Who does what
Provider
- Investigate alerts around the clock
- Resolve false positives and escalate risk
- Contain threats under agreed engagement rules
Your team
- License tools and maintain telemetry coverage
- Set response authority and approval paths
- Complete remediation and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
Details
Service scope
Best for Teams adding MDR to existing EDR and SIEM investments
Response authority
Actions depend on rules of engagement and connected tools. Confirm what is pre-approved, requires confirmation or stays with your team.
Service tiers
Essentials excludes SIEM/XDR integrations and custom data sources or detections. Enterprise and Signature add those capabilities; advisory analysts and incident response have separate add-on terms.
Buying scope
Quote the MDR tier, managed tools, service credits and additional incident-response work together. Private-offer marketplace amounts are not complete service prices.
Full service analysis
Critical Start MDR is a managed detection and response service that adds 24x7 SOC monitoring, investigation, response and CORR/MOBILESOC workflow around customer security telemetry. After an alert, Critical Start investigates, resolves false positives, escalates real risk and can take response actions on the buyer's behalf when rules of engagement and the connected tool allow it. The buyer still owns the underlying tools, telemetry coverage, approvals, remediation and recovery work.
- Your team owns
- Licensing, deploying and maintaining the EDR, SIEM, identity, cloud and other tools in scope
- Making sure expected assets, log sources and telemetry are connected and reporting
- Defining rules of engagement, response authority and approval paths for high-impact actions
- Remediation, recovery and business decisions after containment or escalation
- Confirming which tier includes custom detections, reporting, advisory work and incident response access
Why contain threats
The MDR offer goes beyond monitor-and-notify because official sources support 24x7 investigation and response plus remote threat containment through MOBILESOC. It is still not a full SOC replacement because the buyer owns the stack, asset coverage, rules of engagement, remediation and recovery.
Response boundary
AWS Marketplace language says the SOC can take response action on the buyer's behalf based on rules of engagement and the security tool. This profile should not imply universal remediation across every product, identity workflow, cloud account or business system.
Tier boundary
The published tier table excludes SIEM/XDR integrations and custom detections from Essentials. Enterprise and Signature add those capabilities, while incident-response and advisory services have further entitlement choices. Scope the quoted tier before assuming broader tool coverage.
Pricing & contract
- Billing
- Tiered, Custom
Quote the MDR tier, managed tools and service credits. Essentials excludes SIEM/XDR integrations and custom detections. Advisory SOC analyst and incident-response additions have separate entitlements; underlying tool licenses and renewal terms need to be identified.
Tradeoffs & buying questions
Strengths
-
Works with supported customer tools
Investigates alerts around supported customer security tools
-
Permitted response through connected tools
Can perform response under agreed tool permissions and engagement rules
-
Analyst notes and mobile workflows
Provides analyst notes and mobile investigation workflows
Considerations
-
SIEM/XDR and custom detections need higher tiers
Essentials does not include SIEM/XDR integrations or custom detections
-
Tool capabilities and engagement rules limit actions
Actions depend on connected-tool capability and engagement rules
-
Advisory and IR entitlements need separate scoping
Advisory analysts and wider incident response require explicit scope
Ask before buying
- Which tool actions can the SOC take directly, and which need approval?
- Which assets, log sources and integrations are included from day one?
- Are advisory analysts, incident response, custom detections and executive reporting included or tier-dependent?
Integrations
Platform / SIEM
- Microsoft Sentinel
- Splunk Cloud
- Sumo Logic Cloud SIEM
Endpoint
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- Palo Alto Networks Cortex XDR
1 more integrations
- SentinelOne
Other integrations
- Critical Start CORR
- MOBILESOC
- Microsoft Defender XDR
2 more integrations
- Microsoft Entra ID
- Proofpoint
Common questions
Does Critical Start MDR replace a full SOC?
No. Critical Start provides MDR monitoring, investigation, alert resolution workflow and scoped response through supported tools. The buyer still owns the security program, connected controls, asset coverage, response authority, remediation and recovery.
Can Critical Start take response actions for the buyer?
Public marketplace and datasheet material support response actions and MOBILESOC containment when the connected tool and rules of engagement allow it. Buyers should confirm the exact actions, approval requirements and tier dependencies in the quote.
Is Critical Start pricing public?
No reliable public list price was found. Critical Start publishes tier names and AWS Marketplace private-offer procurement, but buyers need a current quote for scope, term and price.
Company details
- Headquarters
- Plano, Texas
- Founded
- 2012
- SOC regions
- North America