// What it covers
The scope of the work.
01Hypothesis-driven hunts
02Historical log analysis
03Anomaly detection
04Indicator sweeps
05Lateral-movement traces
06Persistence checks
07Findings triage
08New detections
// What we need from you
The basics below — everything else is worked out together in the free scoping call.
▸Access to telemetry and logs
▸The environment to hunt across
▸Any concerns or past incidents
▸A contact for findings
// What you receive
What we found, what we ruled out, and new detections to catch it next time.
Plus documentation, so your team can run and extend it without us.
// How it runs
STEP 01HypothesiseDecide what to look for, based on your risks.
STEP 02HuntSearch your telemetry, past and present.
STEP 03TriageSeparate real threats from the noise.
STEP 04DetectTurn findings into lasting detections.
// More blue team services