OPERATE · Managed Detection & Response
Detection That Ends in Containment, Not Just an Alert.
MDR adds threat hunting, containment and remediation to 24/7 monitoring, so threats are stopped as well as seen.
- Faster detection and containment
- Less dwell time for intruders
- Clear response accountability
- 1Scope and Authority
- 2Telemetry Baselining
- 3Detect and Hunt
- 4Contain and Eradicate
- 5Review and Tune
Executive Summary
- 01MDR turns monitoring into action by pairing investigation with authorized containment.
- 02Hunting finds intrusions that rule-based detection misses, and each hunt strengthens future detection.
- 03Pre-agreed playbooks decide what analysts may do alone and what needs your approval.
The Challenge
Alerts alone do not stop an intrusion; someone has to investigate, contain and remediate.
Many internal teams lack the depth to hunt or the authority to act quickly at night.
The DAAKYI Approach
DAAKYI analysts hunt proactively, investigate detections and take containment actions within playbooks agreed with you in advance.
Remediation guidance or action follows, with a full case record.
- 01
Response playbooks agreed in advance
- 02
Hypothesis-led threat hunting
- 03
Containment within authority
- 04
Remediation and case closure
In Depth
How the Discipline Works
Telemetry Becomes Validated Detections
Endpoint, network, cloud and identity logs are collected, normalized and correlated. Detection logic flags behavior that resembles known adversary techniques. Analysts then validate each detection and separate routine administrative activity from genuine intrusion. Context decides urgency: asset criticality, user role, and whether a change window was open. The output is a confirmed case with evidence, not a raw alert someone must still interpret.
Hunting Finds What Rules Miss
A hunt starts with a hypothesis, such as an attacker abusing remote administration tools to move between servers. Hunters query historical telemetry for that behavior and map findings to MITRE ATT&CK tactics. A hunt ends one of two ways: evidence of compromise that opens an incident, or a documented negative result. Either way, the hunt usually yields a new detection rule that closes the gap permanently.
Containment Under Agreed Authority
Once an incident is confirmed, delay helps the attacker. Pre-approved playbooks define which actions analysts may take alone, such as isolating a host or disabling an account, and which require client sign-off. Every action is logged and reversible where possible. Eradication, recovery validation and a closing case record follow, so the incident ends with evidence of what happened and what changed.
An intrusion is only contained when someone with authority acts on it, ideally before the attacker finishes.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Threat Hunting | Hypothesis-led hunts. | – | – | OPERATE stage | Managed Security Services |
| Incident Response | Containment and forensics. | – | – | OPERATE stage | Managed Security Services |
| Orchestrated Response | Playbook-driven actions. | – | – | OPERATE stage | Managed Security Services |
| Case Management | Every incident tracked to closure. | – | – | OPERATE stage | Managed Security Services |
| Intelligence CorrelationAI-Assisted Operations | Alerts matched to indicators and actors | – | – | OPERATE stage | Managed Security Services |
| Automated Alert EnrichmentAI-Assisted Operations | Context added before triage | – | – | OPERATE stage | Managed Security Services |
| SOC Workflow AutomationAI-Assisted Operations | Playbook-driven containment | – | – | OPERATE stage | Managed Security Services |
| AI‑Assisted InvestigationAI-Assisted Operations | AI agents that draft investigations | – | – | OPERATE stage | Managed Security Services |
Threat Hunting
Hypothesis-led hunts.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Incident Response
Containment and forensics.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Orchestrated Response
Playbook-driven actions.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Case Management
Every incident tracked to closure.
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Intelligence Correlation
Alerts matched to indicators and actors
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
Automated Alert Enrichment
Context added before triage
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
SOC Workflow Automation
Playbook-driven containment
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
AI‑Assisted Investigation
AI agents that draft investigations
- Stage
- OPERATE
- Delivered Through
- Managed Security Services
How It Works
How Managed Detection & Response Works
Telemetry
- Endpoints
- Network
- Cloud
- Identity
- Applications
- OT & IoT
Collection
- Event collection
- Normalization, parsing and enrichment
Analytics Core
- SIEM & XDR correlation across telemetry
- Threat intelligence: indicators and actor context
- Detection engineering: use cases tuned to you
24/7 SOC
- Alert triage: L1 and L2 analysts
- Threat hunting: hypothesis-led hunts
- Incident response: containment, forensics
Client Outcomes
- Orchestrated response
- Case management
- Client dashboards
- Incident reporting
Managed SOC vs MDR vs MXDR
| Compare | Managed SOC | This serviceManaged Detection & Response | Managed XDR |
|---|---|---|---|
| Scope | 24/7 monitoring, triage and escalation | Adds hunting, containment and remediation | Unified response across endpoint, network, cloud, identity |
| Telemetry Coverage | In-scope sources collected, normalized and correlated in the SIEM | In-scope sources, plus the depth needed for hypothesis-led hunts | Endpoint, network, cloud and identity correlated in one analytics core |
| Response Responsibility | DAAKYI triages and escalates; your team contains and remediates | DAAKYI hunts, contains and remediates within agreed playbooks | DAAKYI coordinates one response across every layer in scope |
| Best For | Institutions with in-house responders that need round-the-clock eyes | Teams that want detection and containment handled for them | Hybrid estates that need one coordinated response across layers |
- Scope
- 24/7 monitoring, triage and escalation
- Telemetry Coverage
- In-scope sources collected, normalized and correlated in the SIEM
- Response Responsibility
- DAAKYI triages and escalates; your team contains and remediates
- Best For
- Institutions with in-house responders that need round-the-clock eyes
- Scope
- Adds hunting, containment and remediation
- Telemetry Coverage
- In-scope sources, plus the depth needed for hypothesis-led hunts
- Response Responsibility
- DAAKYI hunts, contains and remediates within agreed playbooks
- Best For
- Teams that want detection and containment handled for them
- Scope
- Unified response across endpoint, network, cloud, identity
- Telemetry Coverage
- Endpoint, network, cloud and identity correlated in one analytics core
- Response Responsibility
- DAAKYI coordinates one response across every layer in scope
- Best For
- Hybrid estates that need one coordinated response across layers
Methodology
The Method, Step by Step
- 1
Scope and Authority
Define in-scope assets, escalation contacts and the actions analysts may take unaided. Document approval thresholds for business-critical systems so containment decisions at night follow rules rather than improvisation.
