Triage plan
A decision tree is written in advance for each alert type: ignore, watch, notify the customer or call urgently. The same event therefore never gets two different treatments on two different days.
DOKI / Cybersecurity
Cybersecurity · Monitoring · SOC-Lite
For businesses that do not want to build their own security team but want an expert to look at their alerts. An expert reviews and prioritises alerts 24/7 and passes them to you with written response steps.
- Alert rules
- Triage plan
- Response playbook
- Scope boundaries
01 / What this service includes
A person looking at the alert, a service with clear limits.
24/7 review and scope boundaries
An expert looks at alerts around the clock. Which systems and alert types are in scope, and how we reach you for a critical alert, are written clearly in the contract.
Response playbook
Every event we pass to you comes with step-by-step instructions on what to do. You carry out the action on your own systems; if you wish, we can do it too, combined with the remediation service.
02 / How it works
The journey of an alert
Alerts move across three columns; every card shows its owner, priority and last action time.
Open
Wave of failed logins
Newly opened port
Under review
Suspicious admin session
Malicious file upload
Completed
Spike in blocked requests
Expired certificate
03 / Scope
Let's define the scope together.
We clarify the scope, deliverables and acceptance criteria together in the first meeting. The written quote lists that scope item by item; if the scope changes, the quote is updated as a new version.
Only explicitly authorized assets and agreed scope are assessed.
Deliverables
- 01Alert rules
- 02Triage plan
- 03Response playbook
- 04Scope boundaries
04 / Process
How we move forward, step by step.
Each step ends with something concrete in your hands; we move on with your approval.
- 01
Scope
Together we put the goal, the boundaries and the acceptance criteria in writing.
- 02
Setup
We set up tools, access and settings, document the setup and hand it over to you.
- 03
Monitoring
We watch the agreed indicators regularly and notify you when something deviates.
- 04
Reporting
We share what was done, the result and the next step in a plain report.
05 / Decision details
What to know before you ask for a quote.
What is included, what we need from you, timing and payment, all in one place. The exact scope and price are set in the written quote.
Included
- An expert reviews and prioritises alerts 24/7.
- Automatic notifications reach the people you choose straight away.
- Written response steps.
- A monthly report.
Not included
- Fixing the findings (offered separately as Remediation).
What we need from you
- Access to your log sources, or installing the monitoring agent on your devices.
- Who should receive the alerts.
What sets the price
- Number of devices (endpoints) monitored.
Payment and aftercare
- A monthly subscription.
- We respond to every request within 12 hours.
- Meetings are held in Turkish; correspondence and deliverables are handled in the language of your choice with translation support.
- We work in person in Istanbul and remotely across Türkiye and worldwide.
06 / FAQ
The questions on your mind.
Tell us what you need; we will define the scope together.
Tell us about your projectWhat happens if a critical alert comes in at night or at the weekend?
SOC-Lite runs 24/7: the automatic notification reaches the people you choose straight away, and an expert reviews the alert, night or weekend, and tells you in writing what to do.
Is permission needed before testing?
Yes. Only systems you are authorised for and have approved in writing are assessed.
Will testing affect my live system?
Scope, time window and methods are agreed in advance; risky steps require your separate approval.
Let's begin
Let's talk about your project.
Tell us what you need; we will define the scope together.