Managed detection and response with human analysts on watch 24/7.

What managed detection and response means, in plain terms

MDR is a service, not a product. It combines sensors on your systems, a platform that pulls their signals together and, most importantly, people who investigate and respond. Three terms come up constantly:

• SOC (security operations center). The team that watches alerts, investigates and responds, ideally around the clock.
• EDR and XDR. Endpoint detection and response watches behavior on laptops and servers. Extended detection and response adds email, identity and cloud signals to the same picture.
• SIEM. Short for security information and event management, a platform that collects logs from many systems and correlates them so related events are seen together.

MDR suits businesses that hold sensitive data but have nobody awake to watch alerts at night, and in-house IT teams that can't add round-the-clock monitoring to everything else they do. For the second group, MDR often sits inside a co-managed IT arrangement: your team keeps daily ownership while we cover detection and response.

It's also common for lean teams in Sorrento Valley, UTC and North County to carry enterprise-sized obligations, such as partner security reviews, insurer questionnaires and customer audits, that all ask the same thing: who watches the alerts after hours?

What a 24/7 SOC actually does at 2am

Here is an illustrative overnight alert, the kind that often comes before ransomware. It's a composite example rather than a client story, but each step reflects how the work is done.

1. The signal

   Around 2am on a Saturday, EDR flags a remote-access tool installing itself silently on a front-desk PC. Minutes later, the same machine runs a command that tries to delete its local backup copies.

2. Triage

   An analyst checks context. Is this tool on the approved list? Is a vendor doing scheduled maintenance? Which account is signed in, and where else has it been used recently?

3. Decision

   The tool isn't approved, no maintenance is scheduled and deleting local backup copies is a classic step before encryption. The analyst treats it as a confirmed incident.

4. Containment

   Using actions agreed in advance, the analyst isolates the PC from the network, disables the signed-in account and blocks the tool on every other managed device.

5. Scope and hand-off

   The analyst searches other machines for the same activity and confirms backups are intact. Because this looks like a ransomware precursor, the containment playbook starts and your named contact gets a call.

Reported phishing gets the same treatment. When staff use the report-a-phish button, an analyst reviews the message and, if it's malicious, removes it from every inbox that received it.

Alert triage versus real incidents

Triage is the sorting step: deciding quickly whether an alert is harmless, needs more work or is a real incident. Every alert ends up in one of four places.

Good triage depends on context. When the SOC knows what normal looks like for your business, noise drops and real anomalies stand out. Useful context includes:

• Staff who live in or regularly travel to Tijuana and elsewhere in Baja California, so routine cross-border sign-ins are read correctly
• Which IT staff and vendors are authorized to use remote-access and admin tools
• Scheduled jobs, such as lab instruments uploading data overnight or backups running on weekends
• Executives, finance staff and anyone who approves payments, because attackers single them out
• Planned changes, such as a new office network or a migration weekend

What an average first response under 15 minutes means

Response-time claims are easy to make and hard to compare, so here is how to read ours. Alpiba's SOC has an average first response under 15 minutes, at any hour. First response means a person on the SOC has picked up the alert and started working it, which can include containment actions you've already approved.

• It's an average. Some alerts are picked up faster and some take longer, so it isn't a ceiling for every alert.
• It isn't resolution time. Investigation and cleanup take as long as the evidence requires, sometimes hours for a complex case.
• It isn't containment. For confirmed ransomware or breach events, the separate commitment is that our containment playbook is triggered within the first hour.
• It runs around the clock. Nights, weekends and holidays are covered by the same human-staffed SOC.

Minutes matter because an attacker with a working password or a foothold on one laptop needs time to escalate privileges and find your data. Acting within minutes, rather than when someone checks email the next morning, is often the difference between a reset password and a recovery project.

MDR versus SIEM versus plain antivirus

These three are often compared as if they were alternatives. They're really different layers, and only one of them includes people who respond.

A SIEM isn't the problem; it's part of how our SOC connects signals. The problem is any tool, however capable, with nobody watching it at 2am. XDR narrows the gap by linking endpoint, email, identity and cloud signals automatically, but it still needs people to decide and act. Antivirus keeps a role too, as one control on the endpoint rather than the whole plan.

What we monitor: endpoints, identities, email and cloud

Telemetry is the stream of security signals your systems produce. The SOC can only act on what it can see, so coverage is agreed and checked rather than assumed.