- 2
Telemetry Baselining
Confirm which sources feed analytics and where blind spots remain. Establish normal behavior for key systems and accounts so deviations stand out and hunts rest on reliable historical data.
- 3
Detect and Hunt
Run continuous detection alongside scheduled hypothesis-led hunts. Prioritize hypotheses using current adversary behavior, asset exposure and gaps in existing detection coverage across ATT&CK tactics.
- 4
Contain and Eradicate
Execute playbook actions on confirmed incidents, remove persistence, and verify the adversary has lost access. Record each action, its timing and its approver so the response can be audited.
- 5
Review and Tune
After closure, examine root cause, detection gaps and playbook performance. Feed lessons into new rules, revised thresholds and hardening recommendations so the same technique succeeds less often.
Operating Model
Delivered from the OPERATE Pillar
Pillar position
OPERATE
Security Operations & Managed Resilience
Engagement model
Managed Security Services
SOC, MXDR and managed cloud security under SLAs.
Best for · 24/7 coverage without building in-house
Threat Scenarios
What It Looks Like in Practice
Ransomware Precursor Activity
How It Shows Up
Backup deletion commands, mass credential dumping or unusual remote execution appear on several servers in a short period.
Response
Analysts isolate affected hosts, disable abused accounts and block the staging infrastructure before encryption begins.
Stolen Credentials on Cloud Accounts
How It Shows Up
A valid login arrives from an unfamiliar location, followed by new access keys or mailbox forwarding rules.
Response
Sessions are revoked, credentials reset and persistence mechanisms removed, then the account's activity is reviewed for data access.
Lateral Movement with Legitimate Tools
How It Shows Up
Administrative utilities run at odd hours from a workstation that never used them, so no malware signature fires.
Response
A hunt on that behavior scopes the affected systems, and containment cuts the attacker's paths between them.
Data Staging Before Exfiltration
How It Shows Up
Large archives appear on a file server, followed by unusual outbound transfers to rarely seen destinations.
Response
Outbound connections are blocked, the host is isolated, and the case record documents what data was touched for notification decisions.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Ransomware Precursor Activity | Backup deletion commands, mass credential dumping or unusual remote execution appear on several servers in a short period. | Analysts isolate affected hosts, disable abused accounts and block the staging infrastructure before encryption begins. |
| Stolen Credentials on Cloud Accounts | A valid login arrives from an unfamiliar location, followed by new access keys or mailbox forwarding rules. | Sessions are revoked, credentials reset and persistence mechanisms removed, then the account's activity is reviewed for data access. |
| Lateral Movement with Legitimate Tools | Administrative utilities run at odd hours from a workstation that never used them, so no malware signature fires. | A hunt on that behavior scopes the affected systems, and containment cuts the attacker's paths between them. |
| Data Staging Before Exfiltration | Large archives appear on a file server, followed by unusual outbound transfers to rarely seen destinations. | Outbound connections are blocked, the host is isolated, and the case record documents what data was touched for notification decisions. |
Outcomes
What Your Institution Gains
- Faster detection and containment
- Less dwell time for intruders
- Clear response accountability
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Response Playbook Library | Records approved actions, owners and escalation paths for each incident type. |
| Incident Case Record | Preserves the timeline, evidence, actions and decisions for audit and regulators. |
| Hunt Report | States the hypothesis, data examined, findings and any detections created. |
| Containment Action Log | Shows who authorized each action, when it ran and whether it was reversed. |
| Post‑Incident Review | Identifies root cause and the control changes that reduce recurrence. |
| Role | Responsibility |
|---|---|
| Security Analyst (Provider) | Validates detections, investigates scope and executes approved containment steps. |
| Threat Hunter (Provider) | Designs hypotheses, queries telemetry and converts findings into durable detections. |
| Incident Authority (Client) | Approves actions that fall outside pre-agreed playbooks, especially on critical systems. |
| System Owner (Client) | Supplies business context and carries out remediation that only the owner can perform. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Alert‑Driven
Monitoring exists, but investigation and containment depend on staff availability. Incidents are handled ad hoc.
