Sophos MDR for

Microsoft Defender
Expert-led Threat Response for Microsoft Environments
Sophos Managed Detection and Response (MDR) for Microsoft Defender
extends your team with highly skilled experts who monitor, investigate,
and respond to Microsoft Security alerts 24/7.

Maximize Your Microsoft Security Investment Highlights

Many organizations have invested in the Microsoft Security suite but may not have Ì Sophos MDR analysts monitor,
enough in-house expertise to effectively use Microsoft’s multi-product technology stack investigate, and respond to
to detect, investigate, and respond to hundreds of security alerts every day: Microsoft Security alerts 24/7,
taking immediate action to
Ì The global shortage of cybersecurity practitioners has reached 3.4 million1.
stop confirmed threats
Ì 71% of security teams find it difficult to determine which security
Ì Service capabilities extend
alerts to investigate among the noise generated by their tools2.
beyond Microsoft Defender
Ì The median threat response time for organizations with a for Endpoint and Microsoft
dedicated security operations team is 16 hours, leaving attackers Sentinel to provide coverage
significant time to operate within the network3. across the Microsoft Security
platform
Sophos MDR for Microsoft Defender provides the most robust threat detection, hunting,
and response capabilities available for Microsoft environments. Our analysts monitor, Ì When an active threat is
investigate, and respond to Microsoft Security alerts 24/7, executing immediate, human- identified, the Sophos MDR
led response actions to stop confirmed threats with an industry-leading average threat operations team can execute
response time of 38 minutes—96% faster than the industry benchmark. an extensive set of threat
response actions on your
Detect and Stop Threats Beyond Microsoft Defender behalf
With Sophos MDR for Microsoft Defender, our Microsoft Security experts detect, Ì Proprietary Sophos
investigate, and respond to threats using security data from the following Microsoft detections, threat intelligence,
products: and human-led threat hunts
add additional layers of
Ì Microsoft Defender for Endpoint Ì Identity Protection (Azure AD)
defense
Ì Microsoft Defender for Identity Ì O365 Security & Compliance Center
Ì Integrate non-Microsoft tools
Ì Microsoft Defender for Cloud Ì Microsoft Sentinel and telemetry sources to
stop attacks targeting your
Ì Microsoft Defender for Cloud Apps Ì Office 365 Management Activity
network, your users, and your
customers
In addition, our proprietary detections, world-class threat intelligence, and human-led
threat hunts add additional layers of defense, identifying and stopping more threats than
Microsoft Security tools can on their own.

Organizations can also integrate non-Microsoft security tools and telemetry sources from
Sophos solutions or dozens of other vendors such as Palo Alto Networks, Fortinet, Check
Point, AWS, Google, Okta, Darktrace, and more for complete visibility and protection.

1 2022 Cybersecurity Workforce Study, (ISC)2

2 The State of Cybersecurity 2023: The Business Impact of Adversaries, Sophos
3 Gartner Cybersecurity Business Value Benchmark database, 2022
Sophos MDR for Microsoft Defender

Sophos MDR for Microsoft Defender: Key Service Capabilities

Microsoft Security Event Sources Threat Analysis, Correlation, and Prioritization Sophos MDR for Microsoft Defender
Sophos XDR Data Lake

Microsoft Defender for Endpoint 24/7 Managed Detection

and Response Services
Microsoft Defender for Identity
Human-led
Microsoft Defender for Cloud Threat Response

Microsoft Defender for Cloud Apps Proactive

Threat Hunting
Identity Protection (Azure AD) Collect Contextualize Correlate
Threat Investigation
O365 Security & Compliance Center and Analysis

Microsoft Sentinel Weekly and Monthly

Reporting
Office 365 Management Activity
Proprietary Threat
Non-Microsoft Telemetry Sources Intelligence

Threat Proprietary Automated Advanced

+
Intelligence Detections Response Threat Analytics

24/7 Threat Monitoring Proactive, Human-Led Threat Hunting

Our Microsoft Security experts detect and stop threats Proactive threat hunts performed by highly-trained analysts
before they can compromise your data or cause operational uncover and rapidly eliminate threats and identify attacker
disruption. Backed by six global security operations centers behaviors that evaded detection from deployed toolsets.
(SOCs), Sophos provides around-the-clock coverage.
Compatible with Non-Microsoft Security Tools
Human-Led Threat Response Sophos MDR can integrate non-Microsoft security tools and
The Sophos MDR team can execute an extensive set of threat telemetry sources to detect and stop attacks across your
response actions on your behalf to disrupt, contain, and entire environment.
eliminate attackers. Threat response actions can include:
Weekly and Monthly Reporting
Ì Isolating host(s) utilizing Sophos Central
Real-time alerts, reporting, and management options
Ì Applying host-based firewall IP blocks are readily available in Sophos Central, while weekly and
monthly reports provide insights into security investigations,
Ì Terminating processes
cyberthreats, and your organization’s security posture.
Ì Forcing log off user sessions
Monthly Threat Intelligence Briefings
Ì Disabling user accounts
Delivered by the Sophos MDR team, the “Sophos MDR
Ì Removing malicious artifacts ThreatCast” is a monthly briefing that provides insight into
Ì Adding malicious hashes to blocked the latest threat intelligence and security best practices.
items in Sophos Central
Proprietary Detections
Proprietary detections, advanced threat analytics, and world-
class threat intelligence built into the Sophos platform add
additional layers of defense, identifying more threats than
To learn more, visit: Microsoft Security tools can on their own.

sophos.com/microsoft-defender

United Kingdom and Worldwide Sales North American Sales Australia and New Zealand Sales Asia Sales
Tel: +44 (0)8447 671131 Toll Free: 1-866-866-2802 Tel: +61 2 9409 9100 Tel: +65 62244168
Email: sales@sophos.com Email: nasales@sophos.com Email: sales@sophos.com.au Email: salesasia@sophos.com

© Copyright 2023. Sophos Ltd. All rights reserved.

Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned are
trademarks or registered trademarks of their respective owners.

23-07-10 DS-EN (DD)