Who does what
Provider
- Monitor and investigate supported XDR alerts
- Report on investigations and security posture
- Execute pre-approved platform containment actions
Your team
- Deploy sensors and maintain integrations
- Set response authority and supply investigation context
- Handle remediation beyond contracted support
Coverage
- Endpoints
- Network
- Cloud Workloads
Details
Service scope
Best for Teams wanting Dell-operated MDR on supported CrowdStrike, Microsoft or Sophos platforms
Platform scope
The order names the platform and modules. The CrowdStrike endpoint service differs from the broader XDR service, including retention and configuration support.
Response authority
Dell can isolate hosts or block files when supported and pre-approved. You maintain sensors, access, contacts and investigation context.
Included hours
The CrowdStrike endpoint contract includes up to 40 remote incident-response initiation hours per year. Broader variants have different configuration support. Additional time costs extra.
Full service analysis
Dell Managed Detection and Response is an MDR service where Dell SOC analysts monitor supported XDR or EDR telemetry, investigate threats and take pre-approved containment actions such as host isolation or file blocking inside the platform. Buyers still own platform access, endpoint sensor coverage, investigation context and remediation work that falls outside the contracted response and incident response hours.
- Your team owns
- Pre-approving which threat response actions Dell may take in the platform
- Keeping endpoint sensors, integrations, bandwidth, credentials and authorized contacts current
- Providing business context, files, logs and access during investigations
- Handling remediation beyond included threat response, security configuration and incident response hours
Why contain-threats lane
Dell service descriptions support analyst investigation plus pre-approved threat response actions in the platform. Public examples include host isolation and file blocking, so this goes beyond advice, but it is still narrower than co-managing the buyer's whole SOC.
Platform boundary
Dell lists CrowdStrike, Microsoft and Sophos as platform options. The current legal library separately lists endpoint and broader XDR services. Their modules, retention and configuration entitlements differ. Backup protection, vulnerability management and recovery retainers are separate services.
Response boundary
Dell can take agreed platform actions, but the customer still has to deploy sensors, maintain integrations, supply investigation context and handle work outside the included response and configuration hours.
Pricing & contract
- Billing
- Per-endpoint, Custom
Quote-based. Dell service descriptions describe order-form pricing, contracted endpoint counts, monthly subscription billing and auto-renewal terms, but no numeric public list price.
Tradeoffs & buying questions
Strengths
-
Contract describes onboarding, response, reporting and IR initiation
Clear contract language for onboarding, detection, response, quarterly reporting and incident response initiation
-
Service-only option with required customer platform licenses
Supports service-only buying when the customer already licenses required platform components
-
Pre-approved containment goes beyond alert notification
Pre-approved platform response actions make the service more active than alert-only monitoring
-
MDR included in Dell Type 2 SOC 2 scope
Dell's trust center lists MDR under Type 2 SOC 2 scope
Considerations
-
Request a scoped per-endpoint quote
Public pricing does not show a numeric list price
-
Coverage depends on contracted platform and modules
Service scope depends heavily on the platform and modules named in the order form
-
Buyer maintains deployment, access and investigation context
Customers must maintain endpoint deployment, integrations, authorizations and investigation context
Ask before buying
- Which endpoint or XDR variant and modules are quoted, and which platform licences must we buy separately?
- Which response actions are pre-approved, and who authorizes changes after onboarding?
- Which response and configuration hours are included, when do they expire and what does extra time cost?
Integrations
Platform / SIEM
- CrowdStrike Falcon Next-Gen SIEM (XDR variant)
- Microsoft Sentinel (Microsoft variant)
Endpoint
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
Other integrations
- Sophos Taegis XDR
- CrowdStrike Falcon Data Replicator
- Dell ITSM portal
Common questions
Does Dell MDR only notify the customer after an alert?
No. This profile classifies Dell Managed Detection and Response as Contain threats because service descriptions say Dell analysts investigate detections and can perform pre-approved threat response actions through the supported platform. Buyers still need to define those actions during onboarding.
Which platforms does Dell MDR support?
Dell currently lists CrowdStrike, Microsoft and Sophos. Its legal library separates CrowdStrike endpoint and broader XDR variants, plus Microsoft and Taegis-based services. Confirm modules, retention and customer-supplied licences for the exact service ordered.
Is Dell MDR pricing public?
No numeric list price was visible in public sources. Service descriptions point to order-form pricing, contracted endpoint counts, subscription billing and renewal terms, so buyers need a scoped quote that separates platform licenses from Dell managed service fees.
Company details
- Headquarters
- Round Rock, Texas
- Founded
- 1984