Event collection
Connecting the sources: firewalls, antivirus, domain controllers, servers, applications.
Monitoring makes sense once there is something to monitor: protection tools and logging first, observation of them second.
Connecting the sources: firewalls, antivirus, domain controllers, servers, applications.
Linking events from different systems. Taken separately they are harmless, together they add up to an attack.
Rules written for your infrastructure plus standard attack scenarios.
A procedure: who to notify, what to isolate and in which order.
Working out what happened: how they got in, what they managed to do, what to do next.
Regular reports on incidents and on the trend.
Connection takes from two weeks to a month: most of the time goes on tuning the rules to your infrastructure.
We look at which event sources exist and what can be collected from them.
We configure log forwarding and event normalisation.
The first weeks are spent adjusting to your specifics, otherwise a stream of false alerts makes the monitoring useless.
Round the clock observation, notifications under the procedure, monthly reports.
Monitoring without a response procedure is useless. If an attack is detected at three in the morning and there is nobody to call and nobody with the authority to switch a server off, the value of the observation is zero. The procedure is prepared alongside the connection rather than afterwards.
It depends on what downtime and a leak would cost. For a company where IT supports office work, basic measures and good backups are usually enough. For those whose production would stop or whose client data would leak, monitoring pays for itself with the first prevented incident.
Round the clock cover needs at least five people across the shifts. For most companies that costs more than an external service. A hybrid works too: external monitoring at night and at weekends, your own specialists during the day.
Monitoring does not guarantee that there will be no incidents, it shortens the time to detection. The difference between detecting something after ten minutes and after two weeks is the difference between an isolated infection and an encrypted company.
Tell us what is critical for you and what an hour of downtime costs. We will say honestly whether you need monitoring or should close the basics first.
Request received
We can already see it. We will reply within one business day, and for urgent matters we will bring in the on-duty engineer right away.
City not found. Please check the spelling.