Detection, SOC & response
Improves threat visibility, alert analysis, response orchestration and incident preparedness.
- RFC BRANCH
- Security & Resilience
Detect and coordinate response
Scattered alerts and insufficiently formalised escalations. Connect detection, triage and incident response.
Starting point
Scattered alerts and insufficiently formalised escalations.
Promise
Connect detection, triage and incident response.
Outcome
Tested scenarios and a coordinated response.
Agentic automation programme at scale
A HERO offer to select use cases, set up the architecture and governance, deploy the first agents and then organise the run model.
The necessary foundations
Services to connect detection, triage and incident response.
Cyber Incident Investigation & Remediation Pack
Post-incident response package: investigation, attack vector identification, executive report, remediation plan and initial hardening. Includes post-ransomware remediation: stabilisation after an attack, restoration, securing and hardening systems, incident report and prevention plan.
Incident Response Retainer
Availability agreement for cyber incident assistance, including scoping, escalation, investigation, coordination and lessons learned.
Microsoft 365 Defender
Configuration, deployment and optimisation of Microsoft Defender to protect endpoints, servers, messaging, identities and applications.
Accelerators suited to your maturity
Additional capabilities to draw on according to your priorities and maturity.
- See details...Detection, SOC & response
Microsoft Sentinel SIEM/SOAR (Security Information and Event Management / Sec…
Sentinel deployment or optimisation service for log collection, correla…
Talk to an RFC expert
Describe your priorities, constraints and projects to prepare a discussion with the relevant teams.
Technology ecosystem
Protection, detection and recovery technologies selected according to risks and the chosen scope.
Security and resilience
Prioritise protections and test their effectiveness.
(Step 01)
Assess the exposure
Identify the assets, usages and risk scenarios to address within the agreed scope.
Deliverable
Risk map and protection objectives.
Organisations supported in their transformation
Find the organisations associated with the engagements presented, along with their industries and individual contexts.
Projects to inform your choices
Explore related engagements to understand the contexts, scopes and challenges covered by RFC.
- Client Reference
2024 - Industry
From an Elastic-based SOC
Sotacib
Elastic Security complements Sentinel coverage.
Tracked Indicators
Connected sources • qualified alerts
Explore the domain's other capabilities
Find complementary offers and areas of expertise to extend your approach according to your organisation's needs.
SOC/XDR express onboarding
SOC/XDR express onboarding should be positioned in Tunisia as a response to the following problem: the customer lacks structured detection, triage and response procedures. The offer targets the following outcome: SOC/XDR onboarding, connected sources, detection use cases and runbooks. In this market, the main emphasis is pragmatism, controlled costs, local delivery and RFC’s local references; the packaging must therefore remain short, concrete and backed by local references.
Incident response & cyber recovery
Incident response & cyber recovery should be positioned in Tunisia as a response to the following problem: the customer lacks a clear capability to investigate, contain and restore after an incident. The offer targets the following outcome: an IR/recovery package, procedures, investigation capability and a remediation plan. In this market, the main emphasis is pragmatism, controlled costs, local delivery and RFC’s local references; the packaging must therefore remain short, concrete and backed by local references.
Splunk security & observability activation
Splunk security & observability activation should be positioned in Tunisia as a response to the following problem: observability/security data exists but is not used sufficiently to detect, understand and act. The offer targets the following outcome: a Splunk/SOC/observability foundation, use cases and an operating plan. In this market, the main emphasis is pragmatism, controlled costs, local delivery and RFC’s local references; the packaging must therefore remain short, concrete and backed by local references.
Talk to an RFC expert
Share your context, priorities and constraints. Our experts help you structure an IT journey aligned with your transformation goals.
Tell us about your challenges
Share your priorities to prepare for a focused discussion.