PROACTIVE INCIDENT RESPONSE (IR)

Obrela has advanced expertise gained from conducting a wide variety of incident response and data breach investigations ranging in size and complexity. With a Mean Time of less than 15 minutes, our SOC Analysts and global Threat Hunting teams rapidly respond to investigate, contain, and mitigate threats. Obrela is approved under the recognized UK national body CREST Cyber Security Incident Response (CSIR) scheme. The team also has experience working with regulatory and law enforcement authorities.

SERVICE CAPABILITIES

Obrela is approved under the recognized UK national body CREST Cyber Security Incident Response (CSIR) scheme.

Obrela’s Security Incident Response Team (SIRT) assists and guides the client in recovering from an incident via the Web Console, phone, email, or documentation. This can involve technical assistance in the interpretation of data collected, providing contact information, or relaying guidance on mitigation and recovery strategies. It does not involve direct, on-site incident response actions.

Obrela’s Security Incident Response Team (SIRT) responds to the Service Request via the Swordfish SRM application; the response time varies subject to the Service Request priority. Obrela’s CSIRT team assists and guides the client remotely in recovering from an incident until closure for assets in the monitoring scope.

Utilizing XDR technology capabilities of file-based malware, malicious scripts, memory-based attacks, and behavioral and network analytics, the IR team proceeds to the identification of suspicious activities and formulates plans of immediate threat containment.

Utilizing XDR technology capabilities of active threat containment, the IR team validates an active threat based on specific playbooks and proceeds to immediate remediation plans or further threat eradication recommendations to be performed by the customer.

Utilizing Digital Risk Protection platform capabilities, the IR team submits a domain takedown request to global network services and search engine providers. It requires a pre-established domain takedown authorization request to be signed by the customer.