Asset inventory
An alert means little unless you know what is being monitored. Servers, applications, domains and accounts are kept in one list with an owner and a criticality level.
DOKI / Cybersecurity
Cybersecurity · Monitoring
We watch the logs and alerts from your systems against rules we define together in advance. Which event goes to whom, how quickly, and which step we take is written in the service scope.
- Asset inventory
- Alert rules
- Incident timeline
- Monthly report
01 / What this service includes
You see the meaningful event, not the noise.
Alert rules made for you
Off-the-shelf rule sets are usually either too quiet or too noisy. We tune the rules to what is normal for your business and reduce false alarms together in the first weeks.
Incident timeline and monthly report
Every event is recorded with when it was seen, who looked at it and how it was closed. At month end, trends, recurring events and recommendations are gathered in one report.
02 / How it works
How a log line becomes an alert
Every record leaving a source passes four stops; only the meaningful ones reach the team.
- 01Log sources
- 02Filtering and correlation
- 03Rule and alert
- 04Team review
03 / Scope
Let's define the scope together.
We clarify the scope, deliverables and acceptance criteria together in the first meeting. The written quote lists that scope item by item; if the scope changes, the quote is updated as a new version.
Only explicitly authorized assets and agreed scope are assessed.
Deliverables
- 01Asset inventory
- 02Alert rules
- 03Incident timeline
- 04Monthly report
04 / Process
How we move forward, step by step.
Each step ends with something concrete in your hands; we move on with your approval.
- 01
Scope
Together we put the goal, the boundaries and the acceptance criteria in writing.
- 02
Setup
We set up tools, access and settings, document the setup and hand it over to you.
- 03
Monitoring
We watch the agreed indicators regularly and notify you when something deviates.
- 04
Reporting
We share what was done, the result and the next step in a plain report.
05 / Decision details
What to know before you ask for a quote.
What is included, what we need from you, timing and payment, all in one place. The exact scope and price are set in the written quote.
Included
- Four tiers: external attack surface, basic monitoring, SOC-Lite and enterprise SOC.
- Automatic alerts run continuously; human review is 24/7 in SOC-Lite, and in enterprise SOC it is the team during working hours plus an on-call expert outside them.
- A monthly report.
Not included
- Fixing the findings (offered separately as Remediation).
What we need from you
- A signed written authorisation.
- A list of assets to monitor (domains, servers, devices).
- Who should receive the alerts.
What sets the price
- The tier you choose.
- Number of web assets or devices (endpoints) monitored.
Payment and aftercare
- A monthly subscription.
- We respond to every request within 12 hours.
- Meetings are held in Turkish; correspondence and deliverables are handled in the language of your choice with translation support.
- We work in person in Istanbul and remotely across Türkiye and worldwide.
06 / FAQ
The questions on your mind.
Tell us what you need; we will define the scope together.
Tell us about your projectIs monitoring done around the clock?
Automatic alerts run continuously at every tier. Human review depends on the tier: in SOC-Lite an expert looks at alerts 24/7; in enterprise SOC the analyst team covers working hours and an on-call expert covers the rest. The scope is written into the contract.
Is permission needed before testing?
Yes. Only systems you are authorised for and have approved in writing are assessed.
Will testing affect my live system?
Scope, time window and methods are agreed in advance; risky steps require your separate approval.
Let's begin
Let's talk about your project.
Tell us what you need; we will define the scope together.