Trafford

analysis of system logs – from network devices and network security systems to determine a detailed chain of events

preparation of incident response scenarios at the process and technical levels

development of sets of correlation rules and/or sets of IOC/IOA indicators (indicator of compromise/indicator of attack) for your security systems

creation of playbooks enabling automation of the incident handling process in SOAR systems

● Security incident analysis
● Post-breach analysis
● Digital evidence protection
● Malware analysis

● Analysis and exchange of information on threats
● Current data on threats and vulnerabilities.
● Identification of cybercriminals, the so-called Threat Landscape
● Development and implementation of playbooks in SOAR class systems
● Partial automation of the incident handling process

● Proactive threat hunting
● "Threat hunting" in the target environment
● Consideration of TTP, IOC/IOA indicators
● Analysis of events and network traffic based on

● Analysis of the environment and architecture
● Verification of security systems in terms of implementation of Incident Response processes.
● Reconfiguration and development of existing security tools and services

Analysis and verification of the SOC team's main security tools environment based on the MITRE ATT&CK SOC Assessments methodology, as well as technical verification using the Continuous Security Validation system.

Support in building/expanding teams responsible for monitoring.

Verification of documentation and procedures in line with international best practices and support in developing work standards.

Support in optimizing event/incident handling time.