Do you need an EDR for a managed SOC?

In practice, yes. The EDR (Endpoint Detection and Response) is a managed SOC’s main source of information on endpoints and servers, and its main way to act: for example, it lets the SOC isolate a compromised machine remotely. A SOC without an EDR sees far less and acts far more slowly. Conversely, an EDR without a SOC raises alerts that nobody handles at night.

This article is part of our series on managed SOC. For the general principle, see SOC for MSP: what it is and how it works.

What the EDR gives the SOC

Visibility. The EDR records what happens on each machine: programs started, network connections, files changed. That lets the SOC reconstruct an attack and understand whether a device has been compromised and what the attacker did on it.

The means to act. The EDR allows remote action: isolating a device from the network, killing a process, quarantining a file. For a SOC, this is what makes it possible to move quickly from detection to containment.

Detections. The EDR itself detects many malicious behaviours. The SOC works these detections, cross-checks them with other sources and discards false positives.

What the SOC gives the EDR

An EDR is only a tool. Its alerts need to be read, understood and acted on, at any hour. Without a SOC:

• night and weekend alerts wait until Monday morning;
• weak signals, low-severity on their own, go unnoticed;
• false positives wear teams down until some alerts get ignored.

We cover these blind spots in The 3 weak signals an EDR cannot see without a SOC and Why are your clients (still) vulnerable despite your EDR?.

Can a SOC work without an EDR?

Technically, a SOC can monitor other sources: Microsoft 365, firewalls, Active Directory. It will catch some attacks, especially those that go through mail. But it will remain blind to what happens on endpoints and servers, where ransomware runs, and it cannot isolate a machine. For serious monitoring, the EDR is the foundation.

Which EDR for a managed SOC?

The right EDR is one the SOC can use in depth: event collection, detections and, above all, remote response actions. That takes native integration, not just alerts received by email.

At Cyna, native integration covers two EDRs: SentinelOne and Microsoft Defender.

• If your endpoints already run one of them, Cyna connects to the EDR in place.
• If you have no EDR, or use a different one, you will need to plan a deployment of, or migration to, SentinelOne or Microsoft Defender.

The terms (scope, licences, support) are set out in the contract agreed with your partner MSP.

To compare tool families, see EDR, MDR, XDR: what are the differences?.

Preparing the connection: what to check

Before connecting an EDR to a SOC, a few checks help avoid unpleasant surprises:

• Estate coverage. Compare the list of machines reporting to the EDR console with the real inventory. A forgotten laptop, an old server or a recently created virtual machine without an agent are all blind spots.
• Operating mode. An EDR can simply detect, or also block certain behaviours. It helps to know which policy is applied, and on which machines.
• Existing exclusions. Broad exclusions, added to fix a performance issue, can hide malicious activity. They are worth reviewing with the SOC.
• Console access. Who administers the EDR, with which accounts, and are those accounts protected by strong authentication? An attacker who takes over the console can switch protection off.
• Authorised response actions. Isolating a laptop is rarely an issue; isolating a production server often needs prior approval. It is better to decide upfront which actions the SOC can take and which need sign-off.

Other sources to add next

The EDR covers endpoints and servers. For a complete picture, you usually add:

• Microsoft 365 or Google Workspace, for identities and mail;
• firewalls and VPNs, for network access.

See What does a managed SOC monitor?.

Talk to an expert

Want to know whether your estate is ready to be connected? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is an antivirus enough for a managed SOC?

No. An antivirus blocks known threats but offers little visibility and few remote actions. See Antivirus vs EDR: which offers the best protection?.

My EDR is neither SentinelOne nor Microsoft Defender: what now?

Cyna integrates natively with these two EDRs only. If you use another one, a migration to either of them can be supported; the terms are set out in the contract agreed with your partner MSP.

Do servers need an EDR too?

Yes. Servers are prime targets in an attack, especially domain controllers and file servers. Leaving them without an EDR creates a blind spot.

How long does it take to deploy an EDR?

Rolling out the agent across a mid-sized estate usually takes a few days, often through the MSP's existing management tools. Connecting it to the SOC is then quick.

Does an EDR slow endpoints down?

Modern EDRs are designed to have limited impact. If a business application slows down, targeted exclusions can be agreed with the SOC.