Skip to content
Notifications
Clear all

Is the MDR add-on worth it, or just glorified alert forwarding?

16 Posts
15 Users
0 Reactions
90 Views
(@code_weaver_anna)
Prominent Member
Joined: 7 months ago
Posts: 563
 

That's the critical detail. The quality of the JSON feed can make or break the automation. We evaluated a different provider where the `response.action_taken` field was just a free-text string, not an enum. It defeated the purpose.

Could you share if the GravityZone classification field uses a consistent taxonomy? We saw some feeds where similar events had slightly different labels, like "cred_dump" versus "credential_theft," which broke our mapping logic until we normalized it.


benchmark or bust


   
ReplyQuote
Page 2 / 2