Who does what
Provider
- Investigate Enhanced Monitoring alerts 24/7
- Review and apply eligible response actions
- Report investigations and advise on tuning
Your team
- Maintain coverage and call-home connectivity
- Govern action permissions and respond to escalations
- Complete follow-up analysis, remediation and recovery
Coverage
- Network
- Identity & Access
- OT/ICS
- Endpoints
Details
Service scope
Best for Darktrace customers with a team available to take over remediation
Alert scope
MDR covers Enhanced Monitoring models within the configured Darktrace deployment. Copied custom models do not inherit that coverage.
Action permissions
Eligible actions can be extended for 24 hours. Pattern-of-life restrictions may be applied even in Human Confirmation mode. Confirm device eligibility.
Incident handoff
You own follow-up analysis and remediation. The September 2026 definition caps further analysis of confirmed attacks at 2 hours per customer per month.
Full service analysis
Darktrace MDR investigates high-priority Enhanced Monitoring alerts and can extend or activate supported containment actions. Your team maintains deployment health, governs response permissions and owns follow-up analysis, remediation and recovery.
- Your team owns
- Maintaining sensor coverage, response configuration and call-home connectivity
- Maintaining escalation contacts and agreeing response authority
- All follow-up analysis and remediation, including recovery and out-of-scope systems
Containment scope
The September 2026 service definition supports extending eligible active actions for 24 hours and activating a pattern-of-life restriction. This limits a device to modeled usual behavior. Other pending Human Confirmation actions require written approval. Verify how the action and eligibility clauses apply to your devices.
Buyer handoff
The service definition assigns follow-up analysis and remediation to the customer. Further analysis of a confirmed active attack is capped at 2 hours per customer per month. Agree additional incident support before treating MDR as an incident-response retainer.
Deployment duties
Readiness consultancy and quarterly reviews advise on configuration. Your team applies recommendations, maintains coverage and resolves deployment issues. The service is delivered in English, and follow-the-sun review can involve another jurisdiction.
Pricing & contract
- Billing
- Custom
Obtain a scoped quote for platform licenses, MDR and any additional incident work. The AWS custom-offer placeholder is not the service price.
Tradeoffs & buying questions
Strengths
-
Provider-led containment within Darktrace
Analysts can apply supported containment measures instead of only forwarding alerts.
-
Investigation records and monthly SOC reports
Investigation records and monthly reports show raised and resolved MDR cases.
-
Readiness checks and scheduled analyst reviews
Readiness consultancy and scheduled analyst reviews help identify deployment issues.
Considerations
-
Deployment health remains your responsibility
Coverage depends on the licensed deployment, connectivity, tagging and reachability that the buyer maintains.
-
Human Confirmation has a pattern-of-life exception
Human Confirmation does not mean every action waits for approval. The service definition includes a pattern-of-life exception.
-
Further attack analysis has a stated monthly cap
Further analysis of confirmed active attacks is limited to 2 hours per customer per month in the September 2026 definition. Wider incident work needs an agreed owner.
Ask before buying
- Which modules and Enhanced Monitoring models does our order cover, including cloud, identity, OT and endpoints?
- How do device eligibility and the pattern-of-life exception interact with Human Confirmation mode in our deployment?
- What do licenses, MDR, partner support, retention, export and incident work beyond the monthly analysis allowance add to the quote?
Integrations
Endpoint
- Darktrace / ENDPOINT
Other integrations
- Darktrace / NETWORK
- Darktrace / IDENTITY
- Darktrace / OT
2 more integrations
- Darktrace / CLOUD
- Darktrace Autonomous Response
Common questions
Does Darktrace MDR replace the entire SOC?
It provides investigation and containment within eligible Darktrace coverage. Your team retains deployment operation, follow-up analysis, remediation and recovery.
Does Human Confirmation require approval for every action?
No. Section 4.1.2 of the 24 September 2026 service definition permits a 24-hour pattern-of-life action even in Human Confirmation mode. Confirm device eligibility and how this exception applies to your deployment.
Does MDR cover every Darktrace product?
No. Coverage depends on the order, licensed modules and readiness checks. The service definition identifies NETWORK or IDENTITY eligibility and conditional OT and endpoint coverage. Specify additional cloud and other module scope in the order.
Company details
- Headquarters
- Cambridge, United Kingdom
- Founded
- 2013