Managed Security Operations Centre (SOC) and Managed Detection & Response (MDR). We collect logs from firewalls, servers, endpoints, cloud and applications into one place, analysed by L1–L3 analysts working in shifts 24 hours a day.
Scope
- SIEM / SOAR deployment and operation with use cases tuned to your business
- Proactive threat hunting driven by local and global threat intelligence
- Alert triage that cuts false positives, with escalation by severity
- Remote containment: isolate hosts, disable accounts, block IPs
Alerting SLA
| Severity | Example | Notified within |
|---|---|---|
| Critical | Ransomware, data exfiltration | 15 minutes |
| High | Account takeover, spreading malware | 30 minutes |
| Medium | External scanning, policy violation | 4 hours |