Go defensive
Blue teaming
A modern threat detection and response capability is an interplay between your team, an advanced SIEM/SOAR, automation and specialist input. A mature capability requires solving two challenges: 1) having custom, high-fidelity detections in place, and 2) reducing analyst time spent on (repeating) analysis and response actions. FalconForce’s Sentry Detect and Respond services allow for more efficient and effective threat detection and response.
As the SOC team, your business trusts you with the protection of their crown jewels. They expect you to be able to detect advanced threat actors timely and mitigate whatever threats they pose.
This is a rat race and catching the threat actors in complex IT environments with ever-changing assets is …. challenging. Out-of-the-box detection content from AV, EDR and SIEM platforms will only help you in fending off simple cyber attacks. Determined threat actors will simply obtain these platforms themselves to test their attacker toolkit and see what will (not) be detected.
To detect and respond to the behavior of advanced threat actors, you need custom, high-fidelity detections in place. Building, tuning and maintaining these advanced detections takes a constant effort and significant expertise and insights in the latest attack vectors and threat actor behavior. This detection engineering lifecycle is often the responsibility of already overburdened engineers who are busy investigating alerts or doing incident response.
This status quo makes you less flexible in focusing on business priorities and may put additional stress on your workforce.
FalconForce Sentry Detect: Managed Detection Engineering
We can help you! FalconForce consists of a team of security veterans with a mix of deep offensive and defensive skills. We have performed numerous red team exercises, spent years in hunting or incident response, and scripted our way through so many technology stacks we lost count.
In the past years we have been using our skills to create an extensive repository of custom, high-fidelity detections for the Microsoft Sentinel and Defender XDR platforms. Moreover, we crafted a toolkit to automate deploying these detections at scale.
We are ready to support you in your mission to secure your business with our Sentry Detect services!
Blue consultancy
Looking for expertise to enhance specific parts of your threat detection stack? FalconForce can help! We have expertise in setting up automated deployment pipelines, automating enrichment, custom detection development, BloodHound and testing your detections. Please get in touch so we can discuss what you are looking for and where we can help!
Go defensive
Blue teaming
experience
“Great advanced detection content!”
Simon - Information Security & Risk Management @ Athora
“FalconForce’s advanced detection content has greatly boosted our detective capability in both breadth and depth. The steady stream of new, tuned and well-documented detections and discussions with FalconForce’s experts really enhance the efficiency of our team.”
Go defensive
Blue teaming
knowledge
Detection engineering rabbit holes - parsing ASN.1 packets in KQL
[dsm_breadcrumbs show_home_icon="off" separator_icon="K||divi||400" admin_label="Supreme Breadcrumbs" _builder_version="4.18.0" _module_preset="default" items_font="||||||||" items_text_color="rgba(255,255,255,0.6)" custom_css_main_element="color:...
FalconFriday — Detecting MMC abuse using GrimResource with MDE— 0xFF24
[dsm_breadcrumbs show_home_icon="off" separator_icon="K||divi||400" admin_label="Supreme Breadcrumbs" _builder_version="4.18.0" _module_preset="default" items_font="||||||||" items_text_color="rgba(255,255,255,0.6)" custom_css_main_element="color:...
Go defensive
What does blue teaming bring you?
We protect your business
Reduce operational costs
Hiring new experts or developing expertise in-house is challenging, and ROI will take time. You can reduce those efforts by collaborating with FalconForce. Moreover, our content enables automation of deployment, and your team can chase mostly true positives.
Grow coverage faster and learn
Olaf speaking
Defensive specialist @ FalconForce & Microsoft MVP
“Constantly researching threat actor behavior, building and testing advanced detections takes a lot of knowledge, skills and time. Based on FalconForce’s offensive and defensive teams we have built and are continuously improving a repository of advanced use-cases for MDE and Sentinel. Moreover, we added various smart automations for deployment and documentation to help our clients focus on what really matters.”
Go defensive
Our other services
Purple teaming
Red teaming
Want to test your cyber threat detection and response with an extensive, realistic adversarial simulation or complete TIBER exercise? Our red teaming experts are ready to put your defenses to the test.
Together. Secure. Today.
Get in touch with one of our professionals
FalconForce realizes ambitions by working closely with its customers in a methodical manner, improving their security in the digital domain.
Energieweg 3
3542 DZ Utrecht
The Netherlands
FalconForce B.V.
[email protected]
(+31) 85 044 93 34
KVK 76682307
BTW NL860745314B01