Incident Response & Forensics
Don't wait until you're certain. Tell us what you're seeing and we'll help you contain it without losing the evidence.
Working hoursSunday to Thursday9:00 AM – 6:00 PM
We reply to messages within one business day, so for urgent cases call or WhatsApp us during working hours.
Five things to do right now
Tap each step as you complete it
The incident clock
From the first hour to after it's over
T+01h
First hour
01 · First hour
Stop the bleeding
Your side
- Isolate affected devices and keep them running
- Contact us and name one decision-maker
Our side
- A quick triage call to understand what's happening
- First containment guidance, and what to avoid
Containment
Goal
Stop the spread without destroying the evidence.
What we do
- 01.1Isolate affected hosts and network segments
- 01.2Disable compromised accounts, revoke sessions and tokens
- 01.3Block attacker IPs and domains
We preserve evidence before anything changes, analyze verified copies rather than originals, and record everyone who handled it and when.
- Exhibit EX-01
Volatile memory
Running processes, connections and memory-only malware. Captured before any shutdown.
Preserved · sealed - Exhibit EX-02
Disk images
A bit-for-bit forensic copy. Analysis happens on the copy; the original stays untouched.
Preserved · sealed - Exhibit EX-03
System logs
Event, authentication and directory logs that reveal the attacker's movement.
Preserved · sealed - Exhibit EX-04
Network & firewall
Firewall, proxy, DNS and VPN records.
Preserved · sealed - Exhibit EX-05
Cloud audit trails
Audit logs from cloud platforms and business apps.
Preserved · sealed - Exhibit EX-06
Email & identity
Original phishing emails with headers, plus sign-in and MFA records.
Preserved · sealed
Every exhibit has a record. Every record has a name.
01
Document
Record where the evidence is and its state before it's touched.
02
Collect
Extract with forensic tools without altering the source.
03
Hash
A cryptographic hash at collection proves it hasn't changed.
04
Secure
Encrypted storage with restricted access.
05
Log handovers
Every handover is logged: who, when and why.
06
Analyze
Work only on copies verified to match.
Don't wait for the first incident to find out who decides, or where the logs are. We set it up with you now.
Talk to us before an incident if:
- There's no written response plan the team knows.
- You've noticed strange activity in systems or accounts.
- You want to test your team's readiness before a real incident.
Playbooks
A written plan for each scenario
Ransomware, email compromise, data leaks and account takeover, each with roles, decisions and contacts.
Tabletop exercises
Rehearse at the table, not in production
Realistic scenario sessions for leadership and technical teams, in Arabic or English, with a report on the gaps.
Readiness review
Will you find what you need?
We review logging coverage, backups, the contact tree and decision authority.
Aligned with national frameworks
NIMF · National Incident Management Framework
We build response plans in line with Qatar's National Incident Management Framework and the incident management requirements in Saudi NCA's controls.
What you receive at the end
- 01IR playbooks
- 02Digital forensics
- 03Tabletop exercises
- 04Incident report for leadership, plus a technical one
- 05A timeline of attacker activity
- 06Indicators of compromise (IOCs)
- 07A remediation and hardening plan
Have this ready when you reach out
- AA description of what you noticed and when it started
- BDon't power off affected systems or wipe their logs
- CA decision-maker available throughout the response
Not under attack right now? This is the best time to prepare.
Incident response mode
Under attack right now?
Working hoursSunday to Thursday9:00 AM – 6:00 PM
We reply to messages within one business day, so for urgent cases call or WhatsApp us during working hours.