Who does what
Provider
- Investigate covered alerts 24/7
- Hunt threats and analyze artifacts
- Execute agreed endpoint containment
Your team
- Deploy and maintain agents
- Set permissions and escalation contacts
- Complete remediation and recovery
Coverage
- Endpoints
Details
Service scope
Best for FortiEDR customers needing managed endpoint investigation and containment
Endpoint stack
Standard MDR requires response-capable FortiEDR. Broader Fortinet products have separate managed-service scope.
Agreed containment
Playbooks define permitted isolation, blocking and other endpoint actions. Your team completes work beyond those permissions.
Deployment and licensing
Confirm cloud deployment, endpoint minimums and required onboarding. The ordering guide excludes on-premises deployments from MDR.
Full service analysis
FortiGuard MDR investigates FortiEDR alerts around the clock and contains threats under agreed playbooks. This profile covers Standard MDR with response-capable FortiEDR, while you retain deployment, response permissions and recovery beyond those actions.
- Your team owns
- Deploy and maintain endpoint agents and service access
- Agree response permissions, exceptions and escalation contacts
- Complete remediation and business recovery beyond contracted endpoint actions
Endpoint service boundary
FortiGuard MDR handles FortiEDR detections. Owning FortiGate firewalls does not establish coverage for network, cloud, OT or email incidents. Basic MDR, Managed XDR and FortiGuard SOCaaS are separate scopes in Fortinet's service and ordering material.
Permissions and recovery
Fortinet's response brief describes containment actions agreed during onboarding and recorded in playbooks. The team supplies remediation guidance alongside those actions. Set approval thresholds and identify who will rebuild hosts, restore services and handle the business incident.
Deployment and commercial scope
The ordering guide distinguishes cloud-managed service from on-premises FortiEDR deployments, which do not support MDR. It also requires Best Practice Service for new EDR or XDR deployments. Confirm the current package and minimum quantity before comparing quotes.
Pricing & contract
- Billing
- Per-endpoint
The service covers the FortiEDR endpoint estate. The ordering guide separates Basic MDR, Standard MDR and Managed XDR bundles, minimum quantities and required Best Practice Service onboarding.
Tradeoffs & buying questions
Strengths
-
Analyst investigation for FortiEDR customers
Adds analyst investigation to an existing FortiEDR deployment
-
Agreed containment playbooks
Records containment responsibilities in agreed playbooks
-
Distinct Basic MDR, Standard MDR and Managed XDR bundles
Separates response-capable MDR from Basic MDR and Managed XDR bundles
Considerations
-
FortiEDR stack and agents required
Requires the FortiEDR service stack and agent deployment
-
Wider product management and recovery need separate scope
Does not include every Fortinet product or a complete recovery service
-
MDR excludes on-premises FortiEDR deployments
On-premises FortiEDR deployment is outside the documented managed-service model
Ask before buying
- Are Standard MDR, FortiEDR licenses and required onboarding included for all endpoints?
- Which endpoint actions are preapproved and which need our approval?
- What minimums, retention, renewal and incident-response charges apply?
Integrations
Endpoint
- FortiEDR
Common questions
Does FortiGuard MDR manage our FortiGate firewalls?
This profile covers Standard MDR for FortiEDR endpoints. Fortinet sells other managed services, and any firewall or wider Security Fabric operations need explicit inclusion in the quote.
Can Fortinet contain threats without asking each time?
Actions depend on the playbooks and permissions agreed during onboarding. Fortinet documents isolation, process blocking and other endpoint actions, with guidance for remediation your team must complete.