Who does what
Provider
- Investigate subscribed security sources
- Perform supported, permitted containment
- Report findings and remediation steps
Your team
- Deploy products and maintain access
- Choose approval settings and exceptions
- Complete wider remediation and recovery
Coverage
- Endpoints
- Cloud Workloads
- Network
Details
Service scope
Best for Trend customers needing managed investigation with configurable response authority
Subscribed modules
Endpoint, workload, email and network coverage follows the purchased service and product licenses.
Action permissions
Automatic and manual approval choices control containment. Endpoint exceptions can restrict automatic actions.
Deployment and IR
Onboarding links deployed products. Standalone MDR excludes wider onsite and remote incident-response services.
Full service analysis
TrendAI Vision One MDR analysts investigate subscribed security sources 24/7 and can isolate endpoints, disable accounts or quarantine email when supported and authorized. You retain product deployment, approval settings and recovery outside the managed actions.
- Your team owns
- Deploy licensed products and maintain their connections
- Set response approvals, endpoint exceptions and reachable contacts
- Complete remediation and recovery beyond supported managed actions
Module boundaries
The current FAQ separates users, servers and workloads from the network MDR subscription. Messaging is included with the former service subscription, but still requires messaging XDR licenses. Supported modules can be purchased independently, so a Vision One deployment does not imply every source is monitored.
Response approvals
The response-action guide describes endpoint isolation, account disablement, email quarantine and process termination. Customers configure automatic or manual approval and endpoint exceptions. Routine investigation permissions differ from disruptive containment actions.
Deployment and recovery
MDR onboarding links already deployed licensed products and checks configuration. Standalone MDR excludes onsite and remote incident-response services beyond investigations using licensed product data. The broader Complete package has separate incident-response entitlements.
Pricing & contract
- Billing
- Custom
Quote MDR and the underlying product licenses together. The users, servers and workload subscription includes messaging service, but messaging XDR licenses are still required. Network MDR has a separate subscription.
Tradeoffs & buying questions
Strengths
-
Response permissions by action
Documented response settings for each supported action
-
Modular coverage for Trend products
Modular endpoint, workload, email and network coverage
-
Defined onboarding and escalation workflow
MDR-specific onboarding and escalation workflow in Vision One
Considerations
-
Product deployment and licenses required
Underlying product deployment and licensing remain necessary
-
Network and wider incident-response entitlements are separate
Network MDR and wider incident-response services have separate entitlements
-
Actions depend on products and permissions
Containment depends on connected products and the customer's permission settings
Ask before buying
- Which endpoint, workload, email and network MDR subscriptions and underlying XDR licenses are included?
- Which actions run automatically, which need approval and which critical endpoints should be excluded?
- What retention, regional data handling, incident-response hours and renewal costs apply to this package?
Integrations
Endpoint
- TrendAI Vision One Endpoint Security
Other integrations
- TrendAI Vision One Server and Workload Protection
- TrendAI Vision One Email and Collaboration Security
- TrendAI Vision One Network Security
Common questions
Does a Vision One license include MDR?
Confirm the service entitlement separately. The underlying security products, MDR subscriptions and broader services bundles have different scope. A platform license alone should not be treated as managed monitoring.
Can we require approval before isolation or email quarantine?
Yes. The MDR setup supports automatic or manual approval for listed response actions and endpoint exceptions. Keep contacts available for actions requiring approval.
Company details
- SOC regions
- North America, Europe / UK, APAC