EDR / MDR / XDR
We help select and deploy device protection and organise alert handling. EDR and XDR provide tools; MDR includes a team responding to threats. We agree who assesses events, which actions they can take and when a matter is escalated to your company.
Trusted by
EDR (Endpoint Detection and Response) helps detect, investigate and respond to suspicious activity on computers and servers. MDR (Managed Detection and Response) is a service delivered by a team that assesses alerts and takes agreed action. XDR (Extended Detection and Response) connects signals from devices, accounts, email and other connected systems. Visibility depends on licences, configuration and data sources. Buying EDR or XDR alone does not provide round-the-clock staffing or detection of every attack.
We select the elements your existing environment needs. Not every company needs every tool or a replacement for its current platform.
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateWe first agree the operating model and acceptance criteria. Technical deployment and the start of an MDR service are separate scope decisions.
We examine workstations, servers, domain controllers, ERP, databases, industrial systems (OT) and cloud services. We assess licences, alert history, gaps, critical hours and team capacity; we do not assume an agent can be installed on every system.
We choose the service model, tools and pilot group. We agree client, Virtline and vendor roles, priorities, procedures and reporting. We check scenarios involving phishing, ransomware, account takeover, an attacker moving across the network and data theft.
We configure agents, policies and access. We connect agreed sources: Active Directory or Entra ID, email, firewalls and applications, along with event analysis, response automation and ticket handling. We check notifications and responses to suspicious processes and attack command-and-control (C2) connections.
We start the agreed service and tune alerts. The timing of the controlled exercise, first MDR report and subsequent reviews is confirmed in the agreement.
Practical scope
Configurations, procedures and reports show both working safeguards and the gaps, exceptions and issues that need a decision.
A list of covered devices, servers, privileged accounts and critical applications, including remote working. We identify gaps and available data on processes, PowerShell, network connections, file changes and suspicious user activity.
Alert categories and priorities, responsible people, action permissions and escalation contacts. We agree when to notify IT, management, data protection staff, legal teams or suppliers and how to document incident closure.
Agent groups, policies, exceptions, alert thresholds, administrator roles, isolation rules and log retention. We check the path from event to response and record results, false alarms and corrections.
Monthly operational reports and quarterly management summaries, in Polish. They cover protection coverage, alerts, incident timelines, affected assets, decisions, containment actions, open risks and recommendations. We agree how detection and response times are measured and arrange further reviews. Report frequency, scope and language are confirmed in the agreement for the selected service model.
Co-Managed: the client keeps the console and business context, while Virtline provides agreed analyst coverage, alert assessment, tuning, escalation and reports. Full Managed: Virtline runs the agreed EDR, SIEM and SOAR tools and handles events under a monthly service model; it does not take over the company’s compliance responsibilities. Vendor hybrid: we combine the vendor’s MDR service with local procedures and a Virtline contact in Polish or English. When changing models, we prepare a transition plan and hand over configurations, procedures and reporting history. The company continues to set business priorities and accept risk. Duty hours, escalation rules and response times require confirmation in the selected agreement.
Not necessarily. We first review configuration, alert quality, roles and procedures. We work with Microsoft Defender for Endpoint, ESET, Sophos, WithSecure and ThreatDown solutions and vendor MDR services. Selection depends on operating systems, cloud services, licences, integrations, data retention, cost and team capacity. We check the specific version’s compatibility and service scope before a decision; we do not assume every integration is available.
Service hours, including any 24/7 coverage, must be explicitly agreed in the contract. Before launch, we identify the team on duty, covered systems, response times, contacts and permissions. An EDR/XDR licence or automated monitoring alone does not provide people responding to incidents. We do not promise to detect or block every attack or offer a single response time for all events.
Depending on tool capabilities and permissions agreed before launch, we can isolate a device, stop a process, block an account or IP address, reset credentials, quarantine a file and collect incident data. Procedures define which actions need no further approval and which require escalation. Notifications can use phone, email, Teams, a helpdesk or ServiceNow; we also agree incident communication and closure.
No. MDR supports threat handling but does not replace IT maintenance, backups or company decisions. Reports can inform NIS2, DORA and ISO 27001 assessments and help a statutory auditor understand the IT environment in an audit under Polish auditing standard KSB 315. They do not confirm compliance or transfer the organisation’s responsibilities to a supplier. Audit scope and the company’s obligations require a separate assessment.
Tell us your device and server count, current tools, critical operating hours and response expectations. Explain who handles alerts today and whether you need deployment, a platform review or MDR. Do not send passwords or confidential data.
Discuss your EDR/MDR model