Project and integration scope
Agree an assessment or integration project with defined outputs and handover.
- Telemetry and use-case inventory
- Tool/module and access scope
- Client handover and exclusions
Security operations
Detect, triage and contain with a clear operational response.
OVERVIEW
Turn security signals into informed action
Define how security signals are investigated, escalated and acted on across your teams and tools. Linkfields provides specialist security services and offers Managed Service engagements; the monitoring scope, operational ownership and service terms are agreed for each engagement.
We work with Splunk SIEM, Qualys and Rapid7 to support monitoring, vulnerability prioritisation and incident response. Product modules, telemetry and supported integrations are agreed during scoping. Client system owners retain approval for operational changes, legal decisions and recovery responsibilities unless explicitly agreed otherwise.
OPERATING MODEL
Agree who operates and who authorises
Define the operating model before onboarding tools. Agree coverage, responsibilities and service measures so each team understands its role and commitments.
Shared operational responsibilities
Record which actions sit with Linkfields, client teams and tool vendors.
- Analyst and escalation roles
- Client approval and containment authority
- Log access, retention and delivery locations
Managed Service terms
Where a Managed Service is agreed, define coverage and governance. Continuous coverage is not assumed.
- Hours, time zones and handover
- Reporting cadence and exclusions
- Defined service measures and improvement
WHAT WE DELIVER
Security operations deliverables
Select the deliverables and tools for your agreed scope, from security monitoring and investigation to incident triage, containment and ongoing service improvement.
Detection engineering & SIEM
Use Splunk SIEM where agreed to organise security events and investigation context.
- Log-source and use-case catalogue
- Detection-validation record
Vulnerability prioritisation
Use agreed Qualys monitoring or vulnerability findings to build an owned remediation workflow.
- Prioritised vulnerability queue
- Owners, exceptions and follow-up status
Investigation & containment
Scope the Rapid7 role and authorised response actions with system owners.
- Investigation and escalation playbooks
- Containment approvals and recovery handoff
Service governance & improvement
Review operational evidence, service measures and risk with accountable owners.
- Service/risk review report
- Detection and remediation improvement backlog
DELIVERY APPROACH
From onboarding to service review
Move from scope definition and validated onboarding to authorised incident response under approved playbooks, then use service reviews to improve detections, controls and follow-up.
01
Baseline the scope
Agree telemetry, responsibilities, access and operating boundaries.
- Telemetry/responsibility baseline
- Retention and processing-location decisions
02
Onboard and validate
Check log sources and test agreed detection use cases before operational handover.
- Tested detection/use-case pack
- Onboarding exceptions and acceptance
03
Triage and authorise response
Investigate context, preserve evidence and obtain the required containment approval.
- Escalation/containment playbooks
- Client decision and recovery handoff
04
Review and improve
Document the response and agree improvements to detections, controls and follow-up.
- Incident/service report
- Owned improvement backlog
SECURE BY DESIGN
Incident boundaries and evidence handling
Agree operational authority, evidence handling and legal responsibilities before monitoring begins. Use your organisation’s incident-response procedure for active incidents; the enquiry form is for service discussions.
Optional related products: exposure validation, code and supply-chain analysis, AI oversight
Authorised operational actions
Agree containment authority, approval paths and escalation before the service starts.
- No assumed change authority
- Client recovery and notification ownership
Specialist remediation routes
Preserve and transfer evidence
Agree evidence preservation, secure transfer, access permissions and retention.
- Logs and incident material handled securely
- Processing and access locations recorded
Legal and data responsibilities
Agree POPIA-related personal-data handling and cross-border log processing with your legal owners.
- Operator and client responsibilities
- Legal/notification decisions stay accountable
BUYER QUESTIONS
Scope the service, not an incident report
Discuss your operating model, tools and objectives, not an active incident. Do not send logs, personal information unrelated to your enquiry, credentials or incident evidence.
Let’s connect
Tell us about your security operations model
What happens next
- We route your enquiry to the relevant portfolio specialist.
- Where needed, we agree an NDA before you share confidential information.
- We clarify your priorities and agree the right next step with you.