logo

Coalition Managed Detection & Response Standard Operating Procedures

We are pleased to partner with Coalition, a best-in-class security service provider with a team of expert analysts that can provide 24/7 monitoring of alerts. Coalition integrates seamlessly with your existing Zip setup to provide coverage. Any alert flagged by Crowdstrike will be reviewed and triaged. The below table outlines when and how we notify you or your chosen security contact regarding new discoveries.
Alert Level
Incident Type
What Coalition will do
What you will hear from us
Critical
Ransomware, Lateral Movement, Hacking Tools
Immediate action to contain + eliminate taken.ย  Direct action may be takenย  to contain and eliminate any threats. This may have user impact.
Communicated via email + phone call within 45 minutes. Outside of business hours this is communicated by 8am the following day.
High
Trojans, Credential Harvesting
Acknowledged and reported within 1 hour. Containment + mitigation support provided until resolution.
Communicated via email within 1 hour.ย  Outside of business hours this is communicated by 8am the following day.
Medium
Applications such as games and torrent sites.
Typically acknowledged and triaged within 1 hour.
No client contact unless further action is required
Low
Activities relating to applications, such as toolbars and web plugins.
Typically acknowledged and triaged within 1 hour.
No client contact unless further action is required
If you have additional questions, please feel free to reach out to success@zipsec.com.
Share