Laserfiche WebLink
<br />Critical Insight® and the Critical Insight logo are the trademarks of Critical Insight, Inc. <br />©2023 Critical Insight, Inc. All rights reserved. <br />4 <br /> <br />• FOR DATA STREAMS THAT INCLUDE FUNCTIONALITY THAT <br />ENABLES CI TO TAKE ACTION IN THE CUSTOMER <br />ENVIRONMENT, CI WILL WORK WITH THE CUSTOMER TO <br />PERIODICALLY TEST ACTIONS TO ENSURE SERVICE QUALITY. <br />MANAGED <br />DETECTION AND <br />RESPONSE <br />(CI-MDR) <br /> <br />RESPONSE: <br />• INVESTIGATION TICKET CREATED AND ASSIGNED TO CI ANALYST <br />WITH A GOAL TO CONCLUDE THE INVESTIGATION WITHIN THE <br />SPECIFIED SLA (SEE SLA AGREEMENT) <br />• ANALYSTS INVESTIGATE AND ATTEMPT TO CONFIRM AN INCIDENT <br />HAS OCCURRED BY ANALYZING RELEVANT AND AVAILABLE DATA <br />• IN THE COLLECTOR ENVIRONMENT, “RELEVANT DATA” REFERS <br />TO THE PACKET CAPTURE, NETWORK FLOWS AND SYSTEM LOGS <br />FROM 30 SECONDS PRIOR TO UNTIL 30 SECONDS AFTER THE <br />SUSPECT ACTIVITY IN STANDARD INVESTIGATIONS. WHEN <br />WARRANTED, THE TIME PERIOD MAY EXPAND. <br />• FOR ALL OTHER ENVIRONMENTS, RELEVANT AND AVAILABLE <br />DATA REFERS TO ALL DATA THAT CI IS ABLE TO CAPTURE AND <br />EFFECTIVELY MONITOR FROM THE APPROVED DATA STREAMS. <br />• CONFIRMATION OCCURS WHEN EVIDENCE OF ATTACK OR <br />COMPROMISE IS VERIFIED BY A CI ANALYST <br /> <br />TIERED RESPONSE: <br />• FOR ALL CONFIRMED INCIDENTS, NOTIFY CUSTOMER WITHIN THE <br />SPECIFIED SLA (SEE SLA AGREEMENT) <br />• FOR URGENT OR HIGH SEVERITY INCIDENTS, A FINAL INCIDENT <br />ACTION PLAN WILL BE DELIVERED TO CUSTOMER AT THE TIME THAT <br />ALL RELATED TICKETS ARE CLOSED. THE REPORT WILL INCLUDE: <br />• SUMMARY OF INCIDENT <br />• SUMMARY OF ANY CONFIRMED ACTIONS TAKEN (BY CI AND/OR <br />CUSTOMER) <br />• FINAL STATUS AND/OR RESOLUTION <br /> <br />RAPID QUARANTINE: <br />• IF CUSTOMER HAS A DATA STREAM THAT INCLUDE ACTIONS SUCH AS <br />ISOLATING ENDPOINT,QUARANTINE ENDPOINT, OR BLOCK ACCOUNT <br />THE CUSTOMER CAN COMPLETE A RAPID QUARANTINE PLAYBOOK TO <br />AUTHORIZE CI TO TAKE ADDITIONAL REMEDIATION ACTIONS. <br />• CI WILL TAKE ACTIONS GOVERNED BY THE MUTUALLY AGREED RAPID <br />QUARANTINE PLAYBOOK WHEN ANY INVESTIGATION REACHES THE <br />THRESHOLDS DETERMINED IN THE PLAYBOOK. <br />• ONCE AN INVESTIGATION REACHES THE THRESHOLDS, CI WILL EXECUTE <br />ACTIONS DETAILED IN THE RAPID QUARANTINE PLAYBOOK WHICH MAY <br />INCLUDE BUT ARE NOT LIMITED TO: <br />• USE AN EDR PRODUCT TO QUARANTINE AN ENDPOINT <br />• USE MICROSOFT AZURE ACTIVE DIRECTORY TO BLOCK AN ACCOUNT <br />• REACH OUT TO CUSTOMER FOR APPROVAL TO QUARANTINE <br />• NOTIFY CUSTOMER OF INCIDENT <br />