One list, every plan.
These log sources, vendors and containment actions are supported the same way on all four plans. The plans differ in who is on-site and when, not in what we can watch.
What we take in.
One log source is one system sending us logs: a firewall cluster, a domain, a Microsoft 365 tenant, a server. Endpoints reporting through your EDR or our agent are counted separately.
Perimeter
- Firewalls and UTMs
- VPN and remote access gateways
- Web proxies and DNS filtering
Identity
- Active Directory domain controllers
- Microsoft Entra ID
- Google Workspace, Okta
- MFA and privileged access tools
Endpoints
- Your EDR, through its API
- Or our agent on Windows, macOS and Linux
Servers
- Windows Server event logs
- Linux auth, audit and syslog
- VMware vCenter and ESXi
Email and collaboration
- Microsoft 365 unified audit log
- Defender for Office 365, Google Workspace
- Email security gateways
Cloud
- AWS CloudTrail and GuardDuty
- Azure activity and Defender for Cloud
- Google Cloud audit logs
Applications and data
- Web servers and WAFs
- Databases (login and admin events)
- Business apps that write a security log
Network detection (add-on)
- Suricata IDS on a mirror port
- NetFlow for unusual traffic
Not covered
- OT, SCADA and building systems
- Mobile phones (beyond MDM logs)
- Network uptime monitoring (NOC)
- Full packet capture
Vendors we work with.
Anything that can send syslog, write to a file our agent can read, or expose an audit-log API can usually be taken in, even if its vendor isn't listed. We confirm every source during discovery.
| Vendor | Products | How we collect | Containment |
|---|---|---|---|
| Fortinet | FortiGate, FortiAnalyzer, FortiClient EMS | SyslogREST API | Block IP / domain |
| Palo Alto Networks | PA-Series firewalls, GlobalProtect | SyslogXML API | Block IP / domain |
| Cisco | ASA, Firepower, Meraki, Umbrella, Duo | SyslogAPI | Block IP / domain |
| Sophos | XGS firewalls, Sophos Central (Intercept X) | SyslogCentral API | Block · isolate endpoint |
| Check Point | Quantum gateways, Harmony Endpoint | Syslog (Log Exporter) | On request |
| Microsoft | Active Directory, Entra ID, Microsoft 365, Defender for Endpoint, Defender for Office 365 | Agent on DCsGraph APIDefender API | Isolate · disable user · revoke sessions · quarantine email |
| CrowdStrike | Falcon Insight | Event Streams API | Isolate endpoint |
| SentinelOne | Singularity Endpoint | API | Isolate endpoint |
| Trend Micro | Vision One, Apex One | APISyslog | Isolate endpoint |
| Kaspersky, ESET, Bitdefender | Endpoint management consoles | Syslog | On request |
| Workspace, Google Cloud | Reports APICloud Logging | Suspend user | |
| Okta | Workforce Identity | System Log API | Suspend user · clear sessions |
| Amazon Web Services | CloudTrail, GuardDuty, VPC Flow Logs | S3 / API | On request |
| Linux | Red Hat, Rocky, AlmaLinux, Ubuntu, Debian | AgentSyslog | Not available |
| VMware (Broadcom) | vCenter, ESXi | Syslog | Not available |
| Mimecast, Proofpoint | Email security gateways | API | On request |
Containment: "On request" means we build and test the integration during onboarding. "Not available" means we have no safe automated action for that product, so we call your team to act. Every action also has to be on your signed Containment Authorisation. Product names are trademarks of their owners; listing them doesn't imply a partnership.
Exactly what we look for.
Our standard rule pack, mapped to MITRE ATT&CK, is tuned to your environment during onboarding. We add rules from new threat advisories and review coverage each quarter.
| Source | Examples of what we detect | ATT&CK tactics | Typical alert delay |
|---|---|---|---|
| Identity (AD, Entra ID, Okta) | Password spraying, brute force, impossible travel, sign-in from a new country, MFA fatigue, new admin or privileged group change, dormant account reused | Credential AccessPrivilege Escalation | 1–5 min |
| Email and Microsoft 365 | Phishing clicked, suspicious inbox forwarding rule, OAuth app consent, mass download from SharePoint/OneDrive, mailbox accessed by a new IP | Initial AccessCollection | 5–30 min (vendor log delay) |
| Endpoints (EDR / agent) | Ransomware behaviour, credential dumping, malicious PowerShell, new persistence (services, scheduled tasks), EDR tampered or uninstalled | ExecutionPersistenceImpact | Under 1 min |
| Firewalls and VPN | Connections to known-bad IPs and domains, VPN login from unusual country, port scans that succeed, large outbound transfers | Command & ControlExfiltration | 1–5 min |
| Servers | Admin logins outside hours, new local admin, audit log cleared, web shell, SSH brute force, file integrity changes on key files | Lateral MovementDefense Evasion | 1–5 min |
| Cloud | Root/global-admin use, new access keys, security logging turned off, public storage bucket created | Defense EvasionPersistence | 5–15 min |
| All sources | A log source that goes silent: the first thing many attackers do is turn off logging | Defense Evasion | Flagged within 24 hrs; critical sources 1 hr |
Retention: 90 days searchable, 12 months archived. Longer retention is an add-on, priced per extra 12 months.
What we can stop, and who says so.
