Stoïk MDR: deployment in 4 steps

We guide you through deploying your EDR (Endpoint Detection & Response), managed by the Stoïk SOC, for 24/7 protection.

1

01. Collecting the client identifier

EDR client identifier, example: 2FA390DA300000000EXAMPLE (Endpoints > Settings > Information)

The week before your contract is activated, you will receive your EDR client identifier by email (also available in your Stoïk Protect space).

• A unique identifier for endpoints and servers.

• Check the 4 key points to review before starting deployment.

2

02. Installing the EDR

30-minute webinar, choose a time slot

You're not alone! Join our MDR training session.

Learn about the MDR deployment methodology and how the Stoïk SOC operates 24/7. Attendance by the IT manager or provider is recommended.

The EDR must be installed on all workstations and servers.

Two possible methods:

1. Manual deployment: recommended for up to 20 endpoints, or to test the solution before an automatic rollout.

2. Automatic deployment: via GPO or your management tools (MDM).

Once installed, the EDR replaces your antivirus: a first level of protection is already active.

Additional modules: Mobile devices and Active Directory can be monitored via additional modules. Contact our cyber consultants: [e-mail]

3

03. Progressive configuration by the Stoïk SOC

After installation, our Security Operations Center (SOC) configures your EDR in 3 phases over about one month, with no impact on your operations. No action is required on your part.

1. Observation phase (≈ 2 weeks)

• Observation of your environment and definition of a normal-behavior baseline.

• Traffic analysis and anomaly detection, without blocking.

• The EDR already provides antivirus-level protection at this stage.

2. Initial protection phase (≈ 2 weeks)

• Rollout of the first security rules.

• Automatic blocking of suspicious activity.

3. Optimal protection phase

• Full activation of EDR features.

• Maximum security level, tailored to your infrastructure.

4

04. Monitoring results

To track the activity of your monitored assets, go to your Stoïk Protect dashboard: Endpoints > Results.

The dashboard shows:

• Criticality levels (Critical, High, Medium, Low)

• Alert handling status (Open / Resolved)

• A clear summary of each alert

How are alerts handled by Stoïk's SOC team?

When an alert is detected, the maximum acknowledgment time is 15 minutes. Response time then varies according to criticality:

• 45 minutes maximum for critical alerts

• 4 business hours maximum for medium alerts

Most incidents are resolved directly by our analysts. If action is required on your part, you are notified immediately by email.

Provide your emergency contacts from Stoïk Protect (Settings > Users) so the Stoïk SOC can reach you quickly in the event of an incident.

Additional modules available to extend the protection

• Phones (Mobile)

• Active Directory (ITP)

• Vulnerability management (Spotlight)

• IT mapping (Discover)

To learn more or activate these options, contact us: [e-mail]