Endpoint detection and response
Catch attacks that slip past other defenses
Prevention stops many threats. Attackers still try to blend in with normal activity – misusing ordinary tools, hiding persistence, or looking for a way past the first layer. Managed endpoint detection and response (EDR) watches covered devices for suspicious behavior so covered alerts can be spotted and reviewed early.
Covered scope: Silver includes managed servers. Gold and Platinum include managed servers and workstations.
What managed EDR watches for
Behavioral detection
Many attacks misuse ordinary tools – remote-access software, built-in system utilities – instead of obvious viruses. EDR watches what programs are doing on covered devices and flags activity that looks wrong, including attacks that do not match a known signature.
Persistence indicators
Attackers often try to stay in by hiding inside startup settings and normal tools. EDR looks for those hidden footholds and for signs of movement from one computer to the next.
Ransomware warning signs
EDR watches for early patterns that may indicate malicious encryption or related activity, so suspicious behavior can be flagged while there is still time to limit spread.
Tamper monitoring
Some attackers try to disable or blind security software before they make their next move. EDR watches for those attempts and raises an alert on covered devices.
Analyst review
On Silver plans for managed servers, and on Gold and Platinum for managed servers and workstations, a security operations center reviews covered EDR alerts 24 hours a day, 365 days a year – so a trained analyst sorts real threats from false alarms. See SOC Alert Review.
Threat containment
When a threat is confirmed on a covered managed-EDR device, the SOC can isolate that device from the network, at any hour, to help keep the problem from spreading. Neatoware investigates and remediates under your plan’s response targets. See Plans.
From endpoint signal to action
EDR provides the signals. SOC analysts decide which alerts need action. Neatoware engineering follows up.
Endpoint signal
Managed EDR detects suspicious behavior on a covered device.
SOC triage
A security operations center analyst reviews the covered alert and decides next steps.
Isolation
When a threat is confirmed on a managed-EDR device, the SOC may isolate that device from the network. Isolation limits spread.
Neatoware remediate
Neatoware investigates, cleans up, and coordinates recovery under your plan’s initial-response targets after appropriate coordination with you.
Two clocks.
Security clock: SOC review of covered EDR (and related SIEM) alerts runs 24 hours a day, 365 days a year on covered systems.
Engineering clock: Neatoware follow-up follows your plan’s response targets. Routine help desk is Monday to Friday, 9 AM to 5 PM ET. On Platinum, our Priority 1 response target is four hours, 24 hours a day, 365 days a year.
Which plans include managed EDR
Compare EDR-related coverage across plans. Full plan details live on the Plans page.
| Feature | Bronze | Silver | Gold | Platinum |
|---|---|---|---|---|
| Managed EDR | Not included | Managed servers | Servers + workstations | Servers + workstations |
| 24/7 SOC alert review* | Not included | Covered servers | Covered servers + workstations | Covered servers + workstations |
| SIEM alert review (same device scope)* | Not included | Covered servers | Covered servers + workstations | Covered servers + workstations |
| SOC isolation | – | Covered device | Covered device | Covered device |
| Help desk hours | Mon-Fri 9 AM-5 PM ET | Mon-Fri 9 AM-5 PM ET | Mon-Fri 9 AM-5 PM ET | Mon-Fri 9 AM-5 PM ET |
| Priority 1 after-hours initial response | Not included | Not included | Not included | Yes** (Priority 1 response target: 4 hours, 24 hours a day, 365 days a year) |
*24/7 SOC means security operations center review of EDR and SIEM alerts on covered systems – servers on Silver and up, workstations on Gold and Platinum. Bronze does not include ongoing managed EDR, SOC, or SIEM. **On Platinum, our Priority 1 response target is four hours, 24 hours a day, 365 days a year.
Where EDR fits
Five related layers: how EDR fits with antivirus, SOC alert review, SIEM, and managed endpoints.
Antivirus / prevention
Helps block malicious files and many known or recognizable threats. Modern products may also use some behavior analysis. See Cybersecurity and Plans (antivirus is included on Gold and Platinum).
Endpoint detection and response (EDR)
Collects endpoint activity and raises suspicious-behavior signals on covered devices. Supports containment actions such as device isolation.
SOC alert review
Trained analysts review covered alerts 24 hours a day, 365 days a year and decide which need escalation or containment. See SOC Alert Review.
SIEM
Correlates logs and events across systems for broader context – servers on Silver; servers and workstations on Gold and Platinum. See SIEM.
RMM / managed endpoints
Monitors endpoint health and supports patching, maintenance, and technical management. See Managed Endpoints and Managed Servers.
Common questions
What is endpoint detection and response, in plain English?
Managed EDR watches what is happening on covered computers for activity that looks wrong – not only known virus signatures. Covered alerts go to a security operations center for human review. When a threat is confirmed, the SOC may isolate that device. Neatoware then follows up on investigation and cleanup.
How is EDR different from antivirus?
Modern antivirus and EDR can overlap – many endpoint products use more than one technique. Classic antivirus is still strongest on known threats. Managed EDR adds continuous endpoint telemetry, investigation and response capabilities, and analyst review of covered alerts. On Gold and Platinum plans, antivirus and managed EDR both apply on covered workstations (and on covered servers). Silver includes managed EDR on servers; antivirus for workstations is a Gold/Platinum entitlement. See Cybersecurity and Plans.
Who reviews the alerts after hours?
On covered systems, security operations center analysts review EDR alerts 24 hours a day, 365 days a year on Silver, Gold, and Platinum. Routine help desk is Monday to Friday, 9 AM to 5 PM ET. Neatoware engineering follow-up after a confirmed security incident follows your plan’s initial-response targets. On Platinum, our Priority 1 response target is four hours, 24 hours a day, 365 days a year. See SOC Alert Review and Help Desk.
Can the SOC isolate a device?
When a threat is confirmed on a covered managed-EDR device, SOC analysts may isolate that device from the network. Isolation is containment – it helps limit spread. Neatoware coordinates remediation after appropriate coordination with you.
Does Silver cover laptops and other workstations?
No. Silver managed EDR and SOC alert review cover managed servers. Gold and Platinum add managed workstations (including typical office laptops). See Plans.
Does EDR replace our other security?
No. EDR is one layer. It works alongside prevention (updates, filtering, firewall protection, and antivirus), staff habits, and related services such as SIEM and backups. It helps catch what gets past the first layers – it does not replace them.
Managed EDR that watches for what other defenses miss
Silver covers managed servers; Gold and Platinum add workstations. Compare plans, run the pricing calculator, or book a call to map coverage to the devices you depend on.