Detection engineered for your environment — response prepared for your worst day.
Generic monitoring detects generic attacks. Real adversaries do not file generic playbooks. We engineer detection for your specific stack, business processes and threat model — then we are the team on the bridge call when something goes wrong.
An Onidef IR retainer combines three capabilities. First, detection engineering: we author and tune the rules, queries and analytics that fire in your SIEM, EDR and cloud audit logs. Second, 24/7 monitoring with a tier-2 analyst on every alert. Third, a senior IR lead available within a contractual SLA when an alert becomes an incident.
The same retainer covers proactive work: tabletop exercises, ransomware preparedness, threat hunting, and DFIR-grade investigation when needed. Unused hours bank quarterly — we will not bill you for an idle quarter and we will not refuse the call in a busy one.
When an incident is declared, a named senior responder is on a bridge inside the SLA, with playbooks already mapped to your environment. Your team is not explaining the architecture for the first time at 03:00.
From the first suspicious log entry to the post-mortem you read to your board.
We use a six-phase model adapted from NIST SP 800-61 and the work of FIRST.org. Every phase has a written runbook, a named owner, and an evidence trail.
-
01 · PREPAREPreparation & readinessRunbooks, communication trees, evidence-handling procedures, contractual escalation paths and pre-authorised response actions — set up before any incident occurs.
-
02 · DETECTDetection & triageTuned detections fire into our SOC; an analyst correlates with context within minutes. False positives die quietly; real signal escalates instantly.
-
03 · CONTAINContainmentWithin the SLA, a senior responder is on the bridge with you. We isolate affected systems, preserve evidence, and freeze the blast radius — without unnecessary disruption.
-
04 · ERADICATEEradication & forensicsRoot-cause analysis with court-admissible evidence handling. We find every foothold, every persistence mechanism, every staging artefact — and we document the chain of custody.
-
05 · RECOVERRecovery & restorationA sequenced restoration plan: which systems come back first, in what trust state, with what monitoring uplift. Coordinated with your engineering, business and legal teams.
-
06 · LEARNPost-incident & hardeningA written post-mortem — blameless, calibrated for the board, the regulator and the engineers. Followed by a hardening backlog scoped to prevent recurrence within the quarter.
What a retainer actually buys you — incident or no incident.
The retainer pays for capability you should never need to use most months. The output, in calm quarters, is preparedness; in loud quarters, response.
Tuned detection content
Authored rules, dashboards and analytic queries for your specific SIEM and EDR — versioned, tested, MITRE ATT&CK-mapped.
Runbook library
A library of incident playbooks (ransomware, BEC, credential theft, insider, cloud takeover, supply chain) tailored to your environment.
24/7 monitoring
Tier-2 analysts on every alert. Hand-off to a senior responder within the SLA on any confirmed incident.
DFIR investigations
Memory, disk, cloud and email forensics with evidentiary chain of custody — usable in litigation, regulatory and insurance contexts.
Tabletop exercises
Two facilitated exercises per year — one technical, one executive. Findings tracked in a remediation backlog with named owners.
Post-incident reporting
Written narrative for board, regulator and engineering — calibrated for each audience, drafted by the responder who led the work.
The questions every CISO and CTO asks before signing a retainer.
If yours is not here, write to us. We will answer it in writing within one business day.