MXDR

• 24/7 security coverage

  Threats don’t stop outside working hours. Continuous monitoring, investigation and response helps keep your organisation protected around the clock.

• Protect your full IT estate

  Monitor identities, endpoints, cloud services, email, infrastructure, networks and applications through a single managed security service.

• Detect and respond faster

  Automation and experienced security analysts help identify, investigate and contain threats before they become larger incidents.

• Reduce the burden on IT teams

  Outsource monitoring, triage and response activities so internal teams can focus on strategic projects and day-to-day support.

• Maintain data sovereignty

  Security data remains within your Microsoft environment, helping simplify governance, support compliance and provide full visibility into your security operations.

• Continuous security improvement

  Benefit from threat intelligence, threat hunting, regular reviews and ongoing recommendations that strengthen your security posture over time.

Frequently asked questions (FAQs)

• What is MXDR?

  MXDR stands for Managed Extended Detection and Response or managed XDR. It’s a form of managed security service. Good MXDR services will detect, investigate and respond to threats across your entire estate, covering identities, email, infrastructure, networking, data and applications, whether they sit on-premises or in the cloud. Our “What is MXDR?” article covers this in more detail.

• What data sources does MXDR cover?

  Our MXDR service covers identities, email, infrastructure, networking, data and applications, whether on-premises or in the cloud. It can also ingest events from any other API or data source, including non-Microsoft platforms and multi-cloud environments such as AWS and Google Cloud, reducing gaps in visibility.

• Do you build custom detection rules and playbooks for our environment?

  Yes, alongside our standard detection rules and playbooks, we build custom ones specific to your environment, with proactive cyber threat intelligence so detection reflects the risks that actually apply to your organisation, rather than a generic baseline.

• What ongoing reporting, hunting and support do I get with MXDR?

  Our MXDR services include extended threat hunting, regular service governance reviews, and reporting on SLA performance, incident activity and recommendations, typically monthly to start and then quarterly. You also get ongoing security advisory input to help shape your wider security roadmap.

• What happens when I move to MXDR, is there a smooth transition?

  Yes, onboarding is straightforward. We connect to your Microsoft environment using Azure Lighthouse, Microsoft’s delegated resource management technology, giving our SOC a single, centralised connection without needing separate admin accounts or taking ownership of your environment.

• What’s the difference between Chorus’s MDR and MXDR services?

  Our MDR service protects endpoints, identities and servers, while MXDR expands that coverage to any data source, including on-premises, network and multi-cloud environments, alongside more advanced automation and custom playbooks. Firewall and network log sources are included as standard with MXDR, but they’re a paid add-on with MDR. Both services include 24/7 monitoring, detection and response, threat hunting, incident response, threat intelligence, and governance and reporting. Our MDR page covers that service in full, and our EDR vs XDR vs MDR vs MXDR article explains how these different technologies and services relate.

• Do I need Microsoft Sentinel for MXDR?

  You don’t need to have deployed Sentinel beforehand, as we can assess your existing environment, licensing and security requirements as part of onboarding.

  Microsoft Sentinel is a core component of how we deliver MXDR services, providing security information and event management (SIEM) capabilities alongside security orchestration, automation and response (SOAR). This allows security events to be collected, correlated and investigated, while agreed response actions can be automated to help contain threats more quickly.

• What Microsoft technologies does the MXDR service use?

  Our MXDR service is primarily built on Microsoft Defender XDR, Microsoft Defender for Cloud, Microsoft Sentinel and Microsoft Entra ID. We hold Microsoft Advanced Specialisations in Threat Protection and Cloud Security, so we work with these technologies in depth.

• Can Chorus MXDR protect non-Microsoft and multi-cloud environments?

  Yes, our MXDR service can ingest and cover data from any source, including on-premises infrastructure and multi-cloud environments such as AWS and Google Cloud, alongside your Microsoft estate including Azure. One additional data source is included free, with a cost per source after that.

• What are your SLAs for MXDR?

  For high severity incidents, we complete the response action itself, not just an acknowledgement, within 30 minutes as standard. In practice, our current average time to acknowledge is under 5 minutes, with most incidents closed within 20 minutes.

• Why do organisations use MXDR instead of building their own SOC?

  Building an in-house Security Operations Centre (SOC) means recruiting specialist analysts, running tooling and covering it around the clock, which most SMBs don’t have the resources to justify. MXDR gives you that same level of coverage, but as a managed service, so you get 24/7 protection without having to build and staff the SOC yourself. We cover this in more detail in our articles such as:

  • What is a Security Operations Centre (SOC)?
  • The benefits of partnering with a managed security service provider
  • The benefits of outsourced cyber security
• What Microsoft licensing do I need for MXDR?

  As a general guide, Microsoft Defender Suite is best for our MXDR service. We can support you with any licensing discussions, ensuring you get maximum value from your Microsoft licences.

• How much does MXDR cost?

  Pricing is per-user, per-server per-month. One firewall ingestion is included with MXDR and any additional sources have a cost. For an accurate quote, please get in touch letting us know how many users and servers you have an if any data sources need ingesting.

• Does MXDR help with compliance?

  Yes, our MXDR service supports alignment with frameworks including ISO 27001, Cyber Essentials, Cyber Essentials Plus, GDPR, NIS2, DORA and NIST, and onboarding includes hardening your environment against CIS benchmarks.

• How do you handle and retain our data?

  All data stays within your own Microsoft tenant and region. We apply least-privilege access and don’t use third-party agents to collect it. Logs are retained for 12 months, and data related to a specific incident is enriched and available for up to 30 days to support investigation and reporting.

  This means no agents or third-party solutions holding your data, which simplifies governance and compliance and gives you complete visibility into the service within your Microsoft Sentinel environment.

• Where do you provide MXDR services?

  Headquartered in the South West of England as a Bristol-based business, Chorus delivers MXDR services remotely to organisations across the UK and internationally. Our 24/7 Security Operations Centre supports customers regardless of location, allowing us to provide continuous monitoring, investigation and response wherever your teams operate.

Companies we work with