Servers and endpoints
Suspicious processes, persistence, malware indicators, privilege activity and endpoint anomalies from supported agents and logs.
Managed Detection & Response
Continuous monitoring backed by structured incident response.
Our MDR service brings endpoint, identity, email and network security signals into a coordinated monitoring and response process.
Monitoring and detection
Broader visibility, better context
RoundRobin monitors agreed data sources continuously and correlates activity through a SIEM-led process. Coverage is tailored to the environment and can include up to 1,000 client devices, 30 servers or virtual machines, Microsoft 365 access activity and firewall integrations.
- Endpoint Detection and Response: Deploy EDR agents on supported servers and endpoints where required.
- Directory monitoring: Ingest relevant Active Directory events to observe authentication and client activity.
- SIEM correlation: Aggregate logs from firewalls, IDS, security tools and other approved sources.
- Threat intelligence: Add context from current adversary infrastructure, indicators and tactics.
- Behavioural analysis: Identify deviations in user and entity activity that may indicate compromise.
Integrated coverage
Monitor the systems attackers actually use
Exact integrations depend on the products and licenses in your environment. We confirm supported events during discovery so supported events, licensing limits and technical dependencies are understood before deployment.
Identity and Active Directory
Authentication activity, account changes, privilege events and patterns associated with credential abuse or lateral movement.
Microsoft 365
Sign-in activity, mailbox and administrative events, suspicious access and selected audit records available through the customer's licensing.
Firewalls and network security
Firewall events, denied traffic, remote access, IDS alerts and other network security telemetry selected during solution design.
Cloud platforms
Relevant cloud control-plane, identity, security and workload logs when included in the engagement scope.
Additional log sources
Applications, appliances and infrastructure platforms can be assessed for ingestion value, compatibility, retention and cost.
When a threat is detected
Validate, investigate, contain and recover
- Alert and notification: Notify designated customer contacts based on severity and escalation rules.
- Investigation: Determine the likely scope, origin, affected assets and available evidence.
- Containment and eradication: Recommend and coordinate actions to isolate systems and remove malicious access.
- Recovery: Provide technical findings and recovery guidance to support safe restoration.
- Lessons learned: Capture root causes, control gaps and practical improvements after material incidents.
Reporting and governance
Keep technical activity visible to decision-makers
Monthly reports
Incident summaries, service activity, security performance, recurring risks, coverage issues and recommended actions.
Real-time dashboards
Current security status and agreed operational views based on the platforms integrated into the service.
Quarterly reviews
Trend discussion, control effectiveness, strategic recommendations, service changes and priority improvement items.
Response targets
Severity-based service levels
| Priority | Example impact | Response target | Initial action |
|---|---|---|---|
| Critical / High | Active compromise, material business impact or urgent containment need | Within 30 minutes | Notify, validate, investigate and coordinate immediate containment |
| Medium | Suspicious activity requiring prompt investigation but no confirmed major impact | Within 60 minutes | Review evidence, establish scope and recommend next actions |
| Low | Lower-risk anomaly, policy issue or activity suitable for routine investigation | Within 120 minutes | Analyze, document and include in normal escalation or reporting |
Resolution time is not guaranteed because it depends on incident complexity, tool access, third parties and customer actions.
Build an MDR scope around your actual risk and systems.
We will review your endpoints, servers, Microsoft 365 environment, firewalls and current security tools before proposing the monitoring design.