AC3’s Detection and Response for Microsoft Sentinel Managed Service combines the power of Sentinel and AC3’s 24x7 Security Operations Centre to ensure that your environment is continuously monitored for threats, suspicious events are investigated, and any suspected intrusions are responded to rapidly. 

Located within a purpose-built facility within Sydney, AC3’s SOC is staffed by a team of certified cyber security experts that are solely focused on keeping your business safe and secure.

AC3’s Detection and Response for Microsoft Sentinel Managed Service includes: 

Proactive Management

• Preparation: To ensure your organisation is prepared to detect and manage security incidents, AC3’s Cyber Security Team will provide:
  • Integration with AC3’s Threat Intelligence Platform
    • Tuning of threat feeds & intelligence
  • Log Analysis & Verification
  • Log Source Collection Hygiene & Maintenance
  • Use Case Creation & Maintenance
• Detection & Analysis: We analyse symptoms and investigate if the situation is an incident.
  • 9x5 Business Days “Eyes on Glass” Security Event Monitoring & Analysis, with 24x7 after hours on-call support
    • Dynamic Analysis, Correlation and Normalisation of Events
      • Identification, Classification & Prioritisation
      • Notifications & Escalations
    • Validation and Adoption of SIEM tool updates to Rules, Dashboards & Alerts
    • Reactive Security Incident tracking until the start of Containment, Eradication & Recovery.
  • Containment, Eradication & Recovery: To gather intel to identify the extent of the compromise in order to mitigate the impact, contain and deploy countermeasures. AC3 will:
    • Create and update the AC3 Security Incident Playbooks to ensure we effectively and efficiently communicate with you about identified incidents.
  • Post-Incident Activities
    • Improving your security posture through lessons learnt to prevent re-occurrence.
    • Post Incident Review (PIR) & Corrective and Preventative Actions (CAPA) for
    • P1 Security Incidents – containing critical data and general recommendations.

Reactive Support

• Access for your IT department via ITSM portal, phone, and email tAC3’s Service Desk team to log, troubleshoot and resolve issues within the scope of the Service Inclusions.
• General advice and guidance on common SIEM issues and integrations.

Vendor Support

• Escalating incidents to Microsoft should there be any issues with SIEM functionality.

Reporting

• Three monthly delivered reports, covering:
  • Standard Monthly ITIL Service Management ticket reporting from the AC3 ITSM system including all tickets raised by type and status.
  • Standard Monthly Security Report documenting general SIEM activity, notable incidents, total assets monitored, and areas of improvement.
  • Compliance Reporting on supported standards as configured (e.g. PCI-DSS and ISO/IEC 27001)