Stage 2
Playbook‑Defined
Common incident types have documented actions and approvers. Response is faster and consistent.
Stage 3
Hunt‑Informed
Regular hunts test assumptions and feed new detections. Coverage is measured against ATT&CK.
Stage 4
Continuously Tuned
Case reviews drive detection, playbook and hardening changes. Response is rehearsed and evidence-ready.
Frameworks and Regulation
The Standards That Shape This Work
NIST SP 800-61
Provides a reference lifecycle for incident handling, from preparation and analysis through containment, eradication and recovery.
MITRE ATT&CK
Its 14 enterprise tactics give hunters a common language for hypotheses, detection coverage and incident reporting.
NIST CSF 2.0
MDR primarily supports the Detect, Respond and Recover functions of the six-function framework.
Ghana Cybersecurity Act, 2020 (Act 1038)
It provides for incident reporting, so case records and timelines should support notifications to the Cyber Security Authority.
Buyer Guidance
Choosing the Right Provider
What to look for
- Clear written limits on which containment actions analysts can take without approval.
- Hunting that follows stated hypotheses and produces reports, not just a claim of proactive work.
- Case records detailed enough to support regulator notification and audit.
- Honest statements about which telemetry sources are required and what visibility gaps remain.
Questions to ask a provider
- Which actions can you take alone, and which need our approval?
- How do hunt findings become permanent detections?
- What does a closed case record contain?
- How do you handle response on systems we classify as critical?
Regulatory & Industry Context
The Obligations This Service Supports
MDR supports incident response requirements in ISO/IEC 27001, PCI DSS and HIPAA, and regulator notification duties.
Frameworks DAAKYI helps clients implement
- ISO/IEC 27001
- PCI DSS
- HIPAA
- Ghana Act 1038
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Telemetry sources and partner technologies
- Endpoints
- Network
- Cloud
- Identity
- Applications
- OT & IoT
Technology partners DAAKYI works with in this area.
Detection and response process, step by step
- 01Telemetry. Endpoints, Network, Cloud, Identity, Applications, OT & IoT.
- 02Collection. Event collection, Normalization, parsing and enrichment.
- 03Analytics Core. SIEM & XDR correlation across telemetry, Threat intelligence: indicators and actor context, Detection engineering: use cases tuned to you.
- 0424/7 SOC. Alert triage: L1 and L2 analysts, Threat hunting: hypothesis-led hunts, Incident response: containment, forensics.
- 05Client Outcomes. Orchestrated response, Case management, Client dashboards, Incident reporting.
Framework alignment: NIST CSF Detect, Respond, Recover
- Detect
- Correlation, threat intelligence and detection engineering across endpoint, network, cloud and identity.
- Respond
- Alert triage, investigation and unified containment coordinated across layers rather than tool by tool.
- Recover
- Reporting and handover into incident recovery and continuity operations.
- ISO/IEC 27001
- PCI DSS
- HIPAA
- Ghana Act 1038
MDR supports incident response requirements in ISO/IEC 27001, PCI DSS and HIPAA, and regulator notification duties.
Architecture reference
How Managed Detection & Response Works: Detect → Investigate → Contain → Remediate.
DAAKYI analysts hunt proactively, investigate detections and take containment actions within playbooks agreed with you in advance.
Containment Actions and Their Guardrails
Typical containment actions include network isolation of an endpoint, disabling or resetting an account, revoking cloud sessions and tokens, blocking an indicator at the firewall or DNS layer, and quarantining a mailbox rule or file. Each carries risk. Isolating a server may halt a business process, and a disabled service account may break integrations. Guardrails therefore include asset tiering, approval requirements for critical systems, rollback steps and verification checks that confirm the action actually took effect.
From Hunt Hypothesis to Detection Rule
A hunt begins by selecting an ATT&CK technique and defining the telemetry that would reveal it, such as process creation, authentication or DNS records. Analysts query a historical window, filter known-good activity and examine outliers. Confirmed malicious patterns become detections. Benign patterns become documented exclusions so analysts avoid repeat work. The rule is tested against past data to measure noise before release. Retained hunt records show which techniques have been examined and which remain uncovered.
Glossary
Key Terms
- Dwell Time
- The period an intruder remains undetected inside an environment.
- Playbook
- A documented set of response steps, with approvers, for a defined incident type.
- Containment
- Actions that stop an attacker's spread, such as host isolation or account disablement.
- Hypothesis‑Led Hunt
- A proactive search for a specific suspected adversary behavior in existing telemetry.
Related
Explore Connected Capabilities
Related services
Platforms
Industries
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
Technology partners
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Managed Detection & Response
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Managed Detection & Response with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Managed Detection & Response will respond.
Discuss Managed SOC Services