Log scope design
Collecting everything is costly and noisy. Together we decide which record from which source is kept for how long, based on your threat scenarios and regulatory needs.
DOKI / Cybersecurity
Cybersecurity · Monitoring · Enterprise SOC
For organisations with many systems, several teams and a need to report to the board. The scope of log sources, analyst tiers, response authority and governance are designed with you and written into the contract.
- Log scope
- Incident triage
- Response playbook
- Responsibility and governance
01 / What this service includes
The larger the scope, the more order matters.
Tiered analyst structure
The first tier filters the alert, the second investigates the incident in depth, the third does threat hunting and rule development. The conditions under which an incident is escalated are written down.
Responsibility and governance
Who decides what is gathered in a responsibility matrix. Regular management meetings, measured indicators and an annual exercise plan are part of the service.
02 / How it works
The line from log to decision
Four stops, four responsibilities: each has a clear owner and a clear output.
- 01Log collection
- 02Correlation
- 03Analyst review
- 04Management report
03 / Scope
Let's define the scope together.
We clarify the scope, deliverables and acceptance criteria together in the first meeting. The written quote lists that scope item by item; if the scope changes, the quote is updated as a new version.
Only explicitly authorized assets and agreed scope are assessed.
Deliverables
- 01Log scope
- 02Incident triage
- 03Response playbook
- 04Responsibility and governance
04 / Process
How we move forward, step by step.
Each step ends with something concrete in your hands; we move on with your approval.
- 01
Scope
Together we put the goal, the boundaries and the acceptance criteria in writing.
- 02
Setup
We set up tools, access and settings, document the setup and hand it over to you.
- 03
Monitoring
We watch the agreed indicators regularly and notify you when something deviates.
- 04
Reporting
We share what was done, the result and the next step in a plain report.
05 / Decision details
What to know before you ask for a quote.
What is included, what we need from you, timing and payment, all in one place. The exact scope and price are set in the written quote.
Included
- The analyst team during working hours, an on-call expert outside them.
- Log sources, analyst tiers, response authority and reporting are designed with you and written into the contract.
- Reporting to your board.
Not included
- Fixing the findings (offered separately as Remediation).
What we need from you
- Access to your log sources, or installing the monitoring agent on your devices.
- An authority matrix: who decides what, and when.
What sets the price
- Number of devices (endpoints) monitored.
- Shift pattern and response times.
Payment and aftercare
- A monthly subscription.
- We respond to every request within 12 hours.
- Meetings are held in Turkish; correspondence and deliverables are handled in the language of your choice with translation support.
- We work in person in Istanbul and remotely across Türkiye and worldwide.
06 / FAQ
The questions on your mind.
Tell us what you need; we will define the scope together.
Tell us about your projectIs uninterrupted monitoring possible at this tier?
Yes. The analyst team covers working hours and an on-call expert looks at alerts outside them. The shift pattern, team size and response times are written into the contract.
Is permission needed before testing?
Yes. Only systems you are authorised for and have approved in writing are assessed.
Will testing affect my live system?
Scope, time window and methods are agreed in advance; risky steps require your separate approval.
Let's begin
Let's talk about your project.
Tell us what you need; we will define the scope together.