Amesto Fortytwo Managed Detection and Response is a service that lets you focus on your core business. Our security experts makes sure you as a customer have a Microsoft Sentinel solution that is always up to date with the latest threat detection mechanisms and properly integrated with the other Microsoft security products, such as Microsoft 365 Defender. Should a threat be detected, our Incident Response Team will quickly investigate and perform countermeasures, in order to keep your environment safe.

All of Amesto Fortytwo's managed service are deployed using Continuous Integration / Continuous Deployment (CI/CD). This means that you will always be on the "latest version", and never be in the situation where an implementation or upgrade project is needed in order to get to the most recent release. What this also means, is that any new detection rules, workbooks, or other functionality added to the managed service, is automatically available to you.

Expertise

Amesto Fortytwo have security experts with extensive platform knowledge on Microsoft Sentinel, and more importantly on all the Microsoft cloud services logging to Microsoft Sentinel. This makes us able to properly identify what to look for in your logs, implement analytics rules, evaluate the criticality of the resulting incidents and properly respond to detections.

Amesto Fortytwo services

Apart from the Incident Response Team, the following services are provided by Amesto Fortytwo to properly manage, maintain and monitor your Microsoft Sentinel solution:

• Security Experts available for you to "play ball" with, when it comes to adding even more rules, connectors or other services (T&M)
• Continuous Deployment from Amesto Fortytwo, always running the latest version of our recommended Microsoft Sentinel configuration
• Large set of analytics rules that will create incidents, such as:
• User signing in from IP address related to ransomware attack
• Unusual usage pattern from service principal
• Changes have been made to conditional access policies
• Break glass account has been used to sign in
• One of the designated VIPs have denied a multi-factor authentication notification
• A large set of useful community made workbooks
• Configuration of recommended TAXII providers for threat information
• Connector and log monitoring
• Get notified if any anomaly is detected in log sources, such as a service that stops logging
• Guidance on adding the correct connectors

Because the service runs in your own Azure Subscription, in unlikely event that you should choose to cancel the service, the Microsoft Sentinel configuration will remain in your environment and Sentinel will continue to function.

If you have an existing Microsoft Sentinel workspace, already populated with logs, we can deploy to that workspace rather than establishing a new workspace.

Onboarding process

We have a structured milestone based onboarding process, completed over 5 weeks. Each week consists of a workshop and an extended Sentinel configuration.

Incident handling process

Incident Response Team can be provided by us, or you can have your own team that responds to incidents. Please see the different plans for available options.