Monitoring and triage
Alerts from your endpoint, identity, email and cloud tools come to us at any hour, weekends and holidays included. We separate the noise from what needs real attention.
24x7 Security Operations
Someone on your alerts at 2am on a Sunday.
Our security operations service covers the hours your own team can't. We take the alerts from the tools you already run, investigate them in Steward, and bring you in when there's a call to make. You keep your tools and your data, and you can open any case to see exactly what we did.
| Alert | Source | Status |
|---|---|---|
| Sign-in from new country | Identity | Escalated |
| PowerShell download | Endpoint | Investigating |
| Bulk file share change | Cloud | Closed, admin task |
| Reported phishing email | Closed, blocked |
Tools we work with
Connected to the tools you already run.
Steward reads from your security tools through Omni, and Automaton sends the follow-up work to the places your team already uses.
Endpoint
- SentinelOne
- CrowdStrike Falcon
- Microsoft Defender
- Sophos Central
Identity and email
- Microsoft Entra ID
- Microsoft 365
- Google Workspace
SIEM and detection
- Rapid7 InsightIDR
- Microsoft Sentinel
- Lumu
Cloud, edge and code
- AWS
- Cloudflare
- GitHub
- Qualys VMDR
Follow-up with Automaton
- Slack
- Microsoft Teams
- Jira
- Confluence
- ServiceNow
- PagerDuty
- Okta
- VirusTotal
- AbuseIPDB
- urlscan
- GreyNoise
What we can do in each tool depends on the tool and on the access you grant. Some are read only, and some also support response actions like isolating a device. We'll go through yours on the first call.
What's included
The work a SOC does, without hiring one.
Investigation
Anything worth a closer look becomes a case in Steward, with the account, the device and the recent activity around it pulled together. An analyst checks the evidence before it's closed or sent to you.
Response
If something needs containing, like isolating a laptop or ending a user's sessions, we follow the approval rules we agreed with you. Some teams want a call before anything changes. Others sign off ahead of time on a short list of actions we can take straight away, like isolating a laptop at 3am. That list is your decision. Inside Omni, each containment action still needs a second person to approve it, so no one acts alone.
Tuning
Rules that fire all day for no reason get fixed. We tell you what we changed and why, so nothing goes quiet without you knowing.
Reviews
On a regular schedule we go through what we saw, what we closed and what we'd fix first if we were in your shoes.
Cases you can open
You can look at any case we've worked, open or closed, with the evidence and the reasoning laid out the same way our analysts saw it.
How a case reaches you
You hear from us when it matters, with the evidence attached.
Most alerts never need you. When one does, you get a short write-up that says what happened, what we checked, what we think and what we'd like you to decide.
- The alert, the accounts and devices involved, and how they connect
- What we ruled out, and why
- The action we recommend, ready for your approval
Cases
Alert queue
Entities
Reports
Sources
Identity
Endpoint
Email
Cloud
Suspicious sign-in to a finance mailbox
Opened from an identity alert. Linked to five entities and two earlier cases.
HighIdentityEmailOwner: night shift
Investigation so far
- New country, new device. First sign-in from either for this account.
- Inbox rule added. Invoices now forward to an outside address.
- Harmless explanation tested. No travel or VPN change on record.
- Stopped here. The laptop has not reported in, so an analyst decides.
Proposed response
ActionRevoke sessions
Targetap.finance
AlsoRemove inbox rule
ApprovalSecond person
ApproveReview
Decision record
Questions asked7
Evidence items14
Possible links1 flagged
Changes madeNone yet
How it runs
Four steps, every alert, every hour.
The alert arrives
From your EDR, identity provider, email security or cloud logs, read through your own Omni.
Steward builds the case
It gathers the related sign-ins, devices, processes and past cases, and tests the harmless explanations first.
An analyst decides
If it's benign, it's closed with the reason written down. If it isn't, it moves straight to response.
You're brought in
We contact the people on your list, take the steps you've approved and keep the case open until it's resolved.
Why teams pick us
What's different about the way we run it.
Your tools stay where they are
We don't ask you to move your logs into our SIEM or swap your EDR. We read from what you have, so there's no migration and nothing to unwind if you leave.
You can check our work
Every closed case keeps the questions we asked, the evidence we looked at and why we decided what we did. If you disagree with a call, you can see exactly where we went.
Our access has limits
We reach your tools through your own Omni, with the rights you grant and a record of every call. Take that access back and we can't reach anything.
What we need from you
A short list to get going.
Setup is a project we run with you, not a form you fill in. Here's what it usually takes from your side.
- Read accessTo the security tools you want us to watch, granted through Omni. You can take it back at any time.
- A contact listWho we call, in what order, and how to reach them out of hours.
- Approval rulesWhich actions we can take without asking, and which always wait for you.
- Some contextWhich systems matter most, what normal looks like, and anything we shouldn't be surprised by.