You choose which of these we may take, on which assets, and whether we need to call you first. The list is signed at onboarding and you can change it at any time.
| Action | Through | Typical trigger | Reversed by |
|---|---|---|---|
| Isolate an endpoint from the network | Your EDR | Ransomware behaviour, confirmed malware with persistence, attacker on the host | Us, on your instruction |
| Disable a user account | AD, Entra ID, Google, Okta | Confirmed compromised account, active misuse | Your IT team |
| Revoke sessions and force password reset | Entra ID, Google, Okta | Stolen session token, MFA fatigue accepted | Automatic on next login |
| Block an IP address or domain | Your firewall or DNS filter | Active command-and-control, ongoing attack source | Us, after review or 30 days |
| Quarantine an email from all mailboxes | Microsoft 365, Google Workspace | Phishing campaign reaching several users | Us, if it turns out legitimate |
| Remove a malicious inbox rule | Microsoft 365 | Forwarding rule created by an attacker | Not reversed |
Crown jewels need a call
Servers, executives' devices and anything you mark as critical are never contained without a person on your side saying yes on the phone.
Scoped API access
Our integration accounts have only the rights needed for the actions you approved. Nothing else.
Every action on record
Time, analyst, approval, and when it was lifted. Listed in the incident report and the monthly report.
What we can take in, and what we can't.
If a data source isn't on this list as included, our plans don't cover it. Add-ons are quoted separately.
| Telemetry | All plans | Notes |
|---|---|---|
| Syslog | Included | UDP/TCP 514 or TLS 6514; RFC 3164, 5424, CEF and LEEF. Sent to the forwarder on your network. |
| Windows Event Log | Included | Security, System, PowerShell, Sysmon (recommended), through our agent. |
| Linux auth, audit and journal | Included | Through our agent or syslog. |
| Cloud and SaaS audit-log APIs | Included | Microsoft Graph, Google Reports, Okta, AWS CloudTrail and similar. Read-only API credentials. |
| EDR telemetry and alerts | Included | Through your EDR vendor's API. The EDR licence stays with you. |
| Agent: file integrity, inventory, basic detection | Included | For endpoints and servers without an EDR. |
| Threat intelligence matching | Included | Open feeds and national CERT advisories, matched against your logs. |
| Log files from business apps | Limited | Up to 3 custom formats included; more on request. |
| Network IDS (Suricata) | Add-on | Needs a mirror/SPAN port at the site and a small appliance. |
| NetFlow, sFlow, IPFIX | Add-on | Unusual traffic volumes and destinations. |
| Vulnerability scan results | Add-on | Our scanner, or results from yours. |
| Full packet capture | Not supported | Storage cost and privacy risk out of proportion for this service. |
| TLS decryption / traffic content | Not supported | We look at logs and metadata, not the content of traffic. |
| Industrial protocols (Modbus, DNP3, BACnet) | Not supported | OT security needs specialist tooling. |
| Uptime and performance metrics | Not supported | That's the NOC service. |
One forwarder. Agents where there's no EDR.
You must host one log forwarder per site. If you already run an EDR, we use it and you don't need our agent on endpoints. Domain controllers always get our agent.
| What | Agent needed? | Who installs it | What it needs on your side |
|---|---|---|---|
| Log forwarder | Required, one per site | You host a VM and we install it, or we ship a small appliance | 4 vCPU, 8 GB RAM, 200 GB disk. Outbound TCP 443 to our hub. No inbound ports. |
| SIEM (if hosted with you) | Server, not agent | We install it on a VM you provide | 8 vCPU, 32 GB RAM, storage sized to your log volume (typically 1–2 TB). Or use our Malaysian-hosted tenant. |
| Firewalls, VPN, proxies | Agentless | Nothing to install | Syslog pointed at the forwarder; a scoped API key if you approve blocking |
| Microsoft 365, Entra ID, Google, Okta, cloud | Agentless | Your admin grants consent to our app | Read-only audit permissions, plus scoped write rights for approved containment |
| Domain controllers | Agent required | Your IT team with our installer, or us during onboarding | Open-source Wazuh agent, under 100 MB RAM, sends only to the forwarder. Advanced audit policy enabled. |
| Endpoints with an EDR | Agentless | Nothing to install | An API key for your EDR console with read and isolation rights |
| Endpoints and servers without an EDR | Agent recommended | Your IT team, through your software deployment tool | Wazuh agent. Sysmon recommended on Windows; we supply the config. |
Why domain controllers need the agent
Most serious attacks end up at the domain controllers. The agent gives us the detailed security events that syslog forwarding loses.
Your EDR stays yours
We don't replace your antivirus or EDR, and you keep its licence. We watch its alerts alongside everything else and act through it.
Removing it later
When the contract ends we give you the uninstall steps, revoke our app consents and API keys, and confirm in writing that our access is closed.
Also needed from you
- A 24x7 contact who can say yesSomeone we can reach at night to approve containment on critical systems.
- Notice of planned work and testsTell us about maintenance, penetration tests and red-team exercises, so we don't treat them as attacks.
- A list of your crown jewelsThe systems and people where a false move would hurt most. We treat them with extra care.
Send us your systems list and we'll confirm coverage.
We'll tell you which sources we can take in, what we can contain through your tools, and where your blind spots are.
[email protected]