Managed Detection and Response

Attackers are proactive, so you must be, too.

No MDR solution is complete without a team of threat hunters proactively searching for attackers throughout your environment, utilizing all three types of threat hunting available:

• Indicator of Compromise-Based Threat Hunting: This is the most simple type of threat hunting available and what most of our competitors mean when they say they do threat hunting. Log intensive, this method requires an analyst to search through logs for identifiers (think a known-bad HASH or IP address).
• Tactics, Techniques and Procedures (TTP) Based Threat Hunting: This requires a tier 2 threat hunter or above to think like an attacker and look for scenario-based attack evidence throughout your network. Buchanan’s approach to hunting for TTPs is systematic and thorough, following MITRE ATT&CK® guidelines.

Digital Forensics and Incident Response (DFIR): We can scan and analyze volatile memory from over 1,000 devices per hour, enabling us to proactively use previously labour-prohibitive hunting techniques, leaving absolutely no stone unturned. If there’s anything malicious running or scheduled to run in your environment, our analysts will find it.

The best protection, detection, and response require telemetry from the weakest point in your networks – the endpoint. No MDR& solution is complete without it. Behavioral analysis and threat detection at the endpoint are two of the best ways to protect against ransomware and other malware in work-from-home environments and heavily defended corporate networks alike.

Buchanan has spent countless hours analyzing independent reports and throwing our best penetration testers at EDR solutions so that you don’t have to. This has enabled us to lead the industry with a vendor-agnostic approach and has helped future-proof our MDR program. 

Our endpoint detection and response EDR partners can replace your signature-based antivirus solution or help you co-manage your existing EDR solution and integrate it into our MDR solution.

No Managed Detection and Response service is complete without response, yet so often, this is something our competition leaves up to the client.

Because our approach includes Endpoint Detection and Response and Digital Forensics and Incident Response techniques and tools, we have the capability to isolate infected endpoints and stop threats from promulgating throughout your network. We will also give you advice on how to prevent threats from recurring as well as any other remediation advice needed.

We are also able to tie our services back into your defense architecture, automatically updating firewall rules, blacklists, and other settings to keep attackers and threats at bay.

If a more thorough incident response is required, we offer full response, recovery, and investigation services as well.

The technology that enables our forensic threat hunters is also integrated with our SIEM, launching forensic investigation every time an alert involves an endpoint. This adds a level of accuracy to our work that is unparalleled. Utilizing this process, our experts are able to work with endpoint, network, and forensic evidence, cutting false positives out of our triage process and allowing your team to focus only on validated alerts