Managed Detection and Response (MDR) Service
MDR (Managed Detection and Response) service is a service that monitors the security indicators and metrics of the relevant systems of organizations 24/7 and ensures that the incident is notified or prevented and reported in accordance with the predetermined service level scope before a security breach occurs or in the event of a breach.

The purpose of this service is to detect and analyze emerging or potential security breaches as soon as possible and to initiate the incident response process when necessary.

The MDR service forms the basis of a sustainable and reliable monitoring infrastructure. With this service, rapid and effective intervention is provided for security breaches that will occur or have occurred, and measures are taken to prevent similar incidents.

MDR Service Scope

With Annanowa Managed Detection and Response (MDR) Service, we offer organizations comprehensive protection against cyber threats.

1. Analysis
   Annanowa MDR Service primarily determines the processes, assets, and risk analyses related to the monitoring process with the Current Situation Analysis of the organizations. Then, with the Scope Determination process, the inventory, services, and products to be monitored for security are decided together with the organization.
2. Installation
   The installation and configuration of products and technologies are ensured in accordance with the security design determined by the organization. The rules, correlations, and response* systems of the installed systems are tested and made ready before starting the monitoring service. *(In monitoring services received together with the response service, the actions to be taken by the technologies to be responded to are also determined according to the needs of the institution.)
3. 24/7 Monitoring
   The 24/7 monitoring and notification service continuously monitors the determined organization network and inventory after the analysis and installation studies. In this way, possible cyber breaches are detected immediately and rapid intervention is provided to threats. Notification and reporting are made within the determined SLA periods within the scope of the service.
4. Continuous Improvement
   Continuous necessary improvements and updates are made in monitoring infrastructures according to the incidents or signs of incidents. Thus, the damage that cyber threats may cause is minimized and the recurrence of risks is prevented.

With the scope of these services;

The scope and framework for current situation analysis and data collection are determined,
The necessary methodology is created for the establishment of the supply chain inventory of the organization,
The organizational structure and supply chain system are examined,
Risks originating from the supplier service are analyzed.
MDR Service Benefits

Faster Detection of Threats: MDR services continuously monitor your network to catch the moment when cyber attacks occur. In this way, threats are detected and intervened more quickly.
Fast Response: MDR services respond quickly and effectively to cyber attacks. In this way, the spread of attacks is prevented and possible damages are minimized.
Business Continuity: MDR services respond quickly to minimize the effects of cyber attacks. This helps maintain business continuity.
Better Efficiency: MDR services lighten the load on your cybersecurity team. This allows your team to focus on more strategic tasks and increase work efficiency.

Cost Savings: MDR services reduce the software, hardware and personnel costs required for cybersecurity. This allows organizations to receive better services at lower costs to manage cybersecurity risks.

Additional Services to the Service;

Incident Response Service
Incident Response Service is a service provided in the event of a cyber attack that directly or indirectly targets the services provided by organizations and other components (workstations, databases, etc.) that may affect the continuity of these services. This service ensures the determination of the root cause of a cyber incident, the determination of actions to be taken to minimize the damage to service activities, the determination of actions to restore the normal functionality of the workstations in question as soon as possible, and the creation of the awareness and process needed to prevent similar incidents from recurring.

Red Teaming Service
Red Teaming Service can target all or some of the topics listed below using scenarios that real attackers can implement:

Determining SOME/SGOM detection capabilities,
Determining whether attacks are detected correctly,
Determining how long it takes to detect attacks,
Determining how long it takes to intervene in the incident,
Determining the time it takes to control the incident,
Determining whether the incident response is carried out properly,
Determining human/process/technology-based vulnerabilities in organizations,
Determining vulnerabilities in business processes of organizations,
Determining systems, security, infrastructure, OT, IoT, etc. used within the organization. Detection of vulnerabilities in technology and products,
Detection of vulnerabilities originating from lack of information security awareness of personnel working within the organization, non-compliance with security principles such as separation of duties and minimum authority,
Determination of information security awareness of users, personnel, stakeholders, suppliers and third parties,
Holistic determination of the competencies of SOME/SGOM functions such as security product management, incident response, continuous security monitoring.
Security Operation (SECOPS) Services
With the Security Operations Service, remote management of security products within the determined scope of organizations, periodic maintenance, updates, configurations and backups of products are provided, and it is aimed to prevent errors originating from operations. With this service, the efficient operation of security products is ensured, performance-related problems are detected in advance and necessary precautions are taken. Thus, it is aimed to ensure that operations can be continued safely.

Cyber ​​Threat Intelligence (CTI) Services
With the Cyber ​​Threat Intelligence Service, it is ensured that intelligence data and reports specific to the sector and geographical location of the organizations are created at the Strategic, Operational and Tactical levels. CTI data is shared bidirectionally with MDR teams, enabling faster detection and prevention of threats related to the organization.
With the Cyber ​​Threat Intelligence Service;

The organization’s cyber threats are determined and special Strategic, Operational and Tactical level intelligence data is provided,
Information on current cyber threats is simplified and presented to organizations,
Information on current vulnerabilities and attacks is simplified and presented to organizations.
Threat Hunting Service
With the Threat Hunting Service, the organization’s network, system and servers are analyzed, and advanced malicious activities that continue to exist or have ongoing effects are detected and, if any, are forwarded to the Incident Response team. In the first step of the Threat Hunting Service, the systems of the organizations are analyzed and the aim is to identify the vulnerabilities and potential threats in the systems according to the results of this analysis. The potential threats identified and the indicators and signs related to the threats are investigated and the threats are detected.

Who Can Receive MDR Service?

The organizations that can receive MDR Service are listed as follows;

All organizations that are dependent on external sources in the production of products or services,
Public institutions and organizations that are obliged to comply with regulations and businesses,
All organizations that want to increase their cyber security maturity level and do not have security teams.