Who does what
Provider
- Investigate endpoint incidents
- Execute authorized containment
- Report actions and next steps
Your team
- Maintain the endpoint deployment
- Set response permissions and contacts
- Complete excluded work and recovery
Coverage
- Endpoints
Details
Service scope
Best for Small and mid-market teams that want managed response on ThreatDown endpoints
ThreatDown endpoints required
The service description requires active EDR and MDR subscriptions and deployment on all customer endpoints. Maintain enrollment, configuration, permissions and reachable contacts.
Standard MDR has response limits
Endpoint containment is included. Broader recovery, third-party response and full forensics remain separate.
Elite differs from Ultimate
Complex malware removal, limited root cause analysis and a contractual notification SLA require MDR Plus.
Full service analysis
ThreatDown MDR in Elite provides 24/7 investigation and permitted endpoint isolation. You maintain the ThreatDown deployment, authorize response and handle recovery and work outside its endpoint tools.
- Your team owns
- Deploy and maintain endpoint agents and permissions
- Provide authorized escalation contacts
- Perform recovery and response outside contracted tools
ThreatDown endpoints required
The service operates on ThreatDown EDR through Nebula or OneView. The service description requires EDR and MDR enrollment across the customer's endpoints. Your team maintains agent health, configuration and permissions.
Standard MDR has response limits
Analysts can isolate devices, terminate processes and remediate through endpoint tools. You retain broader recovery and third-party response. Full forensic investigations and external incident coordination require separate scope.
Elite differs from Ultimate
Elite includes standard MDR. Ultimate adds MDR Plus, including complex malware removal, limited root cause analysis and a contractual notification SLA. Standard MDR timing targets are non-binding service objectives.
Pricing & contract
- Billing
- Per-endpoint, Tiered
Elite is a device-based bundle with standard MDR. Confirm annual term, device quantity, server and identity add-ons and partner support charges. The service requires EDR and MDR subscriptions and deployment across all customer endpoints.
Tradeoffs & buying questions
Strengths
-
Endpoint response actions extend beyond alert forwarding
-
Elite bundles the endpoint platform and MDR
-
OneView supports MSP management of customer sites
Considerations
-
Requires the ThreatDown endpoint stack
-
Identity and server licensing need separate quote checks
-
Complex malware removal and the contractual SLA require MDR Plus
Ask before buying
- Which actions can analysts take without contacting us, and who handles an unreachable emergency contact?
- What does our annual device quote include for servers, identity protection and partner support?
- Which incident work requires MDR Plus, and which response timing is a contractual commitment?
Integrations
Endpoint
- ThreatDown EDR
Other integrations
- ThreatDown Nebula
- ThreatDown OneView
Common questions
Does Elite include MDR Plus?
No. Elite includes standard MDR. Ultimate adds MDR Plus services and its contractual notification SLA.
Can ThreatDown respond without our team?
Analysts can execute endpoint containment and remediation within granted permissions. You must maintain authorized contacts and complete escalated actions and recovery.