Identity signals are far more useful when the policies behind them are strong, which is why MDR works best alongside MFA and conditional access policies. Between alerts, analysts also carry out threat hunting: proactive searches for signs of an attacker that no rule has flagged yet. Typical hunts look for patterns like these:

• Accounts that sat dormant for months and suddenly sign in, especially outside business hours
• Remote-access or file-transfer tools running on machines where nobody approved them
• Mailbox rules or third-party app grants created recently that nobody can explain
• Admin tools such as PowerShell used by accounts that don't normally need them

When a hunt comes up empty, its query often becomes a standing detection, so the next occurrence raises an alert on its own.

Coverage to confirm during onboarding

• Every laptop and server has the EDR agent installed and reporting
• Admin, service and shared accounts are identified and watched
• Audit logging is confirmed on in Microsoft 365 or Google Workspace
• Log retention matches what your insurer, auditors or contracts expect
• Systems that can't run an agent have compensating controls agreed

How escalation and containment approvals work

Speed only helps if the SOC is allowed to act. During onboarding we agree an approval matrix with you: which actions analysts take immediately, which need a call first and which are always your decision. A common starting point looks like this:

• Act now, report right after. Isolating a laptop, revoking sessions, blocking a risky sign-in, disabling a clearly compromised user account and purging a malicious email.
• Call first unless it's an emergency. Isolating a server that runs a line-of-business system, disabling an executive's account or cutting off a vendor's remote access.
• Always your decision. Shutting down operations, notifying customers or regulators, engaging law enforcement and anything involving a ransom demand.

When a decision is needed, the contact ladder is just as specific:

1. Named primary contact. Called first, by phone, for anything that needs a decision.
2. Backup contact. Called if the primary doesn't answer within the window you've set.
3. Executive escalation. Used for confirmed incidents with business impact, or when neither contact can be reached.
4. Incident call. A working session with your decision-makers to agree next steps, followed by a written timeline.

If an alert turns out to be part of a larger attack, the response moves into our ransomware containment playbook and recovery planning, with the same named contacts.

San Diego specifics for detection and response

Managed detection and response in San Diego gets tuned for some distinctly local patterns:

• Lab instruments and imaging systems. Biotech labs around Torrey Pines and dental offices often run vendor-controlled PCs that can't take an agent or regular patches. Those systems get compensating controls such as segmentation and tight access rules, and the accounts that touch them are watched closely.
• Cross-border and hybrid teams. Staff who commute from the South Bay or live in Baja, and hybrid workers across the county, create sign-in patterns that need context to read correctly.
• Power shutoffs. During SDG&E Public Safety Power Shutoffs, devices drop offline together and people move to unfamiliar networks. Knowing a shutoff is under way helps analysts tell an outage from an attacker disabling protection.
• Regulated data and audits. Dental practices with patient records, law firms with privileged email and biotech companies with partner data often need to show who watched what, and when. Incident timelines and coverage reports double as evidence for HIPAA safeguard reviews, partner questionnaires and insurer renewals.
• Hands-on help nearby. Being San Diego-based means a contained device can be collected, rebuilt or replaced on-site when remote work isn't enough.

Questions to ask an MDR provider, and what drives cost

Whether you're replacing a provider or buying managed detection and response in San Diego for the first time, these questions separate real service from dashboards:

• Who staffs the SOC overnight, and what experience do they have?
• How do you define and measure first response, and what is your average?
• Which containment actions can you take without calling me, and can I change that list?
• Which telemetry is included: endpoints, identities, email and cloud?
• How do you tune detections to cut noise without hiding real attacks?
• Can I see a sample incident report with client details removed?
• What happens when an alert involves a system you can't put an agent on?
• Do I keep my logs, configurations and documentation if we part ways?

Look for straight answers over impressive dashboards. A provider confident in its service will walk you through a real incident timeline with client details removed, explain what it would do differently next time and show you exactly which of your devices are reporting today.

Cost follows scope: the users and devices covered, the data sources connected, how long logs must be kept and what your compliance or insurance obligations require. Pricing is a flat monthly amount per user, and the scope is set after a free assessment so the plan matches what you actually need covered.

To find weaknesses before the SOC ever has to deal with them, pair monitoring with regular vulnerability assessments. Or book a free 30-minute assessment and talk it through with a senior engineer.