Challenges
- Intrusion detection systems running on generic settings that do not fit the environment
- many false alarms
Scope
- Network traffic profiling and a baseline of permitted protocols
- review of IDS placement and effectiveness
- custom signature development
- analysis of egress traffic, choke points and exfiltration paths
- detection of command-and- control (C2) channels and persistence mechanisms
Deliverables
- Analysis report
- custom signatures
- redesign recommendations
Target clients
Organizations with a security operations centre (SOC)
Value
More accurate detection and fewer false alarms.
Success indicators (set with the client)
False alarm rate · detection coverage of priority attacker techniques
Starting the engagement
Scope, deliverables, requirements and success indicators are agreed before delivery. Include the service name and code in your enquiry.
Client requirements
The catalogue specifies no additional prerequisites for this service. Access, stakeholders and the agreed scope are confirmed before delivery.