Who does what
Provider
- Operate MDR detection and investigations
- Hunt across contracted sources
- Execute preapproved critical responses
Your team
- Maintain sources and context
- Choose shared detection work
- Approve actions and own recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for Security teams that want an external investigation service while keeping hands-on detection and hunting access
Shared operation beyond a portal
Customer analysts can add sources, write rules, query data and hunt in FusionDetect.
Response needs advance authority
Active critical-incident actions need preapproval. Specialist services require a scope check.
Data volume and retention
Endpoint-based quotes include unlimited ingestion and 12 months of hot retention. Check export terms.
Full service analysis
Kudelski Security MDR ONE Resolute co-manages detection and investigation through shared FusionDetect access, with 24/7 analysts and preapproved response. Your team keeps detection priorities, source access, response permissions and business recovery.
- Your team owns
- Maintain tools, source access and business context
- Choose detection work and approve response procedures
- Own recovery and agree additional forensic or specialist services
Shared operation beyond a portal
Clients can add data sources, create detection rules, query data and conduct hunts in FusionDetect. Kudelski maintains its detection service and analysts investigate continuously. Agree ownership of custom content and follow-up work during onboarding.
Response needs advance authority
The service FAQ ties active response to preapproved actions for incidents at critical risk level. Your team retains decisions outside those permissions. Specialist OT monitoring and the separate incident-response retainer need their own scope checks.
Data volume and retention
Official material describes endpoint-based pricing, unlimited ingestion and 12 months of hot retention. Those terms do not establish unlimited response across every ingested source. Confirm supported data, export arrangements and any extra services in the quote.
Pricing & contract
- Billing
- Per-endpoint, Custom
Pricing is based on endpoint count rather than data volume. Confirm endpoint bands, licenses, export terms and additional response services in the quote.
Tradeoffs & buying questions
Strengths
-
Customer analysts can work in the investigation platform
-
Endpoint-based pricing separates fees from ingestion volume
-
Existing endpoint, cloud and identity tools can feed investigations
Considerations
-
Active response is limited by preapproved procedures
-
Integration does not prove full operation of a connected tool
-
Specialist response and OT services require scope checks
Ask before buying
- Which sources will you investigate, and which actions can you execute under our preapproved procedures?
- Who maintains our custom rules, integrations and detection gaps in the shared platform?
- What endpoint bands, licenses, export terms and additional response services affect the quote?
Integrations
Platform / SIEM
- FusionDetect XDR
Endpoint
- CrowdStrike
- Microsoft Defender for Endpoint
- SentinelOne
Cloud
- AWS
- Microsoft Azure
- Google Cloud Platform
Other integrations
- Okta
- Amazon Security Lake
- Client Portal and Threat Navigator
Common questions
Why is this classified as Co-manage the SOC?
The customer shares detection and investigation work through FusionDetect, including rules, queries and hunts. Kudelski supplies 24/7 analysts and authorized response while the buyer keeps meaningful operational choices.
How is MDR ONE Resolute priced?
The provider describes endpoint-based pricing rather than charges by data volume. Obtain a quote that names the endpoint band, included licenses, export terms and additional response services.