24/7 managed SOC and MDR services in Canada
North Star provides 24/7 managed SOC and MDR services for Canadian businesses. Security analysts investigate alerts and coordinate response within an agreed scope. North Star publishes $1,500 to $5,000 per month for its own managed SOC service; your quote should confirm monitored systems, coverage hours and response authority.
Before buying MDR: who can actually respond?
Before buying 24/7 SOC services, get the monitored systems, monitoring hours and responder responsibilities in writing. Continuous monitoring does not establish a fixed containment or recovery time. North Star supports businesses remotely across Canada, with physical dispatch from Grande Prairie, Alberta and Prince George, British Columbia. Onsite work elsewhere is scoped separately, subject to availability.
- Coverage: list endpoints, servers, identities, email and cloud logs included in the quoted scope.
- Authority: agree who may isolate a device, disable an account or revoke sessions, and when your approval is needed.
- Escalation: document your after-hours contact and the response commitment for each severity.
- Recovery: identify who handles restoration, investigation, communications and project work outside the monitoring agreement.
- Evidence: ask for a redacted sample incident report and a walkthrough of the escalation process before signing.
Compare endpoint detection options if you are choosing technology. If an incident is already happening, use the incident response service; buying monitoring is not the same as containing an active breach.
What is MDR, and what is a managed SOC?
MDR means managed detection and response: a service combining security technology, analyst investigation and agreed response procedures. A security operations centre, or SOC, is the function that carries out security monitoring and response. The service agreement determines which systems are monitored, when analysts are available and which actions they may take.
| What it is | Who acts on it | What it misses on its own | |
|---|---|---|---|
| EDR | Software on each laptop and server that spots malicious behaviour | Configured automated protections and authorised operators | Visibility beyond supported endpoints depends on additional integrations |
| SIEM | A place logs are collected and correlated | Analysts and configured automation rules or response playbooks | Missing log sources, unconfigured detections and actions outside its permissions |
| XDR | EDR extended across cloud, identity and email, correlated in one place | Configured automated responses and authorised operators | Licensing alone does not establish analyst coverage or response responsibilities |
| MDR | The above, plus analysts who triage and respond on your behalf | The provider's SOC, to an agreed mandate | Systems and recovery work outside the contracted scope |
EDR and XDR can automate protective actions; SIEM platforms can also orchestrate response. Microsoft documents automatic and approval-based remediation in Defender and automation rules and response playbooks in Sentinel. Availability depends on product, licensing, configuration and permissions. MDR adds responsibility for reviewing alerts, handling exceptions and escalating under the agreed mandate.
What does MDR cost, and what does building it yourself cost?
North Star publishes $1,500 to $5,000 per month for its own managed SOC service, scaling with users, endpoints and the volume of log data ingested. This is one provider's published range, not a Canadian market benchmark or a fixed quote. Confirm onboarding, retention, monitoring hours, response authority and work outside the recurring fee in your proposal.
Plan coverage and handovers.
An internal SOC needs a plan for shifts, leave, training, supervision and handovers. Staffing depends on workload, automation and responsibilities; use your own coverage requirements when comparing an internal team with a managed service.
Define your internal owner.
An internal security lead can own priorities, business context and approvals while a managed service handles agreed monitoring tasks. Document who covers absences and after-hours escalations rather than assuming one hire provides continuous coverage.
Compare the full operating scope.
Compare supported integrations, tuning, investigation, response permissions, reporting and log retention. Ask how the provider shares incident findings and works with your IT team; neither an internal nor a shared SOC guarantees that every attack will be detected.
An internal, managed or combined model can work. Evaluate business needs, skills, costs and contractual obligations. Data residency requirements depend on the data, applicable rules and contracts; they do not create a universal ban on third-party log processing.
What a managed SOC does with an alert
The workflow should explain how alerts are collected, investigated, prioritised and escalated. Alert volume and the proportion requiring action vary by environment; ask how tuning and investigation decisions are recorded.
Collect, from more than endpoints.
List the endpoints, servers, Microsoft 365 and Entra ID logs, firewall and VPN logs, and cloud audit trails included in the proposal. Coverage depends on supported integrations, licensing, permissions and successful log collection; do not assume every source is included.
Investigate and prioritise.
Analysts review available evidence and automated findings against business context, such as approved scripts, travel or scheduled jobs. Agree how unresolved alerts, collection failures and approval requests reach your designated contacts.
Respond within an agreed mandate.
Device isolation, account disabling, address blocking or session revocation may be appropriate when supported and authorised. Record which actions are pre-approved, which require customer approval and how responders escalate if the approver cannot be reached.
Hunt, and report so it is auditable.
Confirm whether threat hunting and monthly reporting are included, which systems they cover and what evidence is provided. Agree separately who owns remediation, restoration, forensics and communications; monitoring does not guarantee insurer or auditor acceptance.
When comparing detection and response metrics, ask what starts and stops the clock, which incidents are included and whether the figures are historical averages or contractual targets. An automated action, analyst acknowledgement, containment and full recovery are different milestones.
What to confirm in your managed SOC proposal
Use these questions to make responsibilities clear before onboarding. Compare the written scope with the systems and response procedures your business needs.
Will you act, or notify?
Get the response mandate in writing: permitted actions, coverage hours, severity definitions and any response targets. Approval requirements can be appropriate for business-critical systems; agree how they affect escalation and containment.
