Sophos MDR Essentials for Education 1-Year Subscription License

1-Year Subscription License.

Sophos MDR Essentials is a fully managed, 24/7 threat hunting, detection, and response service delivered by the Sophos MDR Ops team. It’s designed for organizations that want experts watching and containing threats around the clock — while your internal IT/security team handles the full cleanup and remediation after escalation.

What’s included (software + platform)

• Sophos agent + Sophos XDR features for endpoints and servers (cloud-managed in Sophos Central)
• Coverage requires Sophos XDR and/or the Sophos XDR Sensor installed on the devices you want Sophos to monitor (“managed endpoints”)
• 90 days of data storage (with an optional add-on for longer retention)

What’s included (managed services)

• 24/7/365 monitoring, triage, investigation, and response actions
• Expert-led threat hunting to proactively search for attacker behavior that may have bypassed controls
• Threat containment and disruption (for example, stopping active attacks and preventing spread), plus clear escalation and communications
• Flexible response modes so you control how Sophos takes action:
• Authorize (Sophos can take response actions immediately, then notifies you)
• Collaborate (Sophos investigates, and response actions require your approval except limited actions like remote queries)
• Notify-only (Sophos investigates and advises; you execute actions)
• Reporting and security posture/health notifications to help keep coverage effective over time

Integrations and telemetry (what you can connect)

• Integrates with Sophos products (e.g., endpoint, firewall, email, cloud) and also supports many third-party security tools for broader visibility
• Microsoft 365 integrations (O365 Audit Logs and Microsoft Graph Security API) are supported at no extra cost (subject to your Microsoft subscriptions)
• Some third-party integrations require Integration Pack licenses; Sophos NDR is available as an add-on if you want network-level detection beyond what endpoints can see