Security operations and threat response
Security monitoring, human led investigation and clear escalation. 24/7 security monitoring available with applicable managed cybersecurity services. CTEKS combines endpoint, identity and email security with monitoring to help catch suspicious activity before it becomes a major business incident.
Visibility across your environment
Depending on your service plan and environment, monitoring can include the following.
- Endpoint activity and EDR/XDR alerts
- Malware, ransomware and suspicious process activity
- Microsoft 365 and identity related security events
- Suspicious sign ins and authentication activity
- Email threats, phishing and malicious attachments
- Security alerts from supported cloud and network platforms
- Device health and availability
- Backup and recovery monitoring
- Critical system and service alerts
- Security events escalated through CTEKS SOC and SIEM services, where included
Monitoring sources vary by customer. Your service agreement lists what applies to you.
Flexible by design
CTEKS managed cybersecurity can include 24/7 SOC monitoring, SIEM, endpoint monitoring, threat detection, investigation and escalation, depending on your selected plan, security package and service level agreement.
Security monitoring (SOC and SIEM)
CTEKS supports multiple SIEM and security monitoring technologies based on your environment and requirements. Our managed security stack may include Pillr-backed SOC and SIEM services, while Microsoft Sentinel may be deployed or managed for Microsoft-centric environments where appropriate.
Endpoint protection (EDR and XDR)
CTEKS supports multiple endpoint protection, EDR and XDR technologies based on your environment and security requirements. Our managed security stack may include SentinelOne for advanced endpoint detection and response, while Microsoft Defender may be deployed or managed for organizations standardized on the Microsoft security ecosystem. In some environments they complement each other, and in others one platform is the primary solution.
Endpoint management
CTEKS supports multiple endpoint management technologies depending on your environment and requirements. NinjaOne may serve as our RMM and managed IT operations platform, while Microsoft Intune or Microsoft Configuration Manager (ConfigMgr) may be deployed or managed for organizations requiring Microsoft-native device management, MDM, compliance, Conditional Access and Entra ID integration. In many environments they work together. NinjaOne covers IT operations, monitoring, patching, automation and remote management. Intune covers Microsoft-native device policy, MDM and MAM, compliance, Autopilot and identity-integrated endpoint management.
Identity, email and backup
Identity security uses Microsoft Entra ID, MFA, Conditional Access, PIM, Windows LAPS and related technologies where appropriate. Email security uses Avanan from the CTEKS security stack and/or Microsoft-native or other email security, depending on the environment. Backup and disaster recovery use CTEKS backup solutions or your existing backup platforms, selected based on workload, environment and service agreement.
Five steps from alert to recovery
Our process combines automated detection and response with human investigation and escalation.
Detect
Security tools identify suspicious behavior or an event that needs investigation.
Analyze
The alert is reviewed and correlated with available endpoint, identity, email, network or cloud information.
Contain
When appropriate and supported by the deployed tools, actions can be taken to help isolate an affected endpoint, stop a malicious process, block a threat or restrict access.
Escalate
Significant incidents are escalated based on severity, business impact and your agreed escalation procedure.
Recover and improve
We assist with remediation, recovery, documentation and recommendations designed to reduce the chance of it happening again.
A sample incident timeline
Illustrative incident response example. Actual response actions and timelines vary by environment, severity, service agreement and available security telemetry.
- 8:42 AMDetection
Endpoint security detects suspicious PowerShell activity on a workstation.
- 8:44 AMInvestigation
The event is reviewed along with process activity, user context and other available security telemetry.
- 8:48 AMContainment
The endpoint is isolated where supported and appropriate to help prevent further activity.
- 8:52 AMEscalation
CTEKS contacts the designated customer contact and begins a coordinated investigation.
- 9:10 AMRemediation
Malicious activity is removed, credentials are reviewed or reset when necessary, and affected systems are validated.
- 10:05 AMRecovery
The endpoint is returned to service after validation.
- After the incidentReview
CTEKS documents findings and recommends security improvements.
Layers that work together
Endpoint protection
EDR/XDR, behavioral detection, threat containment and endpoint visibility, using SentinelOne and/or Microsoft Defender depending on your environment.
Learn moreSecurity operations
Continuous security alert monitoring, investigation, triage and escalation.
Email security
Protection against phishing, impersonation, malicious links, attachments and business email compromise.
Learn moreIdentity security
MFA, Conditional Access, privileged access controls, identity monitoring and Microsoft Entra ID security.
Learn moreSecurity monitoring and SIEM
Centralized security events, correlation, investigation and alerting where deployed, using platforms such as Pillr or Microsoft Sentinel depending on your environment.
Learn moreBackup and recovery
Backup monitoring, recovery planning and disaster recovery readiness.
Learn moreManaged IT and managed security together
| Managed IT | Managed security |
|---|---|
| Help desk | Security monitoring |
| Device management | EDR/XDR |
| Patching | Threat detection |
| Microsoft 365 support | SOC escalation |
| Backup management | Email security |
| Network support | Identity security |
| Cloud administration | Security investigation |
| IT planning | Incident response assistance |
CTEKS brings managed IT and managed cybersecurity together, giving you one team responsible for both the reliability and the security of your technology environment.
Common questions
Do all customers get the same monitoring?
No. Monitoring depends on your service plan and environment. Your service agreement lists the security tools and telemetry that apply to you.
Does your security team stop every attack automatically?
No provider can promise that. Our process combines automated detection and response with human investigation and escalation.
Is 24/7 security monitoring the same as help desk support?
No. Continuous security monitoring applies to customers on applicable managed cybersecurity services. Help desk coverage hours are set in your service agreement.
What is the difference between a SOC and a SIEM?
A SOC is the people and process side: monitoring, investigation and escalation. A SIEM is a technology that collects and correlates security data. Not every customer needs the same SIEM deployment.
See how we would watch your environment
Find out where your risks are before they become outages.
- Network, backup and security health check
- Plain-English report with a priority list
- Written quote if you want our help
Prefer to talk? (847) 200-3666
Request your free remote assessment
Prefer to pick a time? Pick a time for a 30 minute Microsoft Teams discovery call. No obligation.
