Nova Defense
An alert is followed by an action.
Detection reports. The response has to happen after that, faster than anyone can read a ticket.
Typical starting points
- „The alert was in the system. Nobody saw it until Monday.“
- „By the time someone reacted, the machine had been on the network for three hours.“
What we do
For the alerts that actually occur in your environment, we put an action behind them: cut the session, lock the account, isolate the system, run anything suspicious in a sandbox instead of on the workstation. SOAR is the umbrella term for this. What runs automatically and what needs approval is your decision per case, and every action taken is in the log.
How we start
- Week 1
Intake
Which alerts come up in your environment, which of them are real, and what follows them today.
- Weeks 2 to 4
Define procedures
Per alert type: which action, automatic or with approval, and who sees it.
- afterward
Go live
First in observation mode, then executing, procedure by procedure.
For your IT
Isolation of endpoints, locking accounts and sessions, sandboxing and jailing of suspicious processes, perimeter blocklists, alert enrichment.
With the detection already in your environment, and with your ticketing and notification channels. Every action is logged and can be reversed.
Part of Nova Defense. Detection itself belongs to security monitoring in Nova Run. Related: emergency and recovery planning.
What happens at your company after an alert?
30 minutes. We look at which alerts come up and what follows them today.