Who does what
Provider
- Investigate included Cortex incidents
- Hunt threats and report findings
- Execute authorized endpoint actions
Your team
- Maintain Cortex licenses and access
- Set permissions and declare incidents
- Complete recovery beyond the subscription
Coverage
- Endpoints
Details
Service scope
Best for Cortex customers needing managed investigation and endpoint response
Contracted incidents
Endpoint and extended-data SKUs differ. Built-in detection coverage does not include requested custom detections or playbooks.
Response permissions
Onboarding defines remediation authority. Supported endpoint actions include isolation, quarantine and process termination.
Additional services
Cortex licensing and deployment are separate. Wider incident response and Managed XSIAM SOC engineering have their own scope.
Full service analysis
Unit 42 MDR investigates Cortex incidents 24/7 and can isolate endpoints, quarantine files or terminate processes within the chosen response permissions. You retain platform upkeep, incident declaration and recovery beyond the subscription's actions.
- Your team owns
- Maintain platform licenses, agents and access
- Define response permissions and keep escalation contacts available
- Declare incidents and complete recovery or separately commissioned incident response
Detection scope
The January 2026 service description separates endpoint and extended-data subscriptions. Its XDR coverage is limited to cases generated by built-in detectors and automations. The subscription excludes monitoring, response and implementation of requested custom detections, playbooks or correlation rules.
Containment and incident response
Unit 42 documents endpoint isolation, file quarantine, process termination and other Cortex actions. Onboarding sets response permissions. The buyer still declares incidents and handles recovery, while broader Unit 42 incident-response services require separate scope.
Platform and minimums
Cortex licenses are separate. The service description requires at least 200 Cortex XDR Pro agents for XDR subscriptions or 1,000 for XSIAM variants, plus completed deployment through separately purchased services. Managed XSIAM's wider SOC engineering is a separate offer.
Pricing & contract
- Billing
- Custom
Separate the MDR subscription, Cortex licenses, deployment services and any wider incident-response engagement in the quote.
Tradeoffs & buying questions
Strengths
-
Documented endpoint response actions
Concrete endpoint response actions documented in the service contract
-
Endpoint and extended-data options
Endpoint and extended-data subscription options
-
Cortex visibility into findings and actions
Investigation findings and actions visible in Cortex
Considerations
-
Separate platform licenses and deployment
Cortex licenses and deployment are additional requirements
-
Custom detections and playbooks excluded
Custom detections and playbooks are excluded from this subscription
-
Wider incident response and recovery need separate scope
Broader incident response and recovery require separate ownership
Ask before buying
- Which endpoint or extended-data SKU covers our sources, and which cases created by custom rules are excluded?
- Which response actions are authorized, and when does an escalation require a separate Unit 42 incident-response SOW?
- Does the quote include Cortex licenses, deployment, retention and the minimum agent quantity for our platform?
Integrations
Endpoint
- Cortex XDR Pro
Other integrations
- Cortex XSIAM Enterprise or Enterprise Premium variants
Common questions
Does Unit 42 MDR include every Cortex data source?
No. Endpoint and extended-data subscriptions have different scope. Confirm which Cortex-generated incidents are included. Custom detections, playbooks and correlation rules are excluded from the January 2026 MDR subscription.
Is this the same as Unit 42 Managed XSIAM?
No. Managed XSIAM adds continuous SOC engineering. This profile covers the MDR subscription, including its XSIAM variants, without assigning that broader operational scope.