How do analysts and automation work together?
Ask when analysts are available, how automated actions are reviewed and who handles exceptions. Confirm the after-hours contact route and escalation process for your environment.
Where do the logs live?
Data residency matters for Canadian organisations with privacy obligations or public-sector customers. Ask which country the log data is stored in and for how long. See data residency in Canada.
What is out of scope?
Confirm whether remediation, forensics, system rebuilds, restoration and incident communications are included or separately quoted. Assign an owner for each recovery task before an incident.
Can we leave?
Confirm the notice period, log export formats, export costs, retention and deletion terms, and the handover of open incidents when the agreement ends.
North Star's managed SOC uses Huntress and SentinelOne. Your proposal should identify the selected products, licences, integrations and responsibilities; naming the stack does not mean every product feature or log source is included.
What is pushing Canadian SMBs to buy MDR
Cyber insurance renewals.
If your application asks about continuous monitoring, MFA or tested backups, describe the controls actually deployed and retain supporting evidence. Confirm requirements and any coverage implications with your insurer or broker. See cyber insurance requirements.
A customer security questionnaire.
Where a customer asks about continuous monitoring, compare the requirement with the systems and hours actually covered. A service agreement and reports can support your answer but do not establish that every procurement requirement is met.
An incident, theirs or a peer's.
If an incident is active, start with incident response; ongoing monitoring and recovery planning address different needs and cannot guarantee prevention.
Nobody is reading the console.
If alerts or approval requests have no assigned owner, review the monitoring process and existing licences. An assessment can help identify whether configuration changes, internal coverage or a managed service fits the gap.
What MDR will not do
It does not prevent the phishing email.
Monitoring and response complement awareness training and email filtering. Confirm the responsibilities and pricing for each control.
It does not replace backups.
Detection and containment do not restore lost data. Recovery depends on backup condition and a tested restore process. See backup and disaster recovery.
It does not fix the basics for you.
Assign responsibility for MFA, administrator privileges and patching. Monitoring can identify issues, but fixing them requires an agreed owner, access and scope.
The free assessment offers an optional public-domain security check and a confidential request for human review. Use the request to describe your existing tools, monitoring gaps and response needs. A public-domain snapshot does not establish endpoint coverage or replace a managed SOC scope review.
Find out whether MDR is your next spend
Share your current security tools, systems to cover, existing alert owner and after-hours contact needs. Use the assessment to discuss monitoring, approval and recovery responsibilities before requesting a scoped proposal.
Start the free assessment Back to CybersecurityFrequently asked questions
What does MDR stand for?
MDR stands for managed detection and response. It combines security technology, analyst investigation and response under an agreed mandate. A security operations centre, or SOC, performs monitoring and response work. Confirm the monitored systems, monitoring hours, analyst availability and response responsibilities in the service agreement.
What is the difference between MDR and EDR?
EDR is endpoint security software that detects suspicious activity and can take automated protective actions, depending on product, configuration and permissions. MDR adds a managed service with analysts who investigate, review exceptions and coordinate authorised response. Confirm who owns alerts, approvals and escalation outside business hours.
How is MDR different from a SIEM or XDR?
A SIEM collects and correlates logs; platforms such as Microsoft Sentinel can also automate incident handling and run response playbooks. XDR correlates signals across supported security products and can automate response. MDR adds analyst investigation and agreed operational responsibilities. Product licensing alone does not establish staffed monitoring hours or a response mandate.
How much does a managed SOC cost for a Canadian SMB?
North Star publishes $1,500 to $5,000 per month for its own managed SOC service, scaling with users, endpoints and log volume. This is one provider's published range, not a Canadian market benchmark or a fixed quote. Confirm onboarding, retention, monitored systems, monitoring hours, response authority and separately quoted incident work in your proposal.
Can we just hire a security person instead?
An internal security lead can own priorities, business context and approvals, with internal, managed or combined monitoring coverage. Plan shifts, leave, training and handovers around your workload rather than assuming a fixed staffing number. Assess data handling against your applicable requirements and contracts; data residency does not impose a universal ban on third-party log processing.
Will the SOC act on its own, or just tell us?
Get response authority in writing. Identify supported and pre-approved containment actions, actions needing customer approval, monitoring and response hours, severity definitions and any contractual response targets. Name an after-hours approver and an escalation route if that person is unavailable. Approval-based response can be appropriate; continuous monitoring does not guarantee a fixed containment time.
Where is our log data stored?
Confirm storage and processing countries, administrative access, retention, export and deletion terms for the selected products and log sources. Requirements depend on the data and your applicable rules and contracts. North Star uses Huntress and SentinelOne; the proposal should identify the selected scope rather than assume every product feature or log source is included.
Does MDR mean we can stop worrying about backups and training?
No. Monitoring and response complement email filtering, awareness training, MFA, patching and access controls. Containment does not restore lost data, and monitoring cannot guarantee prevention. Keep tested backups and document who owns restoration and the other controls.
What does MDR not include?
Inclusions depend on the agreement. Confirm whether remediation, forensics, system rebuilds, restoration and insurer or regulator communications are included or separately quoted. North Star offers incident response as a distinct engagement from the monthly SOC service. Assign recovery responsibilities in writing; monitoring does not guarantee a fixed recovery time.
A clear scope before you commit