Days 1-7: Baselining
We learn your environment - normal login patterns, typical data volumes, expected admin activity. Detection rules are initially set conservatively to avoid overwhelming you with alerts while we establish baselines.
Days 8-21: Tuning
Rules are tuned based on what we learn. False positive noise is reduced. Additional log sources are onboarded if needed. You may receive a few check-in messages as we confirm expected behaviour.
Days 22-30: Steady state
By the end of the first month, your environment is in steady-state monitoring. You receive your first monthly security report at day 30, covering the baselining period with observations and any early recommendations.
Need more help? Contact Adam directly.
Use email for general support, or phone for active P1/P2 incidents.