Critical Insight, Inc. 5/2/2023 - Laserfiche WebLink

Critical Insight® and the Critical Insight logo are the trademarks of Critical Insight, Inc. ©2023 Critical Insight, Inc. All rights reserved. 3 SOME DATA STREAMS, SUCH AS SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) STREAMS OR EXTENDED DETECTION & RESPONSE (XDR) PRODUCTS WILL AGGREGATE DATA ACROSS MULTIPLE ENVIRONMENTS. CI WILL INCLUDE THE XDR OR SIEM PRODUCT AS AN ADDITIONAL DATA STREAM SO LONG AS IT IS AGGREGATING DATA STREAMS THAT ARE ALREADY DOCUMENTED IN THE DATA INGEST LIST. SOME DATA STREAMS INCLUDE FUNCTIONALITY THAT ENABLES CI TO PERFORM ACTIONS IN THE CUSTOMER ENVIRONMENT. IN CASES WHERE A DATA STREAM PROVIDES THIS FUNCTIONALITY, CI AND THE CUSTOMER WILL AGREE THE SCOPE AND ACTIONS THAT WILL BE TAKEN IN A SEPARATE DOCUMENT, I.E. RAPID QUARANTINE PLAYBOOK. CI WILL TAKE NO ACTION UNTIL THIS AGREEMENT IS DOCUMENTED IN WRITING. MANAGED DETECTION AND RESPONSE (CI-MDR) ACTIVATION: AN ENVIRONMENT WILL BE CONSIDERED ACTIVATED FOR MONITORING WHEN ALL SPECIFIED DATA STREAMS FOR AN ENVIRONMENT ARE ACTIVATED. FOR EACH DATA STREAM, CI WILL: • VERIFY CUSTOMER’S DATA STREAM IS CONFIGURED PER PROVISIONING INSTRUCTIONS • WORK WITH CUSTOMER TO GENERATE TEST ALERTS WHERE POSSIBLE • VERIFY TRANSMISSION OF ANY CUSTOMER DATA INTO CI’S CORPORATE ANALYSIS SYSTEMS, SOC DASHBOARDS AND TICKETING CI MONITORS DELIVERY OF DATA STREAMS ON AN AUTOMATED BASIS AS AVAILABLE AND WILL ALSO PERFORM PERIODIC MANUAL REVIEWS. FOR DATA STREAMS THAT INCLUDE FUNCTIONALITY THAT ENABLES CI TO PERFORM ACTIONS IN THE CUSTOMER ENVIRONMENT, THE ACTIONS WILL BE ACTIVATED ONCE THE CUSTOMER AND CI AGREE IN WRITING AND THE ACTIONS ARE TESTED WITH THE CUSTOMER TO ENSURE OPERATIONAL READINESS. MANAGED DETECTION AND RESPONSE (CI-MDR) MONITORING: UPON THE SUCCESSFUL ACTIVATION OF SPECIFIED ENVIRONMENTS, CI WILL INGEST ANY APPROVED DATA STREAMS AND WILL ELEVATE ALERTS FROM THOSE STREAMS FOR REVIEW, AS APPROPRIATE. CI ANALYSTS REVIEW APPROVED DATA STREAMS FOR INDICATORS OF COMPROMISE WHICH INCLUDE BUT ARE NOT LIMITED TO: • ALERTS LINKED TO POOR REPUTATION IPS OR DOMAINS • COMMAND AND CONTROL CONNECTIONS • ANOMALOUS OR SUSPICIOUS ALERT PATTERNS • SUDDEN SHIFTS IN THE VOLUME OF KEY ACTIVITIES • EVENT CORRELATION WITH REGIONAL, SECTOR, OR GLOBAL CAMPAIGNS • SELECTED EVENTS FROM 3RD PARTY SERVICES (SUCH AS 3RD PARTY EDR PRODUCTS, MICROSOFT PRODUCTS, AWS’S GUARDDUTY, ETC.)