Cynode – Managed Detection and Response (MDR) Service License Agreement
1. Service Description
The MDR service is a subscription-based offering delivered by Cynode, designed to monitor, detect, and respond to security threats in the Client's environment. It includes threat intelligence, alert triage, incident response coordination, and ongoing policy tuning based on Microsoft Defender products.
2. Scope of Services
Cynode will deliver:
- Threat Detection & Monitoring: 24/7 monitoring of Microsoft Defender alerts and telemetry data to detect security incidents.
- Incident Response: Initial analysis, containment, and coordination of threat response actions based on predefined response playbooks.
- Policy Tuning & Monitoring: Continuous review and improvement of Defender configurations, threat policies, and alert thresholds.
- Reporting: Periodic summary reports covering incident activity, response metrics, and security posture insights.
- Governance: Regular stakeholder meetings and documented escalation procedures.
Note: A one-time onboarding service is required before MDR begins, covering baseline assessment, environment hardening, and initial alert hygiene.
3. Service Levels
| Category |
Target SLA |
| Critical Incident Response |
Within 1 hour |
| High-Priority Incident Response |
Within 4 hours |
| Medium-Priority Incident Response |
Within 12 hours |
| Low-Priority Incident Response |
Within 24 hours |
| Analyst Availability |
24/7 |
| Technical Support |
24/7 |
| Threat Intelligence Analysts |
Business hours (8x5) |
| Platform Availability |
99.9% uptime |
| Mean Time to Detect (MTTD) |
1 hour |
| Mean Time to Respond (MTTR) |
4 hours |
4. Client Responsibilities
- Provide accurate asset inventory and required Microsoft Defender licenses.
- Maintain necessary infrastructure and ensure connectivity.
- Support incident validation and context-sharing.
- Manage identity and access controls for security operations.
- Communicate relevant changes in the environment.
5. Limitations of Liability
Out of scope:
- End-user support and general IT troubleshooting.
- Configuration or lifecycle management of Microsoft Defender solutions.
- Legal, forensic, or PR costs arising from incidents.
- Custom integrations with third-party tools.
- Network infrastructure and third-party security tool management.
- Business continuity and disaster recovery planning.
6. Term and Termination
The MDR service is licensed on a recurring basis (monthly/annually) as agreed. Termination terms are governed by the provisions set forth in the applicable Master Services Agreement (MSA) between the Client and Cynode.
7. Confidentiality and Data Handling
Cynode will ensure all collected data and detected incidents are handled confidentially and in compliance with applicable data protection laws.
8. Miscellaneous
This Agreement does not transfer ownership of software, intellectual property, or platform licenses. All configurations and actions are performed under the Client's direction and responsibility.