Know when something is wrong and act quickly
We collect logs from your servers and applications, review alerts and respond when an incident happens. Every incident ends with a written report.
What is included
- Log collection
- System, web server, application and authentication logs are shipped to central, protected storage.
- Alert rules
- We set rules for failed logins, privilege changes, unexpected processes and unusual traffic.
- Triage
- We review alerts, filter out false positives and escalate confirmed incidents.
- First-hour procedure
- A written sequence covers notification, containment and evidence preservation.
- Containment support
- We isolate affected systems, revoke credentials and block attacker addresses.
- Post-incident report
- The report sets out a timeline, root cause, impact and actions to prevent a repeat.
How it works
Onboard. We connect log sources, set retention and agree who we call and when.
What you receiveA log source inventory and a contact matrix.
Tune. We adjust alert rules to your normal activity to reduce noise.
What you receiveA documented rule set.
Respond. When an incident is confirmed, we follow the first-hour procedure and keep you informed.
What you receiveNotification within 15 minutes and regular status updates.
Review. We analyse the incident once systems are stable.
What you receiveA post-incident report and a list of follow-up actions.
Right for you if
Nobody currently reads your server logs.
You need to show regulators or clients how incidents are handled.
You have no in-house security team on call.
Questions
Which hours are covered?
Coverage is business hours, extended hours or 24x7, as agreed in your service terms.
Who decides on containment steps?
Steps that affect service, such as taking a system offline, are agreed with your named contact first. The first-hour procedure lists the actions we may take without waiting.
How long are logs kept?
Retention is 30 days by default and can be extended to meet your obligations.
Can you help with incidents on systems you do not manage?
Yes, on request. Response is slower without existing log access.