Security 
 Monitoring 

How it works

Take a deep dive into our MDR service.

Defendable SOC

The heart of Defendable’s MDR service is the Security Operations Centre (SOC), where security analysts monitor and respond to threats 24/7, 365 days a year.

Depending on the severity of an incident, a dedicated Incident Response analyst or an entire Incident Response Team, may be mobilized to assist customers in the investigation, containment, eradication and recovery from a serious incident.

Defendable has SOCs in Oslo and Gjøvik for geo-redundancy

• CTI

  Together with vulnerability assessment, CTI is the key to achieving effective cyber defence.
  
  Defendable monitors various open and proprietary threat intelligence feeds and utilizes these to find suspicious events and incidents on customer networks.
  
  Defendable also extracts CTI from the dark web where leaked or stolen information is shared and traded. Dark web surveillance can give early warning of planning of attacks on a particular organisation or supply chains.
  

• SIEM & SOAR

  Defendable converts threat intelligence and vulnerability analysis into collections of Microsoft Sentinel Security Information and Event Management (SIEM) workbooks and Security Orchestration and Automated Response (SOAR) playbooks. 
  
  Workbooks provide our customers with a high-level overview of security events and trends in the organisation, whilst playbooks trigger automated response or enrichment processes when alerts or incidents are detected.

• Vulnerability analysis

  Defendable combines the functionality in Microsoft Defender and conducts regular vulnerability scanning to discover vulnerabilities in exposed services for our customers. 
  
  This activity is important to identify and close security holes before they can be exploited by threat actors.
  
  Scanning is performed with market leading tools which are continuously updated with the latest vulnerability signatures. 

• Threat hunting

  In parallel with SIEM and SOAR operations, Defendable performs proactive threat hunting in customer environments.  
  
  Defendable analysts will actively look for signs of malicious activity where static detection mechanisms have not yet been developed, and have been missed by tools such as Microsoft Defender.