ISO 27001 · A.8.16CERT-In · 6-Hour ReportingNIST CSF · DE.AE-1

Intrusion Detection & Response

24/7 Wazuh SIEM monitoring with human analyst triage — every confirmed incident escalated in under an hour and reported to CERT-In within the mandated 6-hour window.

Methodology

Four Phases of Managed Detection & Response

From log ingestion to CERT-In-compliant incident report — all managed by our team.

01

Log Ingestion & Normalisation

Collect and normalise logs from endpoints, firewalls, cloud platforms, and applications into Wazuh SIEM — a single pane of glass for your entire environment.

02

Baseline & Rule Tuning

Build a normal-behaviour baseline specific to your environment. Detection rules are tuned to reduce false-positive noise before go-live.

03

24/7 Monitoring & Triage

Our analysts monitor alerts around the clock. Every alert is triaged by a human — confirmed threats escalated to you immediately with context and recommended action.

04

Response & Reporting

Contain the threat, collect forensic evidence, and produce a CERT-In compliant incident report within the mandated 6-hour window. Post-incident review included.

Coverage

What We Monitor

Network Traffic

East-west and north-south flows, unusual port activity, beaconing, and lateral movement patterns.

Endpoint Activity

Process execution trees, file modifications, registry changes, and suspicious parent-child process relationships.

Authentication Events

Brute force, password spray, impossible travel logins, MFA bypass attempts, and privilege escalation chains.

Cloud Logs

AWS CloudTrail, Azure Monitor, and GCP Audit Logs for suspicious API calls, IAM changes, and data access events.

Application Logs

Web server access logs, application error spikes, injection attempt patterns, and unusual API consumption.

Email & Phishing

Inbound email threat patterns, suspicious link clicks, spoofed sender detection, and impersonation attempts.

Control Mapping

Which Controls Does IDR Satisfy?

Every alert and incident report is tagged to the specific compliance control it evidences.

ISO 27001
  • A.8.15

    Logging — activity logs produced, protected, and reviewed

  • A.8.16

    Monitoring activities — networks and systems monitored

  • A.5.26

    Response to information security incidents

CERT-In (2022 Directions)
  • Clause 6(1)(a)

    Mandatory incident reporting within 6 hours

  • Clause 4(v)

    Log retention — minimum 180 days on Indian jurisdiction

  • Clause 4(vi)

    Maintain point-of-contact for CERT-In communications

NIST CSF 2.0
  • DE.AE-1

    Baseline of network operations established

  • RS.MA-1

    Incident response plan executed and communicated

  • RS.RP-1

    Response plan activated in response to declared incidents

What You Get

Deliverables

  • Real-time alerts with < 1hr critical incident SLA acknowledgement
  • CERT-In compliant incident report delivered within 6 hours of confirmed breach
  • Monthly SOC summary — threat counts, alert volumes, and response metrics
  • Forensic evidence package for regulatory and legal submissions
  • Incident response runbooks customised to your environment and escalation paths
  • 180-day log retention on Indian-jurisdiction infrastructure

CERT-In Ready

6-hour reporting capability built into the service

CERT-In's 2022 Directions require Indian organisations to report cyber incidents within 6 hours of detection. Our IDR service is designed around this window — detection, triage, containment, and report preparation happen in parallel, not sequence.

ISO 27001 A.8.16 requires systematic monitoring of networks, systems, and applications for anomalous behaviour. Our Wazuh SIEM deployment — with tuned rules and 24/7 analyst coverage — provides documented evidence of this control in operation.

Book a Scoping Call

Frequently Asked Questions

A SIEM is a tool — it collects and correlates logs. IDR is a managed service: we deploy Wazuh SIEM, tune the rules, staff the monitoring, triage every alert, and respond to confirmed incidents. You get the outcome, not just the platform.

CERT-In's 2022 Directions require Indian organisations to report cyber incidents to CERT-In within 6 hours of detection. We provide a pre-formatted incident report template and assist your team in filing the report — so compliance doesn't slow your response.

For full visibility, yes — Wazuh agents on endpoints give us the richest telemetry. However, we can also ingest existing logs from firewalls, cloud platforms, and applications without agent deployment, giving partial coverage from day one while agents are rolled out.

You receive an immediate alert with the threat summary, affected assets, and recommended containment actions. Our analyst stays on the call or ticket to guide your team through containment. We then produce a forensic timeline and CERT-In incident report.

Yes. Wazuh is open-source and can be deployed entirely on Indian infrastructure, satisfying CERT-In data-localisation guidance. The log retention policies are configurable to meet the 180-day minimum required by CERT-In.

Detect Threats Before They Become Incidents.

24/7 Wazuh SIEM monitoring with human triage — and CERT-In incident reports ready within the 6-hour mandate.

Start 24/7 Monitoring