Estate Monitoring
Device visibility, risk scores, forensic details and investigation views.
Where the module helps during an attack
XDR connects signals across attack stages and primarily supports investigation and response. Coverage depends on enabled modules. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | context |
| Initial access | additional protection |
| Execution and persistence | additional protection |
| Escalation and lateral movement | primary role |
| Impact | additional protection |
| Investigation and recovery | primary role |
Module signals in context
Each Heimdal module catches a different attack element: DNS a suspicious domain, antivirus a file, email protection a fraudulent message. Threat-hunting & Action Center (TAC) combines events, adds context and ranks devices and users by risk.
TAC uses XTP and MITRE ATT&CK techniques. The vendor describes integrated SIEM and XDR for networks, endpoints, cloud, email and Microsoft 365 users.
User Monitoring
Microsoft 365 user behaviour, unusual logins and links to email and ransomware detections.
Action Center
One-click response: scanning, quarantine, device isolation or user sign-out.
From alert to action in one place
Administrators see the highest-risk devices and users, related events, attack details and techniques. From the same view they can isolate computers, quarantine files, install patches or sign out compromised users.
TAC visibility depends on enabled modules and integrations. The vendor lists external Cisco Meraki and Palo Alto firewall integrations, for example.
- The vendor says its XDR package includes EDR, a threat hunting portal, email protection, PEDM, PASM and Application Control.
- Email and Microsoft 365 events are available in TAC depending on the selected email variant.
- The proposal specifies included modules, licences and integrations.
Who assesses alerts
XDR is a tool. Someone must monitor it, assess alerts and decide on response. In smaller businesses, this is often the person managing all IT.
Heimdal therefore offers MXDR: a managed service whose SOC monitors, investigates and responds within configured permissions. The vendor describes 24×7 operation. This is Heimdal's service.
MXDR ADAPT lets you decide, per module, whether vendor analysts may act independently or only notify you.
Your own team with XDR
Your team assesses and resolves alerts through the agreed process.
Vendor MXDR
Heimdal's SOC provides monitoring and response within the service scope and permissions you configure.
APPSEC support
Deployment, configuration and support as agreed in the proposal. Continuous monitoring is not included.
Deployment with APPSEC
Heimdal provides the platform and any MXDR service under its terms. APPSEC provides design, deployment and support as agreed. You decide interventions unless explicitly delegated to MXDR.
Modules and sources
We verify which modules and integrations will send data to TAC.
Response workflow
We agree who monitors alerts, who may isolate devices and when to escalate.
Training
We guide the team through views, investigations and Action Center using pilot data.
MXDR decision
We help assess whether your team is sufficient or vendor services make sense.
Things to consider
- XDR value grows with connected modules. One module alone provides limited context.
- Automated responses such as isolation must align with operations and responsibilities.
- The vendor compatibility matrix lists TAC for Windows. We verify current support for other systems.
- For MXDR, verify communication language, critical contacts and permission scope in the proposal.
