Sophos MDR User

Sophos MDR – technology and human expertise

Sophos MDR User combines the included Endpoint and XDR capabilities with a managed security service. Sophos investigates threats around the clock and supports attack response. This version is licensed per user. Sophos MDR was previously called MDR Essentials. The focus is detection and containment; your team or a separately commissioned service handles full incident response and neutralisation.

An analyst team for workstations – 24/7

The service adds a Security Operations Centre (SOC) to your IT team. Alerts receive attention outside your own working hours too. Your team remains responsible for setup, availability and tasks outside the agreed service scope.

Sophos MDR capabilities

MDR reviews and prioritises detections and can carry out authorised containment actions. For full incident response beyond containment, Sophos MDR Plus provides the more comprehensive service tier.

Investigate detections around the clock

The MDR team reviews relevant detections, correlates related activity and initiates the appropriate response. Alerts receive expert assessment rather than simply being forwarded.

Attack detection

Attackers can also use legitimate tools. Analysis combines telemetry and threat intelligence to identify suspicious behaviour in context and prioritise investigations.

Security Health Check

Sophos reviews visible security settings and flags configurations that weaken protection or data collection. Your IT team receives practical starting points for improvements.

Activity reports and case overview

Cases, investigation findings and actions remain visible in the console. Your IT team can trace decisions and completed actions. Available reports depend on your environment’s migration status.

Define response permissions and responsibilities during onboarding

Before the service starts, configure reachable contacts, data sources and response permissions. The selected mode determines which actions Sophos may take; the subscribed tier determines their scope.

Notify Only

Sophos reports suspicious activity. Containment actions are not performed in this mode. For active response, Sophos recommends Collaborate or Authorize.

Collaborate

Sophos investigates the case and agrees response actions with your authorised contacts. An additional setting can permit action when your contacts cannot be reached.

Authorize

Sophos may perform agreed response actions without asking for approval each time and informs you of the actions taken. Scope and technical capabilities still depend on the tier, configuration and supported systems.

Included integrations

Supported Sophos and third-party integrations are included. This lets you incorporate existing security solutions. Source products require their own licences; available response actions depend on the integration.

Sophos XDR

The included XDR tools provide the technical foundation for detection and investigation. Analysts add their assessment; additional data sources must be configured.

Sophos Firewall

An existing, separately licensed Sophos Firewall can contribute network signals. Supported response features require the appropriate firmware, configuration and authorisation.

Sophos Endpoint

Sophos Endpoint is included in the MDR package. An existing third-party solution can remain in use through supported sensor or integration configurations. The Sophos sensor alone does not include prevention features.

Sophos Email

Sophos Email adds signals and supported response actions when email protection is separately licensed. The included Email Monitoring System analyses message copies without blocking the original emails.

Cloud security data

Supported cloud integrations supply events for threat analysis. They replace the data access formerly provided by Cloud Optix, discontinued on 30 September 2026, and must be configured. The former Cloud Security Posture Management is not included.

Data retention

In the classic Sophos Data Lake, XDR and MDR data remain available for up to 90 days within storage limits. Longer retention and the new platform have separate storage options.

Microsoft security integrations

Supported Microsoft security integrations add context, such as endpoint or identity events. Available data depend on the source product, its licence and the permissions configured.

Microsoft 365 Activity

Supported Microsoft 365 activity events help investigate suspicious activity across services. Permissions and data collection are defined during setup.

Third-party endpoint protection

MDR can be combined with supported third-party endpoint solutions. Each integration determines which data and response actions are available.

Additional integration areas

Supported third-party integrations do not require additional Integration Packs. NDR, ITDR, Managed Risk and extended data retention remain separate offerings.

Firewall integrations

Supported firewall data add network events to investigations. Connectivity depends on the vendor, software version and log forwarding.

Public cloud integrations

Cloud events broaden visibility into connected environments. Supported cloud accounts and the necessary permissions must be configured; the cloud provider may charge infrastructure costs.

Identity integrations

Supported identity services provide information on sign-ins and account risks. Sophos ITDR offers additional identity protection features as a separate add-on.

Network security integrations

Network security data add context to suspicious connections. Analysing network traffic with Sophos NDR requires a separate NDR licence.

Email integrations

Data from supported email security products help trace an attack from mailbox to device. Response options depend on the integration and permissions.

Extended data retention

Separate storage options are available for longer investigation periods. The classic one-year add-on and Next-Gen SIEM options apply to different platform capabilities. We help you choose the right option.