuilding devices or restoring the business is not automatically part of every MDR engagement.
Illustrative scenario
Illustrative scenario involving a fictional food manufacturer
An engineer’s workstation starts running remote administration tools and connecting to servers it rarely uses. The analyst checks process activity against sign-in records. The engineer confirms no maintenance was planned. Under the agreed runbook, Axelris Technologies isolates the workstation and disables the account.
Plant-floor systems stay under the customer’s control, and isolating them needs explicit approval. IT receives a timeline of the activity to guide recovery.
Before monitoring begins, establish the systems in scope and the access needed to investigate them. Name the contact for escalation and record the approved response actions. Tool requirements and any licensing arrangements also need to be settled.
The service agreement should explain coverage limits and response commitments.
FAQ
That depends on your setup and the integrations required. Share the tools already in use so compatibility, access and any licensing needs can be reviewed before the scope is agreed.
Your service agreement sets the response commitments for your coverage. Ask how investigation and containment are measured, when an incident is escalated and which actions need your approval.
The investigation depends on available evidence and permissions. Systems outside the agreed monitoring scope should not be assumed covered; additional access or specialist work may be needed.
Not automatically. Wider digital forensics and incident response depend on the agreed scope and may require a separate engagement.
Your IT team remains responsible for its systems and remediation tasks. MDR provides security investigation and the response actions agreed in the runbook, with findings to support that team’s work.
Tell us which systems you need monitored and how security alerts are handled today. We can discuss where MDR would support your IT team.