DFIR – Cybersecurity Incident Response

Scope of Service

• Readiness and Mobilization: Maintaining constant readiness and rapid mobilization of the incident response team. Available 24/7.

• Flexible Deployment: Conducting incident response operations both remotely and on-site at the location of the incident.

• Direct Countermeasures: Executing immediate actions to disrupt attacks, mitigate impact, and secure the environment against further malicious activities:

• Provisioning, deployment, configuration, and monitoring of top-tier EDR (Endpoint Detection and Response) and NDR (Network Detection and Response) tools.

• Identification of attack vectors, as well as the techniques and tactics (TTPs) used by malicious actors.

• CTI (Cyber Threat Intelligence) and OSINT analysis.

• Proactive Threat Hunting.

• Environmental analysis and specialized security recommendations.

• Evidence Handling: Preservation and analysis of digital evidence using specialized forensic equipment and software.

• Resource Provisioning: Supplying all tools necessary to carry out response operations.

• Reporting: Full documentation of response activities and preparation of a comprehensive Post-Incident Report.

• Law Enforcement Support:

• Preparation of materials and technical reports regarding the incident.

• Providing expert witness testimony during investigations.

• CERT Collaboration: Participation in meetings and providing necessary materials and reports to Computer Emergency Response Teams.

• Ransomware Advisory and Support:

• Establishing and maintaining communication with ransomware groups.

• Conducting negotiations to obtain additional information or delay criminal actions.

• Negotiation support regarding ransom payments and technical assistance during the settlement process.

• Incident Coordination:

• Technical advisory and overall coordination of containment and mitigation efforts.

• Cooperation with local IT and security teams.

• Coordination of involved third-party entities.

• Support in disaster recovery and system restoration.

Service Parameters

• Readiness Standards:
• Mobilization of a three-person expert team within 4 hours of incident notification.
• Ability to scale the team up to 6 experts within 24 hours.
• Immediate remote response following mobilization; on-site response time includes team mobilization and travel time from the SOC360 headquarters.

Pricing Models

• Retainer Fee: Fixed cost for maintaining readiness and process continuity.
• Usage-Based: Number of working days in the billing period dedicated to direct incident response activities.

Team Competencies

SOC360 detects, analyzes, and responds to cybersecurity incidents daily across dozens of organizations worldwide. We monitor hundreds of thousands of endpoints, user activities, LAN networks, and cloud services. Our team possesses the high-level expertise, processes, and tools required to provide comprehensive incident response support.

Our experts hold the following core competencies:

• Practical Experience: Extensive hands-on experience supporting organizations affected by cyberattacks, including large-scale ransomware incidents.
• Negotiation Skills: Direct experience in communicating with cybercriminal groups.
• Tactical Expertise: Tactical and operational proficiency in detection, analysis, and response.

Our team’s qualifications are backed by industry-leading certifications:

• Digital Forensics Examiner (DFE)
• Professional Network Penetration Tester (PNPT)
• Certified Red Team Professional (CRTP)
• Certified Azure Red Team Professional (CARTP)
• And many others.

We maintain high-level competencies in Microsoft environments, supported by official partnerships and numerous technical certifications. In every operation, we utilize professional commercial tools and adhere to DFIR best practices.