Managed Detection and Response (MDR) services should spot prevention failures and respond quickly. Good MDR services spot Red Teams and Pen Testers who are tasked with defeating preventative controls. A great MDR service knows when real, malicious threat actors are hiding their footprints amongst Red Team activity. In this war story, we discuss how Managed Defense, FireEye's MDR service, deals with such situations.