Who does what
Provider
- Operate contracted MDR with CrowdStrike
- Investigate and coordinate response
- Perform agreed containment and remediation
Your team
- Maintain deployment access and covered telemetry
- Agree action permissions and emergency contacts
- Own business recovery and out-of-scope changes
Coverage
- Endpoints
- Identity & Access
- Cloud Workloads
Details
Service scope
Best for Teams adopting CrowdStrike who want Kroll deployment and response support
Service scope
Falcon Complete-backed MDR with Kroll response operations. Identity, cloud and SIEM coverage depend on contracted modules.
Response authority
The service includes investigation, containment and remediation. Agree which team can act on each system and the approval boundary.
Package boundary
APEX, advisory services, warranty terms and wider SIEM work need explicit entitlement confirmation.
Full service analysis
Kroll Responder MDR combines CrowdStrike Falcon Complete with Kroll response operations and incident-response expertise for investigation, containment and remediation. Your team retains deployment access, action approvals and business recovery outside the contract.
- Your team owns
- Maintain deployment access and covered telemetry
- Agree action permissions and emergency contacts
- Own business recovery and out-of-scope changes
Current platform
Kroll reported in August 2026 that it had migrated its global MDR client base onto CrowdStrike Falcon Complete. This profile follows that current service. Older Microsoft marketplace offers do not establish an alternative for a new contract.
Who performs the work
Falcon Complete provides the underlying MDR operation. Kroll adds deployment and response operations plus incident-response services. Specify the action owner, escalation path and included entitlements in the order.
Additional programs
Kroll also markets APEX, SIEM implementation, advisory work and an incident warranty. Confirm each entitlement separately. Program announcements and broad service pages do not make every feature part of the base MDR contract.
Pricing & contract
- Billing
- Custom
Request a current Falcon-based quote separating platform licences, SIEM ingestion, Kroll response operations, incident-response entitlements and optional programs. Older Microsoft listings and Redscan warranty language do not establish the scope of a new order.
Tradeoffs & buying questions
Strengths
-
Combines an established MDR operation with Kroll response expertise
-
Current platform consolidation makes tool dependency explicit
Considerations
-
Current offer centers on the CrowdStrike stack
-
Older platform and warranty descriptions need current-order confirmation
Ask before buying
- Which actions are performed by Kroll, CrowdStrike and our team, and what requires approval?
- Which endpoint, identity, cloud, SIEM and incident-response entitlements are included in this quote?
- Which warranty, data-export and exit terms apply to the current Falcon-based service?
Integrations
Platform / SIEM
- CrowdStrike Falcon Next-Gen SIEM (contracted scope)
Endpoint
- CrowdStrike Falcon
Other integrations
- Falcon Identity (contracted scope)
Common questions
Can we use the old Microsoft Sentinel version?
Older marketplace listings remain discoverable, but Kroll describes its current MDR base as migrated to CrowdStrike. Confirm any proposed exception in writing.
Is all incident recovery included?
Kroll describes response and remediation services. Agree covered systems, included response work and any separate recovery or advisory charges.