What can this service help with?
Support log and threat intelligence analysis, incident timelines, and reviews of detection, response and cyber resilience plans.
Relevant inputs
- Logs and events authorized for analysis
- Documented indicators and threat reports
- Response and recovery plans with asset context
Suggested service outputs
- Indicator analysis and event timeline
- Threat brief and detection recommendations
- Response plan or tabletop exercise
Illustrative service request
Analyze these events and distinguish confirmed evidence from items requiring verification before containment.