Incident response
Digital forensics, retainer services, and containment tooling used during active breach response and crisis remediation.
Key Technical Considerations Before Procuring
Verify guaranteed emergency response SLAs (e.g. within 2 hours) and whether unused retainer hours can be repurposed for proactive readiness assessments.
Documented Solutions in this Category
Showing 11 published solutions with verified evidence
Mandiant Incident Response Services
Emergency incident response, digital forensics, crisis management, and compromised environment remediation.
Dragos Incident Response
Dragos Incident Response is a professional security engagement offered by Dragos. The service focuses on industrial cyber incident investigation and response. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. - Root-cause assessment: Helps identify the factors associated with the incident so remediation can address the underlying exposure. Use and operational context Dragos's incident response service addresses investigations involving industrial environments. Scope the engagement around operational assets and business continuity requirements, with agreed responsibilities for evidence collection, containment decisions and the coordination of security work with operational staff. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Dragos Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
eSentire Incident Response
eSentire Incident Response is a professional security engagement offered by eSentire. The service focuses on breach investigation and incident response. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. - Root-cause assessment: Helps identify the factors associated with the incident so remediation can address the underlying exposure. Use and operational context eSentire's response service addresses the investigation and handling of an incident under an agreed scope. Establish the affected environment, evidence access and decision authority, including the communications needed to coordinate responders with the business's recovery team. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? eSentire Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Mandiant Incident Response
Mandiant Incident Response is a professional security engagement offered by Google Cloud. The service focuses on incident investigation and recovery support. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. Use and operational context Mandiant Incident Response is relevant to organizations responding to a breach or improving incident readiness when the requirement centers on investigating and managing cybersecurity incidents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Mandiant Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
IBM X-Force Incident Response
IBM X-Force Incident Response is a professional security engagement offered by IBM. The service focuses on breach investigation and incident response. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. Use and operational context IBM X-Force Incident Response is relevant to organizations responding to a breach or improving incident readiness when the requirement centers on investigating and managing cybersecurity incidents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? IBM X-Force Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Kroll Incident Response
Kroll Incident Response is a professional security engagement offered by Kroll. The service focuses on cyber incident investigation and containment. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. - Root-cause assessment: Helps identify the factors associated with the incident so remediation can address the underlying exposure. Use and operational context Kroll's incident response entry addresses the investigation and handling of a cyber incident. Agree the business systems and evidence in scope, the decision-makers involved in containment and the communications needed to coordinate investigation with the recovery effort. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Kroll Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
LevelBlue Digital Forensics and Incident Response
LevelBlue Digital Forensics and Incident Response is a professional security engagement offered by LevelBlue. The service focuses on breach investigation and incident response. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. Use and operational context LevelBlue Digital Forensics and Incident Response is relevant to organizations responding to a breach or improving incident readiness when the requirement centers on investigating and managing cybersecurity incidents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? LevelBlue Digital Forensics and Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Incident Response
Incident Response is a professional security engagement offered by NCC Group. The service focuses on incident investigation and containment assistance. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. Use and operational context Incident Response is relevant to organizations responding to a breach or improving incident readiness when the requirement centers on investigating and managing cybersecurity incidents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Incident Response
Incident Response is a professional security engagement offered by Orange Cyberdefense. The service focuses on breach investigation and containment support. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. - Root-cause assessment: Helps identify the factors associated with the incident so remediation can address the underlying exposure. Use and operational context Incident Response is relevant to organizations responding to a breach or improving incident readiness when the requirement centers on investigating and managing cybersecurity incidents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Unit 42 Incident Response
Unit 42 Incident Response is a professional security engagement offered by Palo Alto Networks. The service focuses on breach investigation and incident containment. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. Use and operational context Unit 42 Incident Response is relevant to organizations responding to a breach or improving incident readiness when the requirement centers on investigating and managing cybersecurity incidents. Scope the evaluation around the functions listed above and the assets or workflows that need coverage. A useful trial should use representative business conditions so the team can assess the quality of the results and the effort needed to act on them. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Unit 42 Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.
Sophos Incident Response
Sophos Incident Response is a professional security engagement offered by Sophos. The service focuses on incident investigation and containment support. Capabilities - Incident investigation: Establishes what happened by examining relevant evidence and the scope of the incident. - Containment planning: Helps define steps intended to reduce an incident's immediate spread or effect. - Digital evidence analysis: Examines digital artifacts to support understanding the incident and its timeline. - Recovery assistance: Assists with the recovery tasks included in the engagement and agreed response plan. - Incident readiness services: Supports preparing for incidents before an emergency response engagement is required. - Root-cause assessment: Helps identify the factors associated with the incident so remediation can address the underlying exposure. Use and operational context Sophos's incident response service addresses investigation and response during a cyber incident. Agree the affected systems, access required by responders and the decision process for containment, with a clear operational handoff for recovery and longer-term remediation work. Deployment and evaluation Deployment: Professional service delivered within an agreed engagement scope. Before adoption, review engagement scope, evidence handling, response authority and the responsibilities of internal and external responders. Assign an owner for administration, document required permissions and identify how the product or service will fit the existing operating process. Buyer questions - What is the main purpose? Sophos Incident Response focuses on investigating and managing cybersecurity incidents. - What should a proof of concept establish? Test the listed capabilities against representative service deliverables, record useful results and unresolved gaps, and confirm who handles follow-up work. - What should be confirmed before purchase? Ask the vendor which edition or service scope includes the required features, which dependencies must be configured and what licensing or contract terms apply. Pricing has not been verified for this catalog.