Who does what
Provider
- Monitor and investigate contracted signal sources
- Execute supported containment under agreed rules
- Provide incident handling and package-specific hunting
Your team
- License endpoint tools and maintain source access
- Set response permissions and business exceptions
- Own business decisions and recovery outside scope
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for Teams needing approved containment across a mixed security stack
Containment scope
Response includes supported host, connection and account actions under agreed rules. Professional includes endpoint, identity and cloud response. Custom response orchestration starts with Enhanced.
Package boundaries
Professional, Enhanced and Elite differ. Enhanced adds hunting and 90-day Atlas SIEM logs. Elite adds 365-day logs and a DFIR retainer. Network detection is an add-on.
Buyer responsibilities
You license the underlying EDR, maintain integrations and set response authority. Define recovery assistance and forensic work separately from routine incident handling.
Full service analysis
eSentire MDR combines the Atlas platform with 24/7 analysts to investigate and contain threats in covered sources. Professional, Enhanced and Elite have different hunting, log and response-orchestration entitlements. The buyer supplies licensed EDR, access and response permissions, and owns business decisions and work outside contracted incident support.
- Your team owns
- Licensing supported EDR and maintaining source integrations and credentials
- Setting response permissions, contacts and business exceptions
- Handling business decisions and recovery outside the agreed incident-support scope
- Selecting the package and add-ons for hunting, logs, network detection and forensic response
Response ownership
The service documents host isolation, account suspension and other supported response actions. The buyer still sets permissions and source access. Incident handling can include recovery assistance, so the boundary is the contracted work rather than a claim that every remediation task stays with the buyer.
Package boundary
Current Professional, Enhanced and Elite packages supersede the older Essentials, Advanced and Complete names still visible in some assets. Hunting, Atlas SIEM logs and customizable response orchestration start with Enhanced. Elite includes a DFIR retainer. The entry rate does not include all those capabilities.
Price basis
The official store quotes per user with annual billing and a required recurring launch and optimization fee. It assumes customer-licensed EDR. Its user-based package table is the price source here rather than older endpoint-count marketing tables or private marketplace offers.
Pricing & contract
$17/user/mo + $2,500/year Official US-dollar Professional rate for 10–100 users with annual billing. Ten-user minimum totals $4,540/year. EDR licensing and add-ons are separate. This is not the Enhanced or Elite price.
Professional · 10–100 users · annual billing · $2,500/year required fee · BYO EDR
- Billing
- Per-user, Tiered, Custom
Tradeoffs & buying questions
Strengths
-
Supported endpoint, identity and cloud containment
Supported containment across endpoint, identity and cloud sources
-
Works with compatible client-licensed endpoint tools
Uses compatible client-licensed endpoint tools
-
Published package rates and feature boundaries
Public per-user rates and a package comparison support a scoped cost calculation
Considerations
-
Annual service fee and EDR licences add to the rate
The recurring annual fee and EDR licences add to the per-user rate
-
Hunting, logs and custom orchestration require higher tiers
Hunting, log detection and custom response orchestration require Enhanced or Elite
-
Response depends on integration access and permissions
Integrations and permissions constrain available response actions
Ask before buying
- Which containment actions can each selected integration execute, and which need approval or Enhanced response orchestration?
- Which Professional, Enhanced or Elite package and add-ons cover our sources, hunting, retention and DFIR needs?
- What is the annual total including launch and optimization, licensed EDR, add-ons and any recovery work outside the package?
Customer feedback
Customers value
-
A June 2026 G2 user describes responsive analysts and useful after-hours coverage
-
May 2026 G2 users describe device containment and integration support
Reported concerns
-
A June 2026 reviewer reports switching between consoles during investigations
-
The cited reviews are incentivized and do not validate every package
Integrations
Platform / SIEM
- Atlas SIEM (Enhanced and Elite)
Endpoint
- CrowdStrike
- SentinelOne
- Microsoft Defender for Endpoint
1 more integrations
- Palo Alto Networks
Other integrations
- Atlas endpoint agent
- Microsoft 365 reported-phishing inbox
Common questions
Does eSentire MDR only notify the customer?
No. The service can execute supported containment under agreed policies. Check permissions and source-specific actions. Enhanced and Elite add customizable response orchestration.
What differs between the current Atlas packages?
Professional includes endpoint, identity and cloud response plus reported-phishing investigation. Enhanced adds hunting, log detection with 90-day retention and custom response orchestration. Elite adds 365-day retention and a DFIR retainer. Network detection is an add-on.
Is eSentire MDR pricing public?
The official US-dollar store lists Professional at $17 per user per month for 10–100 users, billed annually, plus a mandatory $2,500 annual launch and optimization fee. Ten users cost $4,540 annually before licensed EDR and add-ons. Higher packages and larger volumes have different prices.
Company details
- Headquarters
- Waterloo, Ontario
- Founded
- 2001
- SOC regions
- North America, Europe / UK