Managed security
Nothing fired.
So we went hunting.
Active threat hunting through your endpoint data for the intruder no alert caught, and a fast response the moment we find one. The SOC watches what fires. MDR goes looking, with your written permission to act.
- Hunts with a written questionWhat hunting and response coverWatching
- Permission to act, in writingWhat hunting and response coverWatching
- Isolation in softwareWhat hunting and response coverWatching
- Built on endpoint dataWhat hunting and response coverWatching
- Hands as well as findingsWhat hunting and response coverWatching
- A hunt log anyone can followWhat hunting and response coverWatching
Foothills Digital—Sentrello Premier Partner
- AWS
- Azure
- Google Cloud
- DigitalOcean
- On-premises Linux
- On-premises Windows
Every one of our people holds active certifications on the platforms they work on.
Sentrello is our only partnership. On the clouds, it's our people who hold the certifications. We don't claim a partner tier, and we'll keep saying so until that changes.
Where this usually starts
Quiet attackers don’t trip alarms
Tools that look for known-bad do that job fine. The intruder worth worrying about is the one careful enough to look like an ordinary Tuesday.
- Every alert last quarter closed green. Either you’re clean, or nobody looked for anything else.
- The stolen account logged in at 9:14, from the office, and did exactly what its owner does all day.
- In the end, somebody did find the intruder. It was the ransom note.
- Pulling a laptop off the network needs a director’s OK, and the director is somewhere over Kansas.
- Your endpoint tool records everything. Nobody has ever run a query against it.
What we do instead
Hunt on a hunch, contain without the phone tree
A hunt starts with a question, not an alert. Say someone had a foothold on the finance team’s laptops: what would the process trees look like? We go and check, across the endpoint data you’re already collecting. And when a hunt turns something up, the argument about whether to isolate the machine has already happened, in a document you signed. So it’s off the network while the engineer is still typing up why.
How it works
How a hunt runs
Step one happens before we hunt anything at all, and it’s the one that saves you hours later.
Agree what we can do without asking
A written containment policy comes first. Which signals justify isolating a machine, disabling an account or killing a process, and which need a call. Thresholds, not gut feel. You sign it, we act on it, and every action we take is logged against the line that allowed it.
Start with a hypothesis
Each hunt is one question about your business, drawn from what attackers are doing to companies like yours this month and where your defenses are thinnest. Stolen credentials on the sales laptops, say. Or a scheduled task quietly persisting on the server nobody patches.
Query every endpoint at once
Process trees, parent and child chains, network connections, registry writes, scripts that ran out of a temp folder. Your EDR agents already hold all of it. We search the whole fleet in one go instead of opening one laptop at a time.
Contain inside the policy
A finding over the threshold is isolated in software, straight away, under the rule you agreed. Anything under it reaches an engineer with the process tree attached and a recommendation. Nobody waits for a director to land.
Turn the hunt into a detection
Whatever we found by hand becomes a rule that fires on its own next time, filed with the hunt that found it. The hunt list grows. The manual work shrinks.
What hunting and response cover
Hunts with a written question
Each hunt records its hypothesis, its method and its result, whether or not it found anything. A clean hunt is evidence too, and it goes on file with the rest.
Permission to act, in writing
The points at which we isolate a machine, disable an account or kill a process without phoning first. Agreed up front, reviewed after every incident, and only ever changed in a commit you can read.
Isolation in software
Cross the line and the machine is cut from the network as fast as its agent can receive the command. The user keeps their screen. The attacker loses the route.
Built on endpoint data
MDR hunts through what your EDR records. If you run ours, it’s already there. If you run someone else’s, we hunt on what it keeps and tell you honestly where it’s thin.
Hands as well as findings
Containment, cleanup, rebuilding the machine, resetting the account. We do the part after the discovery instead of emailing you a PDF about it.
A hunt log anyone can follow
Which question, which query, which machines, what turned up and what we did. When an auditor asks whether anyone actually goes looking, you can say yes and show them.
Related
Security Operations Center (SOC) as a Service
Round-the-clock monitoring of your network alerts, 365 days a year, with triage and escalation built in. Automation reads each alert the second it lands, so the watch never depends on who happens to be awake.
Endpoint Detection & Response (EDR)
Continuous monitoring of every laptop, desktop and server for behavior that looks like an attack, whether anyone’s seen that particular malware before or not. It’s the sensor the rest of your security runs on.
Incident Response & Digital Forensics
Immediate containment, breach investigation and evidence gathering while the attack is still underway. Set it up as a retainer and your first call is a call, not a contract negotiation, and the cleanup won’t destroy the proof you’ll need later.
What does your endpoint tool already keep?
Which EDR you run, how far back it holds data, and who’s allowed to isolate a machine today.
Give us those and we’ll sketch your first few hunts, draft what a containment policy needs to say, and show you where today’s sign-off chain would cost you hours.
- What we arePlan, create, launch, maintain
- What we areSentrello Premier Partner
- What we areEvery quote written for you