Frequently Asked Questions

Can EASM harm our systems?

Discovery relies largely on passive sources, and active checks are limited to light, authorized scanning. Scan scope and timing are agreed with you in advance.

How often are results updated?

The external surface is monitored continuously, and new assets or critical changes are reported as they are detected. The frequency of summary reports is set according to your needs.

What is the difference between cyber threat intelligence and a threat feed?

A threat feed is usually a list of IPs, domains and hashes with limited context. Threat intelligence analyzes that data, relates it to your organization and turns it into prioritized information that explains who might attack, why and how.

What are STIX and TAXII?

STIX is a language and data model for describing threat intelligence in a structured, machine-readable way. TAXII is the protocol for sharing that data between organizations and systems over HTTPS; both are published by OASIS.

What do TLP labels mean?

The Traffic Light Protocol uses color codes to state which audience shared information may be passed on to. For example, TLP:RED limits information to the people it was given to directly, while TLP:CLEAR allows public disclosure.

How often are intelligence reports delivered?

Reporting frequency is set according to your needs; alongside regular periodic reports, you receive separate alerts on critical developments that could affect you directly.

What is the difference between SOC and MDR?

A SOC service monitors and analyzes threats and sends you prioritized notifications. MDR adds direct containment actions, such as isolating an endpoint, within scenarios you have approved in advance.

Do we need our own SIEM for these services?

No. If you already have a SIEM or EDR platform, we work with it; if not, we help you define a suitable, vendor-neutral architecture.

We suspect an attacker is inside. Where should we start?

The usual first step is a compromise assessment. It establishes, based on evidence, whether there are traces of an active or past breach in your environment and clarifies the next steps.

What is the difference between a compromise assessment and a penetration test?

A penetration test looks for vulnerabilities to find how an attacker could get in. A compromise assessment investigates whether an attacker is already inside and, if so, what traces they have left.

How long does a compromise assessment take?

Duration depends on the number of devices and data sources in scope. We confirm the timeline in the proposal after scoping.

Will the assessment slow down our systems?

Data collection tools are configured to run lightly, and timing on critical systems is planned with you. The goal is to gain visibility without affecting business continuity.

What is the value of the report if no breach is found?

A clean result provides a documented reference that no traces of compromise were found within the assessed scope. The report also includes recommendations on visibility gaps and vulnerabilities identified during the assessment.

Do we need an EDR product for MDR?

Yes, an EDR or XDR platform is required for MDR to take action at the endpoint. We can work with your existing product; if you don't have one, we help you evaluate suitable, vendor-neutral options.

Will the MDR team act on our systems without approval?

No. Which actions can be taken directly and which require approval is set out in a written response matrix before the service starts. We do not act outside that matrix.

Does MDR replace incident response services?

MDR is designed for fast detection and initial containment. In major incidents that require in-depth investigation and recovery, we share our findings and coordinate with the incident response team your organization designates.

Which organizations is MDR suitable for?

MDR suits organizations without their own 24/7 response team that still want threats stopped without waiting for business hours. Small and mid-sized IT teams often benefit the most.

Can OT SOC monitoring disrupt production?

Passive monitoring only listens to a copy of the traffic, so it sends no packets to control systems and does not affect production. Sensors are installed during maintenance windows planned with your site team.

Can the same team run both the IT and OT SOC?

Yes. Seeing IT and OT events together helps detect attacks that move from the corporate network into production. OT events, however, are assessed by analysts who understand industrial processes.

Which industries is OT SOC suitable for?

It suits any industry that controls physical processes with industrial control systems, including power generation and distribution, water and wastewater, manufacturing, chemicals, pharmaceuticals and food production.

What is a SIEM and what does it do?

A SIEM collects logs from servers, network devices, security products and applications in one place, correlates them and raises alerts on suspicious patterns. It also stores logs centrally for incident investigations and audits.

Our SIEM produces too many false positives. What can be done?

This is usually caused by rules not tuned to the environment, missing asset and user context or unnecessary log sources. We review, tune and prioritize existing rules to reduce non-actionable alerts.

What is the difference between SIEM management and a SOC service?

SIEM management keeps the platform and its detection content working correctly. A SOC service is the analyst team that monitors and investigates the alerts that platform produces, 24/7; the two can be purchased together or separately.

Which logs do we need to share for a SOC service?

We typically start with authentication (Active Directory, cloud identity services), firewall, EDR/XDR, email security and critical server logs. The final scope is agreed based on your risk profile and existing infrastructure.

Can you work with our existing SIEM?

Yes. We can deliver the service on your existing SIEM, and our Sigma-format rules can be converted into different SIEM query languages. If you don't have a SIEM, we help you choose a suitable, vendor-neutral architecture.

Does an outsourced SOC replace our own team?

Not necessarily. Many organizations choose a hybrid model, with their own team covering business hours and the outsourced SOC covering nights and weekends. The model is shaped around your needs.

How do you reduce false positives?

We tune rules to your environment's normal behavior, enrich alerts with asset and user context, and review them regularly. The goal is that only actionable notifications reach your team.

How is threat hunting different from SOC monitoring?

A SOC evaluates alerts generated by rules and products. Threat hunting looks where there are no alerts, using analyst hypotheses to find attacker traces, and feeds its findings back to the SOC as new rules.

How often should threat hunting be done?

It depends on your risk profile and current visibility. Some organizations run a continuous program, while others prefer periodic campaigns or focused hunts after a critical threat advisory.

What data is needed for threat hunting?

The best results come from EDR telemetry, authentication logs, DNS and proxy records and cloud audit logs. Where data is missing, the hunt report identifies the gaps and how to close them.