You hear about a threat making the rounds among companies in your industry. Until now, all you could do was write to us and ask whether you were protected. Starting in September, you log its traces in your portal and our SOC adds them to everything it already watches in your environment.
That's this month's change: you decide what we watch. Your network, the tools you already had and the threats that worry you are now on the list, and everything you'll see here is already in your portal, with Network Detection available as an add-on.
Network Detection: we also watch what happens between your devices
A protected computer tells its part of the story, but the other part travels across the network. The new Network Detection module completes the picture.
- It investigates what it finds. It can spot something out of the ordinary, like someone scanning your network, jumping from one device to another or sending data to a malicious destination. When that happens, it doesn't just sit on the dashboard: it opens an investigation that our SOC works and cross-checks with what it sees on your devices.
- You see how your network moves. The module shows what happens between your devices, what your network is used for and where traffic goes out, so the question "what's going on here?" gets answered on a single screen.
It's purchased as an add-on to your service and requires a sensor on your network. If you're interested, request a Network Detection assessment and we'll review it with you.
Connect the tools you already use, and we'll watch them too
If you've already invested in security tools, you don't have to replace them for TecnetSOC to put them to work.
- You connect them from the portal. The new Integrations module lets you connect the tools you already have for your devices, your identity and your network, so our SOC also watches what they see.
- You know what connects today and what's coming. The catalog groups them by type and shows which ones are already available and which are on the way. More than 30 connect today, and the list keeps growing.
The module is already live for all customers.
Indicators of compromise: tell us what to look for and we'll watch for it
Every threat leaves traces: a file with a known digital fingerprint, an IP address, a domain or an email address it attacks from. Those traces are called indicators of compromise, and now you can ask us to look for them in your environment.
- You log them yourself. From the new "Indicators" tab, inside Investigations, you add the indicators you want us to watch: file hashes, IP addresses, domains, websites and email addresses.
- One at a time or in bulk. If someone shared a full list with you, you upload it in one go and review which rows are valid before confirming. For each indicator, you decide what happens if it shows up: we alert you, we contain it on your devices that have EDR protection (endpoint detection and response) or we exclude it from alerts.
- They join what we already watch. Your indicators go into our SOC's monitoring along with everything we already look after for you.
Available for all customers.
Your inventory, ready for the audit
September gave the inventory the two pieces an audit always asks for: which standard applies to each device and who keeps the information up to date.
- Every device shows which standard it falls under. You tag each device's standards from the list or from its page, and you filter the inventory by standard. A card tells you how many devices already have their standard assigned and how many are left.
- Inventory-only access. Your administrator can add someone as an Asset Manager, who keeps the inventory up to date without seeing the other modules. That way, purchasing or internal IT support can help without stepping into security operations.
More updates already in your portal
- Everyone gets the emails that matter to them. Your administrator chooses, person by person, which report and notification emails each member of your team receives. Security and incident notifications always go out, because those can't be muted.
- Your plan, by the numbers. In your portal's side panel, below your plan, you see how many protected devices you're using compared with how many you purchased. No need to request reports or do the math.
- Sign-in attempts, counted in more detail. Investigations into sign-in attempts on Windows devices now identify each attempt by where it comes from. Attempts from the same source are reviewed together, even if they hit several accounts. You may see more investigations than before, because each attempt is now counted more precisely, and each one shows its source and the devices and accounts it touched.
- Neo, one button away from everything. Neo, your portal's on-call analyst, opens from a single button and explains any screen, including incidents.
- Know who can see your portal. Your account's user list now also shows the people who have access from our internal console, flagged and read-only.
What September brings you
Starting this month, your network, the tools you were already using, the threats that worry you and your complete IT inventory are all looked after from the same place, and you decide what goes in.
That's where TecnetSOC is headed: a service that adapts to your company, not the other way around, with our team behind every investigation.
In your portal, the updates section has the full history and marks what's already included in your service. Go to my portal → portal.tecnetone.com
Future updates are also built on what you tell us. If there is something you want to see in TecnetSOC, write to us at hola@tecnetone.com. We read everything you share with us.
Adán es especialista en ciberseguridad en TecnetOne. Analiza amenazas, vulnerabilidades y buenas prácticas de protección para ayudar a las empresas a fortalecer su seguridad. En el blog comparte hallazgos técnicos y recomendaciones prácticas frente a los riesgos digitales actuales.
