What events help an MDR service detect attacks?

What information does an MDR service need to protect a company from complex targeted attacks?