Who does what
Provider
- Investigate and hunt threats
- Execute permitted module actions
- Communicate incidents and findings
Your team
- Choose modules and permissions
- Maintain deployment and contacts
- Finish excluded response and recovery
Coverage
- Endpoints
Details
Service scope
Best for Organizations and MSPs adopting Heimdal modules that want configurable SOC response authority
Permissions are set by module
Authorize isolation, quarantine or other actions, or retain execution with notification-only settings.
Coverage follows the module quote
Confirm the actual endpoint, DNS, email, privilege and patch modules and their SOC duties.
Patching needs separate authority
Patch changes require enabled modules and permissions. Broader IT maintenance and recovery need agreement.
Full service analysis
Heimdal MXDR investigates threats 24/7 and can isolate endpoints or quarantine files through your licensed Heimdal modules. You or your reseller choose which actions the SOC may execute and retain notification-only work, deployment and recovery outside the agreed scope.
- Your team owns
- Choose module-specific action and notification permissions
- Maintain deployment and emergency contacts
- Complete excluded work and business recovery
Permissions are set by module
MXDR ADAPT lets you authorize action or retain it through notification. Permissions include endpoint isolation, file quarantine and remote sessions. Resellers can route notifications to themselves or the customer, so the escalation owner must be explicit.
Coverage follows the module quote
The SOC uses Heimdal's platform. Its bundle page combines MXDR with XDR tools, while the calculator also lets buyers select individual modules. Confirm the actual endpoint, DNS, email, privilege and patch modules included in your quote.
Patching needs separate authority
ADAPT can permit application installation, removal and OS updates where patch modules are enabled. Those controls do not establish unlimited IT maintenance or recovery. Agree changes, exclusions and the work your own team must finish.
Pricing & contract
- Billing
- Per-endpoint, Custom
Official calculator prices MXDR per device/year with separate endpoint/server inputs. Modules and reseller scope determine quote.
Tradeoffs & buying questions
Strengths
-
Response authority is configurable for each module
-
Reseller notification routing makes escalation ownership explicit
-
SOC actions can include authorized patch changes
Considerations
-
Scope depends on the Heimdal modules purchased
-
Notification-only settings retain response work
-
Recovery and forensic boundaries need contract confirmation
Ask before buying
- Which modules and server licenses are included, and what response work does each cover?
- Which ADAPT actions should the SOC execute without us, and who owns notification-only incidents overnight?
- What recovery, forensic work, data retention and incident charges are included in our service agreement?
Integrations
Endpoint
- Heimdal Endpoint Detection and Response
Other integrations
- Heimdal Threat-Hunting and Action Center
Common questions
Can the Heimdal SOC act without contacting us?
Yes, when Allow MXDR to Action is selected for the relevant module and action. Notify Customer or Notify Reseller settings retain the next action with that party.
Does MXDR automatically include every Heimdal product?
The published MXDR bundle includes XDR tools, but modular quotes also exist. Check the actual licenses and SOC duties in your order rather than assuming all portfolio products are covered.