Who does what
Provider
- Investigate supported security telemetry
- Provide 24/7 analyst coverage
- Execute configured containment playbooks
Your team
- Maintain connected security controls
- Approve response playbooks and source scope
- Remediate beyond contracted response coverage
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for Teams keeping existing EDR tools while adding 24/7 MDR
Connected sources
Investigation support and response actions differ by integration. A source stored in the data lake does not automatically receive the same detection or containment coverage.
Remediation add-on
Hands-on Active Remediation requires a separate add-on for enrolled MDR endpoints. Supported isolation playbooks do not cover every remediation task.
Current identity
Red Canary became Zscaler MDR in September 2026. Some documentation, integrations and marketplace contracts still use the Red Canary name.
Full service analysis
Zscaler MDR is the current name for Red Canary. It combines analysts and operational AI with connected-tool investigations and response playbooks. Buyers retain the underlying controls, permissions and work beyond the contracted response scope.
- Your team owns
- Approving which response playbooks can run automatically
- Remediation work outside supported EDR remote actions or Active Remediation scope
- Maintaining the endpoint, identity, cloud and email controls that feed Red Canary
- Confirming whether each data source is investigated, used for context or stored only
Operating scope
Zscaler MDR supplements the buyer’s SOC with investigations and permitted containment across supported controls. It does not transfer ownership of source deployment, business decisions or complete recovery.
Response boundary
Playbooks can isolate endpoints, suspend identities or block network indicators through supported integrations. Active Remediation remains a separate annual add-on for enrolled MDR endpoints, with remote-response limits.
Current identity
The September 2026 release notes identify Red Canary as Zscaler MDR. Marketplace listings and some integration names retain the old brand. Confirm the current contracting entity and entitlement names when ordering.
Commercial scope
The AWS listing separates endpoint, account, cloud-resource and network coverage dimensions. A single endpoint price is not the total cost of multi-domain coverage, underlying security products or remediation add-ons.
Pricing & contract
$120/endpoint/year
AWS Marketplace AWS Marketplace lists this endpoint dimension for a 12-month contract under the Red Canary name. Identity, cloud and network dimensions, add-ons and usage charges are separate.
AWS Marketplace · endpoint dimension · 12-month contract. Accounts, cloud resources, network coverage and add-ons are separate.
- Billing
- Per-endpoint, Per-user, Per-asset, Custom
Tradeoffs & buying questions
Strengths
-
Keeps supported tools while adding investigation
Preserves supported security tools while adding analyst investigations
-
2026 reviewers describe less triage and clearer incident context
2026 customer accounts describe less alert triage and useful incident context
-
Response playbooks support automation or approval
Response playbooks support buyer-selected automation or approval
Considerations
-
Active Remediation requires an add-on
Hands-on Active Remediation is an additional subscription
-
Investigation and response depth varies by source
Response actions depend on the integration and granted permissions
-
Reviewers cite limits in customization and investigation control
Some reviewers cite customization and investigation-control limits
-
Legacy package names need confirmation in the current quote
Older Core, Complete and Enterprise package descriptions need reconfirming after the rebrand
Ask before buying
- Which included data sources are investigated, context-only or storage-only?
- Which response actions run automatically, and which need confirmation?
- Are Active Remediation, Managed Phishing Response and Security Data Lake included or separate?
Customer feedback
Customers value
-
March–June 2026 customer accounts value less alert triage
-
Reviewers describe useful investigation context
-
Customer accounts value overnight coverage and analyst access
Reported concerns
-
2026 reviews cite cost and customization limits
-
Some customers report delays or limited follow-up
-
These accounts predate the September Zscaler MDR rebrand
Integrations
Endpoint
- CrowdStrike Falcon Insight XDR
- Microsoft Defender for Endpoint
- SentinelOne Singularity
2 more integrations
- Carbon Black Cloud
- Palo Alto Cortex XDR
Cloud
- AWS
- Azure
- GCP
Other integrations
- Microsoft Entra ID
- Okta Workforce Identity
- Google Workspace
4 more integrations
- Microsoft Defender for Office 365
- Cisco Duo
- Cisco Umbrella
- Zscaler OneAPI
Common questions
Is Zscaler MDR the same service brand as Red Canary?
The September 2026 release notes rename Red Canary to Zscaler MDR. Some marketplace and integration names still use Red Canary. Confirm the current contract’s source coverage and response entitlements.
Does Zscaler MDR require an agent?
The MDR layer uses supported third-party telemetry. Endpoints need appropriate sensors, and the optional Linux EDR service deploys its own sensor.
What does Zscaler MDR pricing cover?
AWS Marketplace lists $120 per endpoint for 12 months. Accounts, cloud resources and network coverage are separate dimensions. Confirm quantities, included services and add-ons.