MDR for
on-prem
infrastructure
24x7 monitoring and response for your endpoint, network and SIEM tech
BYO-tech MDR that shrinks alert-to-fix timelines
Our analysts (and bots) triage the alerts from your security tech. When we find something suspicious, you’ll know right away. Plus. we can automatically contain the threat so you get the space to breathe during an incident.
24x7 detection and response
We work with the security tech you’ve already invested in. Pop over here to see our full list of integrations.
Endpoint
We support 13 EDR products
Network
We support 15 network products
SIEM
We support 14 SIEMS
Detections across the attack lifecycle
Commodity malware is … common (heh). Our detection strategy includes everyday tactics and the more sophisticated ones, like lateral movement, hijacking processes and staging data for exfiltration. When we investigate we go beyond the surface and tell you the who, what, where and when of incidents.
| Endpoint | Network | SIEM | |
|---|---|---|---|
| Examples of things we detect | |||
| Credential theft | |||
| Potentially unwanted programs or apps (PUP/PUA) | |||
| Malware | |||
| Hands on keyboard | |||
| Ransomware | |||
| Potential data exfiltration | |||
| Examples of investigative actions we can take | |||
| Query domain | |||
| Query IP | |||
| Query filename | |||
| Query process | |||
| Acquire file | |||
| Acquire directory listing | |||
| Acquire PCAP | |||
| Query all logs for arbitrary strings | |||
Blog
Plotting booby traps like in Home Alone: Our approach to detection writing
We’re often asked about how we create and prioritize detection at Expel. With so many factors to consider, it’s difficult to give a one-size-fits-all response.
Blog
Someone in your industry got hit with ransomware. What now?
It seems like every week there’s a new story about an organization that’s become the latest victim of a ransomware attack.
Blog
Obfuscation, reflective injection and domain fronting; oh my!
Learn about the three-phased analysis that helped our analysts spot a Red Team and decode the malware script.
Three questions your MDR (or MSSP) provider hope you don’t ask
How will you use the network and SIEM products I own to deliver your service?
Am I locked into my current EDR provider or can I add/change the security tech I use?
Can I see what you’re analysts are doing as they work?
Ready to
talk to a human?
When you tell us you’re ready, we won’t waste your time. Let us know what you’re looking for and we’ll have someone get in touch who can talk tech.
Thanks for clicking submit. Your message is now being directed to a real person.