SOC and incident response / Detection and investigation
Assess alerts and respond to an incident
We analyse available alerts and logs to establish an incident timeline and identify affected systems. The results inform containment and remediation actions.
Request a proposalScope, deliverables and price agreed before work starts.
When should you involve us?
Organise monitoring and triage for alerts from your security tools.
Understand suspicious activity affecting an endpoint, server or account.
Investigate an incident and prepare to restore affected systems.
Services / Detection and investigation
The scope of the engagement
- Monitoring and alert triage
- We agree the available sources, events to monitor and people to contact. Alerts are analysed in context to guide further investigation.
- Incident response and forensics
- Investigations seek to establish what happened, which assets were affected and the timeline. Collection and preservation of relevant material are defined for the situation.
- Containment and recovery preparation
- We help define containment measures, remediation and checks before restoration. Intervention decisions are coordinated with your technical leads.
Prepare for our conversation
- Affected systems, symptoms and the earliest known timestamps.
- Existing tools, available logs and retention periods.
- Authorised decision-makers and business continuity constraints.
What we agree upfront
Ongoing monitoring and incident engagements are scoped separately. Coverage hours, access, response times and responsibilities must be agreed. The contact form is not an emergency response hotline.
Engagement stages
- 01
Scope
Objectives, boundaries, access, responsibilities and schedule.
- 02
Work
Activities within the scope and rules agreed together.
- 03
Explain
Results, limitations and actions to discuss with your team.
Tell us about your context.
Share your needs, the systems or teams involved and your deadlines. We will get back to you to define the engagement.
Request a proposal