NL 072 202 97 95 Free Cybercheck

Vendors / Rapid7 / MDR for Microsoft

<24/7 SOC for Microsoft Defender>

Rapid7 MDR for Microsoft

Get more out of Microsoft Defender. The Rapid7 24/7 SOC monitors your Defender environment, investigates alerts and takes action. With Brandaris as your fixed point of contact.

Discuss MDR for Microsoft with us All about Rapid7

What is MDR for Microsoft?

Many organisations already have Microsoft Defender in their licence. But Defender generates alerts, and they need to be assessed and followed up day and night. That is often what is missing.

With MDR for Microsoft, the Rapid7 24/7 SOC monitors your Defender environment. Rapid7 introduced the service at the end of 2025, as part of a broader partnership with Microsoft.

What is included?

According to Rapid7:

  • 24/7 SOC: analysts who investigate alerts from Defender and take action, also at night and at weekends.
  • Broad: Defender for endpoints, identities, cloud and email.
  • More context: signals from Defender combined with Rapid7 data and vulnerability information.
  • Own SIEM with access: the Rapid7 next-gen SIEM brings together Defender, the Rapid7 agent and other tools. You can look along yourself.
  • Logs: unlimited ingestion, retained for 13 months as standard.
  • Incident response: investigation and recovery for an incident, without limit.

Who is it for?

For organisations that use Microsoft 365 and Defender and want day-and-night monitoring without building their own SOC. If you also use other security tools, look at Rapid7 MDR.

How Brandaris uses it

We first look at how your Defender is currently set up. Then we help with onboarding to Rapid7 and remain your fixed point of contact. We translate findings from the SOC into improvements, for example with exposure management.

<frequently asked questions>

About MDR for Microsoft

What is MDR for Microsoft?

A Rapid7 service in which the 24/7 SOC monitors your Microsoft Defender environment. The analysts investigate alerts from Defender, combine them with other sources and take action when needed.

We already have Microsoft Defender. Why MDR as well?

Defender generates alerts, but someone has to assess and follow them up day and night. Most organisations cannot do that themselves. MDR for Microsoft makes sure analysts are always watching, also at night and at weekends.

Which parts of Defender are covered?

According to Rapid7, the Defender products for endpoints, identities, cloud and email. Signals from Microsoft 365 and Entra ID can also be included.

Do we then need Microsoft Sentinel?

No. Rapid7 uses its own SIEM, which brings together signals from Defender, the Rapid7 agent and other tools. You get access yourself, so you see what is happening. Rapid7 does not manage Microsoft Sentinel.

What does Brandaris do in this?

We are your fixed point of contact. We help with onboarding, coordinate with your IT team or IT partner and translate findings into improvements in your environment.

Can Brandaris set up and manage Rapid7 MDR for Microsoft for us?

Yes. We first look at what is already there and what you need. Then we help with implementation, setup and follow-up, or take over the management. We make clear up front what it costs.

Does MDR for Microsoft suit your organisation

We first look at what is already there, and tell you honestly what you need.

Book a call Call +31 72 202 97 95 Free Rapid7 Health Check
<more from rapid7>

Other Rapid7 solutions

<Attack surface management>

Attack Surface Management

See your organisation the way an attacker sees it. All systems, domains and cloud environments in view, including the forgotten ones, and where security is missing.

 <Exposure management>

Exposure Management

Vulnerabilities, attack surface, cloud and applications in one risk picture. So you know which weak spots can really be reached and what to fix first.

 <Vulnerability management>

Vulnerability Management

Find vulnerabilities on servers, workstations, network and cloud, prioritise them by risk and demonstrably fix them. With InsightVM and Exposure Command.

 <Governance, risk and compliance>

Cyber GRC

Governance, risk and compliance linked to your real security data. Controls, evidence, risks and audits in one place, with live evidence from your Rapid7 environment.

 <Next-gen SIEM>

Next-gen SIEM

Logs and signals from cloud, workstations, identities and network in one place. With AI-driven detection, so attacks stand out and you can respond quickly.

 <24/7 SOC (MDR, Managed Threat Complete)>

Managed Detection and Response (MDR)

A team of Rapid7 analysts that watches day and night, takes action and handles incidents end to end. With Brandaris as your fixed point of contact.

 <Exposure management>

Exposure Command

Vulnerabilities, your attack surface, cloud and application risks in one overview. So you know what to fix first.

 <Vulnerability management>

InsightVM

Find and prioritise vulnerabilities on servers, workstations and network. InsightVM is the scanner within Rapid7 Exposure Command.

 <Attack surface management>

Surface Command

See your organisation the way an attacker sees it: domains, cloud and systems that can be reached from the outside, and where security is missing.

 <Automatic patching (with Automox)>

Active Patching

Fix vulnerabilities automatically with patches and configurations, straight from Exposure Command. Built on the Automox platform.

 <SIEM (successor to InsightIDR)>

Incident Command

The Rapid7 next-gen SIEM, successor to InsightIDR. Logs, devices and cloud in one overview, so attacks stand out and you can respond quickly.
<newsletter>

Our newsletter

Cybersecurity is not just technology. It is people work. In our newsletter we share knowledge, stories and experiences that show how we help organisations move forward. The newsletter is in Dutch.