Threat monitoring
Review log sources and available signals for the selected systems. Define relevant alert scenarios and how they are checked.
Threat monitoring and incident response preparation
Define how your team identifies suspicious activity, decides what it means, and coordinates a response. ACW helps prepare the monitoring and response workflows included in your engagement, with clear boundaries for access and action.
Contact UsResolve the gaps that delay a response
Missing signals
Relevant activity is not logged or never reaches the person who can investigate it.
Unclear decisions
An alert arrives without an owner, severity criteria, or an escalation route.
Uncoordinated containment
Teams do not know who may disable access or isolate an affected component.
Untested recovery
Dependencies and restoration checks are unclear when a service needs to return to operation.
Connect detection, response, and recovery
What the engagement produces
A map of relevant systems, log sources, and coverage gaps.
Configured monitoring or alerts where included.
Triage, escalation, and response procedures for selected scenarios.
Recovery responsibilities and verification steps.
Findings from the agreed walkthrough or exercise.
Prepare the workflow with its operators
- Step 01.
Assess readiness
Review current logs, tools, contacts, procedures, and operational dependencies.
- Step 02.
Define authority
Agree who reviews alerts, who can authorise containment, and which actions require system-owner involvement. Establish evidence handling and retention.
- Step 03.
Implement and exercise
Configure the selected components and walk through representative scenarios with the responsible people.
- Step 04.
Close the gaps
Record missing access, untested assumptions, and procedure changes. Set owners and review triggers for the response plan.
Evaluate the response process
Check whether the relevant signal is available, reaches the assigned reviewer, and leads to the intended decision. Document exercise timing and gaps without presenting it as a guaranteed response time for future incidents. Recovery checks should confirm that the affected service meets its agreed operating requirements.
This is an example of a possible engagement, not an ACW client result.
Illustrative exercise: a suspicious account event
The team walks through a suspicious login scenario: where evidence appears, who reviews it, who can restrict access, and how the system owner confirms restoration. The exercise records unanswered questions and required improvements.
Questions before starting
Does this include 24/7 monitoring?
Coverage, response hours, responsibilities, and service levels require an explicit agreement. Monitoring setup alone does not provide continuous operational coverage.
Can you respond to an active incident?
Confirm availability, authority, and the required response scope directly. This page does not establish an emergency response commitment.
Do we need to replace our tools?
Review existing sources and response workflows first. New tooling is justified only where it addresses a defined gap the team can operate.
Review how your team would handle an incident
Share the systems involved, current alert sources, and the response decisions that remain unclear.