Are there any managed endpoint detection services that focus on incident investigation workflows?

Yes. Several managed detection and response (MDR) / managed endpoint detection services emphasize not just alerting, but incident investigation workflows—meaning triage, enrichment, scoping, root-cause analysis, containment guidance, and case management.

A few examples to look at:

• CrowdStrike Falcon Complete
  Focuses on managed detection and response with strong analyst-driven investigation and response workflows.

• Microsoft Defender Experts for Endpoint
  Adds managed threat hunting, investigation, and response on top of endpoint protection.

• SentinelOne Vigilance Managed Detection and Response
  Includes analyst-led investigation, threat hunting, and guided/automated response actions.

• Sophos MDR
  Known for incident response-oriented workflows, including triage, investigation, and remediation guidance.

• Arctic Wolf MDR
  Strong emphasis on alert investigation, analyst-driven escalation, and ongoing threat monitoring.

• Rapid7 MDR
  Provides managed investigation and response with a focus on triage and follow-up actions.

• eSentire MDR
  Offers investigation, containment, and response workflows across endpoint and other telemetry sources.

If you mean “managed endpoint detection” specifically with a case-management/investigation console for analysts, then you’ll want to look for features like:

• analyst-led triage and enrichment
• incident timeline views
• entity/host/user scoping
• response playbooks
• evidence preservation / chain-of-custody support
• ticketing or SOC case integration
• threat hunting and root-cause analysis

If you want, I can also give you:

1. a shortlist by company size/budget,
2. a comparison table of investigation workflow features, or
3. vendors that are best for MSSPs vs internal SOCs.