Chevalier — managed detection and response, in four tiers.
CyberTI®'s Managed Detection and Response (MDR) platform goes beyond existing MDR services by addressing the whole attack life cycle and aligning protection to the MITRE ATT&CK model. Every tier is fed by the same cyber threat intelligence (CTI): indicators of compromise and attack (IOC/IOA) and adversary behaviour mapped to MITRE ATT&CK; Vanguard and Elite add exploitation intelligence from attack surface monitoring. From a first, autonomous prevention engine connected through the cloud, attacks are halted right at the entrance, and security is reinforced with kernel-level data gathering and processing to make it more resilient to attacker manipulation.
Chevalier — Managed Detection & Response tiers
All delivered from CyberTI®'s single MDR platform, so you can take advantage of layered security.
Chevalier
Chevalier Vanguard
Chevalier Hunter
Chevalier Elite
Which tier, and how to read the table
The four tiers are cumulative rather than alternative: each one is the tier below it plus the rows the table adds. So the question is not which product to buy but where the line falls between what your own people will do and what you would rather hand over, and the table is arranged to make that line visible.
Chevalier is the base — prevention, detection and canary tripwires on the endpoint, monitored around the clock. Vanguard adds attack surface monitoring, which is the outside-in view of what an attacker can reach without credentials; that capability is a product in its own right and is described in full on the U-ASM page. Hunter adds proactive threat hunting — analysts going looking rather than waiting for a rule to fire. Elite adds the remote incident response hours that turn a confirmed detection into somebody else's night.
Two things sit outside the tiers and are worth knowing before you choose one. If you are not yet sure what you should be logging or where your coverage stops, that is an advisory engagement rather than a subscription, and it is usually the cheaper place to start. If the constraint is your SIEM — its cost, its licence model, or the effort of maintaining detections in it — that is the SIEM services practice, which runs alongside any tier rather than replacing one.
The Global Threat Intelligence row and the threat intelligence (IOC/IOA) capability above are how CTI reaches your environment on every tier. An indicator or a described attacker behaviour becomes either a detection rule or a hunt hypothesis; when it matches your endpoint, network or cloud telemetry an analyst confirms it, and the Response Action Execution row is the point where it turns into containment. The practice behind it is described on the cyber threat intelligence page.
The hunting rows are where operational CTI is used. Targeted threat hunting runs quarterly on Chevalier and Vanguard, fortnightly on Hunter and weekly on Elite, and Hunter and Elite add artifact-driven and hypothesis-driven hunting: analysts start from what a campaign is known to do and look for it in your estate before any rule fires. The global threat intelligence and IOC/IOA matching are the same on every tier; what the higher tiers change is how often, and how, analysts hunt with it, and Vanguard and Elite add attack surface monitoring.
Every tier is delivered from the same platform and by the same team; there is no separate organisation behind the higher ones. The full catalogue is on the services page, and the people and the registered entity behind it are on the about page.
Unified Attack Surface Management (U-ASM)
U-ASM continuously discovers and monitors your digital assets for vulnerabilities and weaknesses, which helps you gain the attacker's point of view, resulting in a proactive and effective approach to security.
Ready to see your attack surface the way an attacker does?
Book a walkthrough with an Australian-based security engineer. No scripted demo, no obligation.
Both forms deliver to info@cyberti.com.au.