Who does what
Provider
- Investigate actionable alerts
- Hunt and document findings
- Escalate with remediation guidance
Your team
- Maintain collectors and data feeds
- Approve and implement changes
- Perform direct remediation
Coverage
- Endpoints
- Network
Details
Service scope
Best for Teams retaining remediation staff while outsourcing alert investigation
Response scope
Base Lightning MxDR investigates and advises. MEDR and Network Protect add separately contracted response actions.
Data terms
One-year retention and standard-source ingestion include a 3 GB per user per month condition. SIEM access and longer retention have separate SKUs.
Escalation
The SLA starts after case classification. Full critical or high-alert investigation is described as available on customer request.
Full service analysis
SilverSky Lightning MxDR investigates alerts from agreed log sources around the clock and sends remediation guidance through customer-specific escalation playbooks. You maintain the collectors and data feeds, approve changes and carry out direct remediation unless separate managed endpoint or firewall services authorize SilverSky to act.
- Your team owns
- Maintain collectors, connectivity and sufficient-quality data
- Approve changes and implement remediation instructions
- Purchase and authorize additional endpoint or firewall response services if needed
Base service and containment
The Lightning attachment promises investigation and response guidance. Executed containment depends on separate MEDR or Network Protect scope. Elite and Complete customers can enable MEDR under their own attachments, so the package name alone does not establish response authority.
Ingestion and retention
The attachment includes one year of retention and standard-source ingestion with an average allowance of 3 GB per user per month. Longer retention and SIEM access have separate SKUs. Confirm the treatment of nonstandard sources and higher volumes.
Investigation and notification
The published SLA measures notification after case classification rather than from the first malicious event. Full investigation of critical or high alerts is described as available on customer request. Set escalation contacts and investigation expectations during onboarding.
Pricing & contract
- Billing
- Per-user, Custom
The base attachment prices users, servers and light users separately. Installation, SIEM access and extended retention have separate SKUs.
Tradeoffs & buying questions
Strengths
-
Documents the boundary between guidance and executed response
-
Provides visibility into notified and unnotified alerts
-
Defines source ingestion and retention terms
Considerations
-
Direct remediation remains with the buyer under the base service
-
Standard ingestion has a per-user volume condition
-
Full high-severity investigation can require a customer request
Ask before buying
- Which actions can SilverSky execute under our MEDR or Network Protect attachments, and which stay with us?
- Which sources fit the 3 GB per user per month allowance, and what costs apply beyond it?
- Which investigations require our request, and when does the notification SLA clock start?
Integrations
Other integrations
- SilverSky Lightning platform
Common questions
Does Lightning MxDR include endpoint isolation?
The base attachment links endpoint containment to a subscribed MEDR service with a deployed agent. Confirm the exact endpoint package, permitted actions and approval rules.
Is ingestion unlimited?
The standard-source allowance is described as an average of up to 3 GB per user per month. Confirm other sources, higher volumes and any additional charge in the quote.