Sophos MDR Detection Triage Explained

Name: Sophos MDR Detection Triage Explained
Uploaded: 2026-10-05T12:05:16-04:00
Duration: 2 min 27 s
Description: Learn what MDR Detections are, how telemetry enters Sophos MDR, and the detection triage process. **Captions are generated by machine translation may contain errors** ------ *Video Chapters* 00:00 Intro 00:18 Detections overview 00:57 Detection triage ...

Sophos

10/05/2026

0 (0%)

Report Like Favorite

Transcript

Today, you'll learn about MDR detections, including what they are, how data is collected, and the detection triage process. Let's dive in. Broadly speaking, a detection is any unusual or suspicious activity detected in your environment, including prevention or cleanup events. Our AI-powered threat detection platform identifies multi-stage, multi-vector threats by correlating telemetry across control points, including endpoints, network, cloud, email, identity, and more. The more integrations in data, the greater our visibility and investigation accuracy. Sophos detectors work around the clock to actively monitor your environment in real-time. And, they're continuously enhanced by our engineers as the threat landscape evolves. In the security operations area, the detections page displays the generated detections, classifying them by severity, from informational to critical. Not every detection is malicious. Only high-confidence or high-severity detections may progress into a Sophos MDR case. Use the filters to quickly organize the list of detections to display what's relevant to you. Click on a detection to view the details. Examine the key information in the quick view or expand to the full view for additional details. At any time, you can go to the rules page to create custom detection rules to suit your needs. However, these can only be used for creating customer-managed cases and will not trigger MDR-managed cases. In addition, the Detector Explorer lets you browse the comprehensive list of Sophos threat detection rules and explore the detection logic and associated MITRE ATT&CK tactics and techniques. If a Sophos MDR case is generated from a detection, this triggers a response from the MDR operations team, which is covered in another video. Now you understand what Sophos MDR detections are and how they're generated. I hope you found this useful. The relevant documentation and other comprehensive resources for this video are linked in the video description. Join the Sophos community to stay up to date with Sophos MDR, ask questions, and get answers from Sophos experts. And go to Sophos TechVids for more expert tutorials to help you maximize your products and stay secure. See you next time!

TL;DR

Sophos MDR detections cover any unusual or suspicious activity across endpoints, network, cloud, email, and identity, correlated by an AI-powered platform.
Not every detection is malicious — only high-confidence or high-severity detections escalate into a formal MDR case handled by the operations team.
Customers can create custom detection rules for self-managed cases, but these rules will not trigger MDR-managed responses from the Sophos operations team.

Summary

This short onboarding module from the Sophos MDR series explains how detections work within the Sophos MDR platform — from data ingestion to triage. A detection is defined as any unusual or suspicious activity identified in a customer environment, including prevention and cleanup events. Sophos MDR's AI-powered threat detection platform correlates telemetry across multiple control points — endpoints, network, cloud, email, and identity — to identify multi-stage, multi-vector threats. The broader the integration footprint, the greater the visibility and investigation accuracy. Detections are classified by severity from informational to critical, and only high-confidence or high-severity detections escalate into a formal MDR case handled by the operations team. The video also introduces two self-service capabilities: custom detection rules, which allow customers to create their own rules for customer-managed cases (though these do not trigger MDR-managed responses), and the Detector Explorer, which lets users browse Sophos threat detection logic alongside associated MITRE ATT&CK tactics and techniques. Together, these tools give security teams meaningful transparency into how threats are identified and prioritized within the platform.

Chapters

0:00 - Introduction
0:18 - What Is a Detection?
0:57 - Detection Triage Process
1:26 - Custom Detection Rules
1:39 - Detector Explorer & MITRE ATT&CK

Key Quotes

0:27 "Our AI-powered threat detection platform identifies multi-stage, multi-vector threats by correlating telemetry across control points, including endpoints, network, cloud, email, identity, and more."
0:40 "The more integrations in data, the greater our visibility and investigation accuracy."
1:05 "Not every detection is malicious. Only high-confidence or high-severity detections may progress into a Sophos MDR case."

FAQ

What is the difference between a detection and an MDR case in Sophos MDR?

A detection is any unusual or suspicious activity flagged by the platform, classified by severity from informational to critical. Only high-confidence or high-severity detections progress into a formal MDR case, which then triggers a response from the Sophos MDR operations team.

Can customers create their own detection rules in Sophos MDR?

Yes. Customers can create custom detection rules via the rules page. However, these custom rules can only be used to generate customer-managed cases and will not trigger MDR-managed cases handled by the Sophos operations team.

Categories:

» Data Protection

Tags:

Show more Show less

TL;DR

Summary

Chapters

Key Quotes

FAQ

Transitioning from CJIS to FERPA: Essential Audit Evidence for Compliance

Risk in Real Time Demo Series: Virtual Patching: Protection at the Speed of Exploitation

Harnessing Data Governance for AI with Cyera and Snowflake