EDR RFP questions

Ask the provider to name the MITRE ATT&CK techniques it has tested, the method used for each test, and the evidence delivered afterward. A strong answer lists specific techniques across initial access, execution, persistence, privilege escalation, credential access and lateral movement, states whether tests were run in your environment or a lab, and provides the raw alert output for each one. Verify by choosing five or six techniques from your own threat model and running a controlled test on a pilot host, then checking whether an alert fired, how long it took, and whether the alert contained enough context for triage. Open-source components such as Wazuh rules, Velociraptor hunts or osquery queries can be used to illustrate what you should ask, but no tool should be assumed to cover a technique until your own test confirms it.

Ask which actions run without analyst approval, such as host isolation, process termination, file quarantine or account disablement, and which require a human decision. A good answer separates automated actions from manual ones, explains how each action is reversed, and describes how the tool avoids isolating a domain controller or production server by mistake through allow-lists, tagging or staged rollout. Ask for the audit record each action produces and who can change the automation rules. Verify by reviewing the action catalog in a pilot, running each action against a test host, and confirming the rollback steps and log entries work as described. For Wazuh, ask specifically how active response scripts are scoped to agent groups and approved before they touch production hosts.

Ask for a written list of supported operating system versions, the agent's resource use under normal and peak load, the privileges it requires, and whether it needs kernel drivers or changes to the host's boot or security settings. Also ask what happens on unsupported systems such as legacy Windows, older Linux distributions or Unix variants. Verify by requesting the exact agent package list and installation requirements, then testing the agent on your oldest and most sensitive host types with CPU, memory and network monitoring in place. For coverage gaps, ask which alternatives are offered, such as log forwarding or agentless monitoring. Wazuh documents agents for Linux, Windows, macOS, Solaris, AIX and HP-UX and agentless monitoring for devices such as firewalls, but confirm each version against your estate.

Ask which systems store raw events, alerts and collected artifacts, in which country or data center they sit, who holds administrative access to them, and how encryption keys are managed. A complete answer also states the retention period for each data class, how deletion is performed, and how backups are protected. Clarify whether any telemetry leaves your environment for vendor cloud analysis, threat intelligence lookups or updates. Verify by drawing the data flow diagram with the provider and checking each arrow against your network policy, then confirming retention settings in a test deployment. Self-hosted platforms keep data inside your infrastructure by design, but the implementer still has to document storage locations, encryption and retention for each component.

Ask who performs triage around the clock, whether analysts are employees, a partner's staff or a shared pool, and what their written response targets are for each severity level. A good answer names the escalation path to your on-call engineers, the handoff format, and the conditions that trigger a call to you rather than a ticket. Ask how the provider covers holidays, staff absence and surges during an incident. Verify by requesting the runbook and a sample shift handover from a comparable engagement, then running a simulated high-severity alert outside business hours and timing the notification. Be cautious of any statement that promises a particular response time without a written service level agreement, and ask for the contractual terms before relying on them.

Ask which collection tools are used, whether the provider can gather volatile memory, disk images, event logs and artifacts from live systems, and how chain of custody is recorded. A strong answer describes hash verification, storage of evidence in a controlled location, and whether analysts can testify or prepare a written report for counsel, insurers or regulators. Ask whether offline collection is supported for hosts that cannot run an agent. Verify by requesting a sample evidence package and a chain-of-custody form, then running a collection drill on a test host. Velociraptor is one open-source option for artifact collection and offline collectors, but confirm with the provider whether memory acquisition, disk imaging and legal handling are within the agreed scope.

Ask how false positives are measured, how new rules are tested before they reach production, who approves changes and how each change is recorded. A complete answer covers a review cycle, a rollback process, a method for mapping rules to threat-intelligence updates and a record of tuning decisions that an auditor can read. Ask how the provider keeps rules current with new vendor releases and how often that happens. Verify by reviewing the change log from a pilot period, checking whether each suppression has a documented reason and expiry date, and confirming that a rule change can be reversed. For self-hosted tools such as Wazuh, ask who owns the rule repository and how custom decoders are versioned and tested before deployment.

The answer depends on your staffing, your hours of coverage and the scope you want the provider to own. Ask the provider to split responsibilities into what your team does, what the partner does, and what is shared, covering deployment, rule tuning, triage, response, forensics, patching and upgrades. Ask which costs are one-time, such as design and deployment, and which recur, such as hosting, storage, licensing for any commercial add-ons, analyst time and retainers. Ask what drives those costs up, such as endpoint count, log volume, retention period and hours of coverage. Verify by requesting a written scope with named deliverables and a responsibility matrix before comparing quotes. DeployOpen plans, implements, hardens and supports self-hosted platforms in the client's infrastructure on a fixed scope agreed in writing, and quotes follow from that scope.