What is included

Monitoring makes sense once there is something to monitor: protection tools and logging first, observation of them second.

Discuss the scope

Event collection

Connecting the sources: firewalls, antivirus, domain controllers, servers, applications.

Correlation

Linking events from different systems. Taken separately they are harmless, together they add up to an attack.

Incident detection

Rules written for your infrastructure plus standard attack scenarios.

Response

A procedure: who to notify, what to isolate and in which order.

Investigation

Working out what happened: how they got in, what they managed to do, what to do next.

Reporting

Regular reports on incidents and on the trend.

How the work runs

Connection takes from two weeks to a month: most of the time goes on tuning the rules to your infrastructure.

01

Survey

We look at which event sources exist and what can be collected from them.

02

Connection

We configure log forwarding and event normalisation.

03

Rule tuning

The first weeks are spent adjusting to your specifics, otherwise a stream of false alerts makes the monitoring useless.

04

Operation

Round the clock observation, notifications under the procedure, monthly reports.

Monitoring without a response procedure is useless. If an attack is detected at three in the morning and there is nobody to call and nobody with the authority to switch a server off, the value of the observation is zero. The procedure is prepared alongside the connection rather than afterwards.

Frequently asked questions

It depends on what downtime and a leak would cost. For a company where IT supports office work, basic measures and good backups are usually enough. For those whose production would stop or whose client data would leak, monitoring pays for itself with the first prevented incident.

Round the clock cover needs at least five people across the shifts. For most companies that costs more than an external service. A hybrid works too: external monitoring at night and at weekends, your own specialists during the day.

Monitoring does not guarantee that there will be no incidents, it shortens the time to detection. The difference between detecting something after ten minutes and after two weeks is the difference between an isolated infection and an encrypted company.

Let us discuss monitoring

Tell us what is critical for you and what an hour of downtime costs. We will say honestly whether you need monitoring or should close the basics first.