Laserfiche WebLink
<br /> 4 <br />CI monitors delivery of data streams on an automated basis as <br />available, and will also perform periodic manual reviews <br /> <br />Managed <br />Detection and <br />Response <br />(CI-MDR) <br /> <br />Monitoring: <br /> <br />Upon successful activation of specified platforms, CI will ingest any <br />approved data streams, specified in the ‘Platform’ section, and will <br />elevate alerts from those streams for review, as appropriate. CI <br />analysts review approved data streams for indicators of compromise <br />which include but are not limited to: <br /> <br />• Alerts linked to Poor Reputation IPs or Domains <br />• Command and Control connections <br />• Anomalous or suspicious alert patterns <br />• Sudden shifts in the volume of key activities <br />• Event correlation with regional, sector, or global campaigns <br /> <br />Managed <br />Detection and <br />Response <br />(CI-MDR) <br /> <br /> <br />Response: <br />• Investigation ticket created and assigned to Critical Insight <br />Analyst with a goal to conclude the investigation within the <br />specified SLA (see SLA agreement) <br />• Analysts investigate and attempt to confirm an incident has <br />occurred by analyzing relevant and available data <br />• For on-premises customers, “relevant data” refers to the <br />packet capture, network flows and system logs from 30 <br />seconds prior to until 30 seconds after the suspect activity in <br />standard investigations. When warranted, the time period <br />may expand. <br />• For AWS, Azure, Microsoft Defender, or MCAS customers, <br />“relevant data” refers to any data that the customer sends <br />CI from Customer’s native AWS, Azure, Defender, or MCAS <br />systems <br />• Confirmation occurs when evidence of attack or compromise <br />is verified by a CI Analyst <br /> <br />Tiered Response: <br /> <br />• For all confirmed incidents, notify customer within 30 minutes of <br />incident verification <br />• For urgent or high severity incidents, a final Incident Action Plan <br />will be delivered to Customer at the time that all related tickets <br />are closed. The report will include: