MDR-01
Endpoint & Server XDR Telemetry
Deploying lightweight kernel sensors across Windows, Linux, and macOS to block ransomware, memory injection, and living-off-the-land attacks.
Request Specification
CYB-02 // 24/7 MDR & THREAT HUNTING
24/7/365 Managed Detection, Automated SOAR Containment & Active Threat Hunting
Stop breaches before they become headlines. Our Nairobi Cyber Security Operations Center (CSOC) monitors your endpoints, servers, cloud workloads, Active Directory, and network traffic 24/7/365—isolating compromised hosts in under 12 minutes.
< 12 Min Threat Containment
24/7/365 Human-Led Threat Hunting
Endpoint, Network & Cloud XDR
Automated SOAR Host Isolation
24/7 MANAGED DETECTION & RESPONSE // CSOC
< 2 Min
Automated Telemetry Ingestion
< 12 Min
Mean Time to Contain (MTTC)
24/7/365
Eyes-on-Glass CSOC Analysts
99.4%
Alert Noise Reduction via AI
EYES-ON-GLASS 24/7 DEFENSE
Why Alerts Without Action Fail—And How Active MDR Neutralizes Ransomware
Most breaches happen at 2:00 AM on a weekend or public holiday when internal IT teams are asleep and firewall email alerts go unread.
Dulo Tech's 24/7 Managed Detection & Response (MDR) doesn't just forward you alert emails. When our XDR sensors and SIEM detect credential dumping, suspicious PowerShell execution, or C2 callbacks, our Nairobi CSOC analysts and automated SOAR playbooks quarantine the affected endpoint and revoke compromised tokens within minutes.
24/7/365 Real-Time Endpoint, Identity, Network & Cloud XDR Telemetry
Pre-Authorized SOAR Playbooks Isolating Ransomware in Under 12 Minutes
Proactive MITRE ATT&CK Hypothesis-Driven Threat Hunting & DFIR
NAIROBI CSOC // ACTIVE THREAT CONTAINMENT
SLA: 99.999%
SIX PILLARS OF DULO TECH MDR
Complete 24/7 Detection, Investigation & Response
Our MDR subscription protects every layer of your enterprise digital estate.
MDR-01
MDR-02
Identity & Active Directory Defense
Monitoring Entra ID (Azure AD), Okta, and on-premise Domain Controllers for impossible travel, MFA fatigue, Golden Ticket, and lateral movement.
Request Specification
MDR-03
Network Detection & Response (NDR)
Deep packet inspection and encrypted traffic analysis across core switches and firewalls to spot command-and-control (C2) beaconing.
Request Specification
MDR-04
Cloud & SaaS Telemetry (M365/AWS/Azure)
Detecting malicious inbox forwarding rules, unauthorized IAM role creations, and anomalous S3/SharePoint mass downloads.
Request Specification
MDR-05
Automated SOAR Containment
Executing pre-approved playbooks to network-isolate infected hosts, disable compromised AD accounts, and block malicious IPs automatically.
Request Specification
MDR-06
Digital Forensics & Root-Cause Analysis
Full forensic timeline reconstruction, malware sandboxing, and executive incident reports after every contained event.
Request Specification
MDR INCIDENT TIMELINE
How Our 12-Minute Containment SLA Works in Practice
Speed is the only metric that separates a minor blocked intrusion from a catastrophic enterprise-wide ransomware outage.
TIM-01
Minute 00–01: Telemetry Detection
Behavioral XDR sensor or NDR probe flags anomalous process tree or lateral SMB movement and streams telemetry to Dulo CSOC.
< 60 SEC DETECT
TIM-02
Minute 01–03: AI Correlation & Enrichment
SOAR engine correlates the alert with global threat intelligence, MITRE ATT&CK tactics, and user identity context.
AI ENRICHED
TIM-03
Minute 03–06: CSOC Tier-2 Analyst Triage
Live Nairobi CSOC analyst inspects process memory and command-line arguments to confirm true positive threat.
HUMAN VERIFIED
TIM-04
Minute 06–09: Automated Host Quarantine
Endpoint is isolated from the corporate network via XDR agent while keeping an encrypted forensic tunnel open to our CSOC.
HOST ISOLATED
TIM-05
Minute 09–12: Identity & Firewall Block
Compromised user sessions/tokens are revoked across M365/AD and malicious C2 indicators are pushed to perimeter firewalls.
< 12 MIN CONTAINED
TIM-06
Post-Containment: Eradication & Recovery
Malicious persistence is wiped, root-cause vulnerabilities are patched, and the clean host is safely restored to production.
CLEAN RECOVERY
MDR COVERAGE MATRIX
MDR Service Tiers & Response Commitments
Scalable 24/7 Managed Detection & Response packages for enterprises of any size.
| Tier Code | MDR Package Tier | Telemetry Scope | Containment SLA | Reporting & Threat Hunting |
|---|---|---|---|---|
| MDR-T1 | MDR Core (Endpoint & Identity) | Workstations, Servers & Active Directory / M365 | < 15 Min Containment | Monthly CSOC Report + Automated SOAR |
| MDR-T2 | MDR Advanced (Full XDR) | Endpoints, Identity, Firewalls, Cloud & NDR | < 12 Min Containment | Bi-Weekly Threat Hunt + vCISO Review |
| MDR-T3 | MDR Sovereign / Financial | Full Estate + Custom SIEM, Deception & Dark-Web | < 8 Min Containment | Dedicated CSOC Pod + CBK/ODPC Audit Pack |
| MDR-T4 | Emergency DFIR Retainer | Pre-Negotiated Incident Response Standby | < 15 Min Remote / 2-Hr On-Site | Guaranteed Retainer Hours & Tabletop Drills |
TECHNICAL KNOWLEDGE BASE
Frequently Asked Engineering & Procurement Questions
Direct answers from Dulo Tech Limited's Principal Systems Architects, CSOC Directors, and Institutional Procurement Officers at Mirage Towers, Nairobi.
Yes! We are vendor-agnostic and accredited across CrowdStrike, SentinelOne, Microsoft Defender for Endpoint (E5), Sophos, Palo Alto Cortex, and Fortinet—or we can supply the XDR licenses bundled into your monthly MDR fee.
No. During onboarding, we establish a strict Playbook Governance Charter with your team: user workstations can be isolated automatically 24/7, while critical production database servers require simultaneous voice/SMS confirmation with your designated on-call officer.
Standard onboarding—including XDR sensor rollout via GPO/Intune, log collector setup, and SOAR playbook calibration—takes just 5 to 10 business days.
Yes. Global cyber insurers and financial regulators explicitly require 24/7 EDR/MDR monitoring and MFA to qualify for coverage and regulatory sign-off.
All telemetry can be retained in sovereign Kenya-resident encrypted storage or your designated regional cloud tenant in full compliance with the Kenya Data Protection Act.
Traditional MSSPs simply forward raw firewall log alerts to your inbox and leave the investigation to you. Dulo Tech MDR actively investigates, hunts threats, and remotely contains the attack on your behalf 24/7.
MDR is priced transparently per monitored endpoint/server or network node per month. Request a tailored quote using the form below.
Need direct architectural clarification?
Call +254 799 000 595
DIRECT DISPATCH DESK
Request Technical Briefing or Tender BOQ Quote
Routed directly to our Senior Engineering Board at 12th Floor, Mirage Towers, Westlands, Nairobi.