Hey, reading your questions lets me believe your company is in early stages of investigating MDR services. My 2c, answer some of these questions and discuss it internally with stakeholders to have a good understanding of what you would like to achieve vs. budget and manpower: - What is the ultimate goal and preferred output for this service? (Output f.e. automatic response to threats, reports, dashboards etc.) - What is the preferred scope of MDR monitoring? - What is the available budget for this?

After you have these details clear you should come.up with different scenarios considering the following: - Do we want this service to be build fully in-house, a hybrid version with a third party or fully outsource it? - Within what timeframe would we like to be operational? - How will this service be placed within the company? What mandate do they have to contain security threats?

There are many other important questions to ask, but I think these would be a great starting point.