The live SOC Demo will take place at the SOC (Security Operations Center) in Zwolle, the Netherlands.

Security Monitoring focuses primarily on collecting and signaling security alerts. Managed Detection & Response (MDR) goes a step further: in addition to 24/7 monitoring, suspicious activities are actively investigated, analyzed and, where necessary, followed up immediately by security experts. This not only detects what is happening, but also reacts before it develops into an incident.

A SIEM (Security Information and Event Management) is a platform that centrally collects, analyzes and correlates log data from various IT systems. This allows for faster recognition of anomalies and threats. MDR services use a SIEM to detect and prioritize complex attacks. Learn more here: SIEM and SOC | Managed Detection and Response (MDR) | nfir – cyber security specialist

A Security Operations Center (SOC) is a 24/7 staffed control room where security specialists continuously monitor the IT landscape. They analyze reports, investigate suspicious activity and take immediate action in the event of a threat. The SOC is the heart of an MDR service. Learn more here: SIEM and SOC | Managed Detection and Response (MDR) | nfir – cyber security specialist

MDR protects your IT network by continuously monitoring log data of users, endpoints and applications, detecting anomalous behavior early and responding to it immediately. Thus, attacks such as ransomware, phishing and privilege escalation are more often stopped even before they cause damage.

Yes, NFIR can also integrate OT log sources into the MDR service. By linking these systems to the Security Operations Center, industrial environments and critical processes are monitored as thoroughly as IT networks.

AI and machine-learning analyze large amounts of data and identify patterns that indicate threats. UEBA detects anomalous behavior of users and systems, while SOAR automates processes and enables immediate response. These technologies increase detection speed and reduce the likelihood of human error.

Cyber attacks don’t stop outside business hours. Through 24/7 monitoring, suspicious activity can be detected and stopped at any time. This limits damage and makes organizations more compliant with laws and regulations such as NIS2 and ISO27001.

Extended Response automates advanced responses to threats, such as isolating an infected endpoint or blocking a suspicious user. This speeds up the response and minimizes the impact of an attack, without manual intervention.

The seven log sources (including Microsoft 365, Firewall and Active Directory) were chosen because they cover the majority of attack patterns and access paths. Combining these sources provides a good picture of user behavior, network traffic and authentication, which significantly increases the chances of early detection.

During the quarterly consultation, your Service Manager and Security Engineer discuss trends, incidents, areas for improvement and new threats. You will receive concrete recommendations to further strengthen your security and insight into the performance of the MDR service.

The reports include an overview of all detected incidents, user behavior trends, status of log sources, key risks and recommendations. This allows you to maintain constant insight into your security level and take targeted action.

Yes, MDR-Essentials can be expanded with custom Use Cases tailored to your organization, industry or specific risks. This way, detection is optimally aligned with your business processes.

In the event of a security incident, our Computer Emergency Response Team (CERT) is on site within three hours. They immediately take control of the incident, limit damage, conduct forensic investigations and advise on next steps.

Yes, all SOC triages and analyses are included in the fixed monthly fee. So you don’t pay any additional fees for investigating suspicious events.

Yes, by default NFIR retains all log data for 12 months at no additional charge. This period meets legal requirements and supports forensic investigations.

A 12-month retention period enables in-depth forensic investigations and is essential for NIS2, BIO2 and AVG compliance. This allows you to reconstruct incidents retrospectively, report to regulators and respond to long-standing threats in a timely manner.