Short answer
If your SIEM is working well, Sophos XDR and MDR can complement it. If it is expensive to operate, slow to deploy or weak on response, Sophos NG-SIEM can replace it as part of a planned transformation run by FirstNet.
In detail
The two paths:
- Complement: keep your SIEM for log management and compliance, and add Sophos XDR to correlate endpoint, firewall, identity, cloud and email telemetry, with Sophos MDR analysts monitoring 24/7 and FirstNet Incident Response acting on alerts
- Replace: Sophos NG-SIEM provides telemetry ingestion, compliance reporting, log retention and SOAR automation, unified through the Sophos Unified Data Lake
Typical timeframes:
- Standard MDR onboarding: two to four weeks
- XDR or NG-SIEM integration: four to eight weeks, depending on telemetry breadth
- Full legacy SIEM replacement: eight to 16 weeks
The deciding questions are usually the cost to operate, how long new detections take to deploy, and whether alerts lead to action. MDR adds the people who watch and respond, which a SIEM on its own does not provide.
FirstNet's discovery reviews your SIEM's age, renewal date and pain points before recommending a path.
Source: FirstNet Managed Cybersecurity Services service page →
Didn’t answer your question?