CATEYE DFIR
When something goes wrong, our incident responders investigate, contain and report, with every piece of evidence hashed when collected and tracked through a full chain of custody.
Request a demo See what’s included
One of our cybersecurity services, hosted by CATEYE. Pricing on request.
Investigations you can rely on
Incident response and forensics run as a case, from first call to final report.
Incident cases
Each incident is a case with its scope, tasks, timeline, decisions and people, so nothing is lost under pressure.
Chain of custody
Evidence is hashed when it is collected and every hand-over is recorded, including physical devices brought in.
Collection
Evidence gathered from computers, cloud services and email accounts, using established forensic tooling such as Velociraptor.
Timeline analysis
Events from many sources merged into one super-timeline, using tools such as Plaso, Timesketch and Hayabusa.
Need-to-know access
Only the people assigned to a case can see it, which matters for sensitive or legal matters.
Reports
Executive and technical reports, with the evidence and custody record behind every finding.
Run by us, or by your team
Managed by CATEYE
Our security team runs the service for you and reports to you, so you get the outcome without hiring for it.
Or used by your team
Your own IT or security staff sign in to the same workspace, with roles that decide who sees and changes what.
Hosted and kept apart
We host and update the platform. Each client has its own workspace, kept apart from every other client’s data.
How it works
From a first conversation to a service running for your company.
Request a demo
Tell us about your company and what you need. We show you the service with sample data.
Agree the scope
We agree what is covered, the systems involved and who does what, in writing.
Set up your workspace
We create your workspace, invite your people and connect the systems in scope.
Work and report
The service runs, findings and progress are tracked in the platform, and you get regular reports.
Questions about CATEYE DFIR
We think we have been attacked. What should we do now?
Contact us straight away. Avoid turning machines off or deleting anything, as that can destroy evidence. We will tell you what to preserve.
Can evidence be used in legal or insurance matters?
Evidence is hashed on collection and its custody is recorded, which is what lawyers and insurers expect. Whether it is accepted is for them to decide.
Do you offer a retainer?
Yes. A retainer means we already know your systems and have agreed response times before an incident happens. Ask us about it.
Can it work with your monitoring service?
Yes. Serious alerts from CATEYE MDR and findings from CATEYE CloudSec can be escalated straight into a DFIR case.
Who sees our case?
Only the responders assigned to it and the people you name. Access is limited case by case.
Be ready for an incident with CATEYE DFIR
We will show you a sample case, its evidence and custody record, and the report.