Skip to content
Made in the UK

SIEM for MSPs

SIEM vs MDR for MSPs: which do clients need?

By , CTO, CybaVerse. Last reviewed

Most MSP clients need MDR, because a SIEM collects and searches logs but does not watch or respond. MDR adds analysts who triage alerts and contain threats around the clock. A SIEM alone suits clients that already employ a security team able to monitor it every hour of the day.

This page is part of our SIEM for MSPs guide.

What is the difference between SIEM and MDR?

A SIEM is software for collecting, storing, searching and correlating log data. MDR, managed detection and response, is a service in which a provider's analysts detect, investigate and contain threats for you. One is a tool you must operate; the other is an outcome delivered by people, often using SIEM-like technology underneath.

QuestionSIEMMDR
What is it?SoftwareService plus platform
Who watches 24/7?Your teamProvider's SOC
Who contains threats?Your teamProvider, within pre-approved actions
Log search and retentionCore strengthIncluded, scope varies
Staff neededAnalysts and engineersApprovals and recovery

When is a SIEM alone the better fit?

A SIEM alone can be the right choice when a client already has a staffed security team covering nights and weekends, or needs deep custom log search for audit and investigations. In those cases the client may want the tool, not a service. Be honest with clients about this; it builds trust.

  • In-house security operations with an on-call rota.
  • Heavy custom search, reporting or compliance queries.
  • An existing SIEM such as Microsoft Sentinel that is already well run.

How should an MSP choose per client, step by step?

Base the choice on who will act on alerts, not on the feature list. The steps below help an MSP place each client in the right model and explain the reasoning in plain language. Record the decision and revisit it at renewal or when the client's risk changes.

  1. Step 1: Ask who reads alerts at 3am

    If the answer is nobody, the client needs MDR.

  2. Step 2: Check regulatory and logging needs

    Note any requirements for log retention, search or reporting.

  3. Step 3: Review existing tools

    An existing SIEM can stay; MDR can layer on top of it.

  4. Step 4: Agree response authority

    Decide which containment actions the provider may take without asking.

Where does CybaOps fit between SIEM and MDR?

CybaOps gives MSPs both sides in one platform: security log collection and search on data normalised to OCSF, plus the CybaVerse SOC watching client environments around the clock. MSPs can deliver it to clients without running a separate SIEM team or building a SOC.

  • CybaOps collects security logs from endpoints, firewalls, cloud and Microsoft 365 into one place.
  • CybaOps normalises security data to the open OCSF schema.
  • Analysts and partners can search and investigate across their data in CybaOps, with AI help to build queries.
  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • CybaOne adds SIEM, an external penetration test and dark web monitoring to everything in CybaEdge.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • We are building a correlation engine into CybaOps that links related alerts into a single incident.

SIEM vs MDR

SIEM collects. MDR watches and acts.

Most MSP clients need MDR, because a SIEM collects and searches logs but does not watch or respond.

01 Log sources

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

SIEM vs MDR

02 The 4-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • SIEM in
  • CybaOne

What else do MSPs ask about SIEM and MDR?

Is MDR just an outsourced SIEM?

No. MDR includes people who investigate and respond. A SIEM on its own does neither. A SIEM collects and searches log data, while MDR adds analysts who triage alerts, contain threats and work incidents through to resolution.

Can a client have both?

Yes. Many MDR services run SIEM capability underneath or alongside an existing SIEM. Agree which system holds which data, who manages detections and how incidents are handled, so the two work together without duplicate alerts or gaps in responsibility.

Which costs more?

It depends on data volume and staffing. A SIEM's true cost includes the analysts to run it. When comparing options, include licences, storage, rule maintenance and round-the-clock cover, not just the software itself.

What should you do next?

  1. List which clients already send logs anywhere, and who reads them today.
  2. Pick two clients to start with and agree what good looks like.
  3. Book a CybaOps demo to see the workflow on real data.

See CybaOps | Become a CybaVerse partner

Related: How do MSPs run a SIEM without a 24/7 SOC? and What is OCSF and why does it matter for MSP log normalisation?

See the workflow on real data.

Book a CybaOps demo