Security Monitoring & Incident Response

What this covers

Detecting an intrusion early limits the damage. That requires centralized logs, sensible alerts, and someone watching. It also requires an incident response plan that has been rehearsed so that the first hour of an incident is not spent deciding who to call.

Typical activities

• Log collection and SIEM configuration for endpoints, identity, cloud, and network sources
• Detection rules tuned to reduce noise
• Endpoint detection and response deployment
• Incident response plan development with roles, escalation paths, and communications templates
• Tabletop exercises for IT staff and leadership
• Incident support and post-incident review

What you receive

A monitoring architecture and configured tooling, an incident response plan, exercise reports, and runbooks for common incident types such as ransomware and business email compromise.

Considerations for public agencies

Incidents at public agencies bring reporting obligations, public records considerations, and often media attention. The plan covers legal, communications, and cyber insurance notification alongside the technical response.

Conditions that indicate a gap

Several conditions point to this work being needed:

• Logs stay on the systems that produce them, and retention is whatever the product shipped with.
• No one can say who receives an alert outside business hours, or what that person is authorized to do about it.
• The first notice of a problem has come from a bank, a vendor, a resident, or a law enforcement contact rather than from internal tools.
• A cyber insurance application asks about endpoint detection, multifactor authentication, and log retention, and the answers are estimates.
• An incident response plan exists but has never been exercised, or it names staff who have left.
• An outside provider watches the environment, but the contract does not say whether it may isolate a machine without asking first.

Where several of these hold, visibility generally comes before detection content. An alert that cannot be investigated, because the underlying logs were never collected or have already aged out, produces work without producing answers.

Common failure modes

• A SIEM used as an archive nobody queries, with volume-based pricing pushing the noisiest and most useful sources, authentication and DNS, out of scope.
• Endpoint detection left in detect-only mode indefinitely because no one wants to own a blocked process.
• Alerts routed to a shared mailbox that no individual is accountable for.
• A response plan built from a vendor template, with generic roles and another organization's name still in it.
• Retention shorter than the period an intrusion can go unnoticed, so evidence has rolled off before the investigation starts.
• Containment authority left unsettled, so the first hour is spent finding someone willing to approve disconnecting a system.

Dependencies on systems and outside parties

The productivity and identity platform already in use determines which audit events exist at all, and higher licensing tiers often gate the records investigators want most. Confirm what is available, and turn on retention or export, before an incident rather than during one. Where a managed service provider runs the infrastructure, the boundary between monitoring and response has to be written down, and it is worth asking whether the provider investigating an incident also configured the system involved.

Outside parties matter as well. Many state and local entities participate in information sharing organizations such as the MS-ISAC and its elections counterpart, use services offered by CISA, and have a state chief information security officer or fusion center contact; available services and membership terms have changed, so verify what is current rather than what was true a few budget cycles ago. Cyber insurance carriers commonly require the use of approved breach counsel and forensics firms, and engaging your own before notifying the carrier can affect coverage.

What to specify in a solicitation

1. The log sources to be collected, the retention period, and a statement that the agency owns its log data and can export it in a documented format at termination.
2. Severity definitions with separate commitments for time to acknowledge and time to escalate, and explicit coverage hours, including holidays.
3. Containment authority: which actions the provider may take without asking, such as isolating an endpoint or disabling an account, which actions require agency approval, and who can approve outside business hours.
4. Named contacts on both sides, and a contact method that still works when email and the identity directory do not.
5. A deliverables schedule covering tuning reviews, exercises, and written post-incident reports within a stated timeframe.
6. Cooperation with the agency's insurer, with law enforcement, and with any reporting the agency owes under state or federal rules, at no additional charge.
7. Personnel screening where the CJIS Security Policy or similar rules apply, subcontractor disclosure, and where data will be stored.

Working with HQT on this

HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.

Frequently asked questions