What is inside
5 IR playbooks
Ransomware, credential theft, malware, lateral movement and data exfiltration.
Auto-incident
Four triggers automatically create incidents including MITRE ATT&CK mapping.
8-phase IR lifecycle
Structures the entire response from detection through post-incident review.
Reporting obligations
BSI-compliant 24-hour and 72-hour notification reports on request.
Automated immediate measures
Target values of the response chain:
- On-endpoint kill: below 100 ms.
- Host quarantine: below 5 s. Firewall block: below 30 s.
- Forensic capture: below 60 s. Fleet scan: below 5 minutes.
- SLA targets: MTTD below 5 min, MTTC below 15 min, MTTR below 4 h.
Target values are experience-based values from reference environments, not a guarantee.