Major Incident threshold for retainer activation
Catalog row in Vendor License Rules · Cited
- Kind
- Threshold
- Statement
- MDR guide (2026-09-09): a Major Incident is declared when the incident has spread to at least two hosts, a business-critical system is at risk, or a host without Elements EDR protection is compromised.
- Applies when
- Deciding whether retainer support is triggered.
- Applies to
- WithSecure Managed Detection and Response.
- Related metrics