Digital Forensics and Incident Response

Mobilization of a three-person team of experts within 4 hours of incident reporting.

Option to scale up the team to six members within 24 hours of the incident report.

Immediate remote response after mobilization or on-site response at the incident location, depending on the time required to mobilize the team and travel time from the SOC360 headquarters.

Collection, preservation, and analysis of system and application logs using tools such as the ELK Stack and other large-scale data processing tools to determine the attack vector, timeline, and impact.

Analysis of memory images and system or portable storage drives to identify digital traces of the incident.

Preservation and analysis of evidence using specialized devices and software:

• Write-blocker devices, disk cloning equipment

• Software for creating and analyzing disk and memory images

Reverse engineering of malicious code.

CTI (Cyber Threat Intelligence) and OSINT (Open Source Intelligence) investigation.

All actions are conducted while maintaining the chain of custody.

Portable storage (NAS devices, portable USB drives) for backups, disk imaging, and memory imaging, with a capacity of at least 20 TB.

Devices and software for creating and analyzing disk and memory images:

• Write-blocker devices

• Disk cloning devices

• Software for disk and memory cloning

• Software for disk and memory image analysis

• Software for log collection and analysis

Log analysis tools

Malware analysis tools

Preparation of materials and reports related to the incident

Testifying as a witness during investigations

Participation in meetings

Providing materials and reports related to the incident

Conducting negotiations to obtain additional information

Conducting negotiations to delay actions by cybercriminal groups

Conducting negotiations for ransom payment

Technical support for activities related to ransom payment

Technical advisory

Providing support in the role of Incident Manager

Leading and coordinating actions to contain the incident and mitigate its impact

Collaboration and advisory support for local IT and security teams

Coordination of activities involving external parties

Support in system recovery and restoration