How MDR360 works
From telemetry to response — with people in the loop
A clear, accountable workflow that turns your security signals into investigated, actioned outcomes.
Service lifecycle
Six stages of MDR360
- 01
Discovery & scoping
We map your assets, technologies, critical systems, contacts and escalation preferences.
- 02
Response permissions
Together we define which containment actions the SOC may take automatically and which require your approval.
- 03
Telemetry onboarding
Supported sources are connected to SHIELD SIEM/XDR and validated for coverage.
- 04
Detection tuning
Use cases are tuned to your environment to reduce false positives during an initial baseline period.
- 05
24/7 operations
Analysts triage, investigate and respond around the clock, escalating according to severity.
- 06
Reporting & reviews
Monthly reporting and service reviews keep improvement on track.
Incident workflow
How every alert is handled, end to end
Every signal follows one accountable workflow: detected and validated, investigated and scoped, then — on Advanced and Ultimate — contained under authorization and remediated through supported technologies, then documented and fed back into tuning. Critical P1/P2 incidents trigger immediate telephone and electronic escalation, and any action with business impact requires your approval before we execute it. Each case is tracked in the client portal with timestamps, an SLA clock, evidence and a clear next step.
P1/P2 incidents: immediate telephone + electronic escalation to your designated contacts
- 1
Detect & Intake
- Security telemetry (SIEM, EDR, email, cloud, network)
- Customer report (portal, phone, email)
- 2
Validate & Classify
- False-positive check
- Assign severityP1P2P3P4
- Assign owner
- 3
Investigate & Scope
- Correlate evidence across data sources
- Identify affected users, devices and systems
- Establish attack timeline
Disruptive action required?
No / pre-authorised
The SOC proceeds straight to containment under the permissions agreed at onboarding.
Yes — your approval first
Anything with business impact (e.g. taking a server offline) is confirmed with you before we act.
- 4
Contain
- Advanced & Ultimate: verify authorization, apply supported containment
- Standard: escalate so your team or MSP contains
- Account / session action (e.g. disable, reset, revoke)
- 5
Coordinate Remediation
- Customer actions (IT / business)
- Recovery guidance
- Verify remediation (systems clean, monitoring in place)
- 6
Close & Document
- Confirm root cause
- Compile evidence (timeline, artefacts, actions taken)
- Closure rationale and customer sign-off
- 7
Improve
- Lessons learned
- Detection / rule tuning
- Threat hunting
- Trend analysis and reporting
Client portal & communications
Case ID
Timestamps
key events
SLA clock
against targets
Assignee
DIAMATIX / customer
Evidence
artefacts, notes
Next step
clear action
Status
open / in progress / resolved
By tier
Who responds at each tier
Response actions depend on vendor capabilities and agreed permissions. Some disruptive actions require your explicit approval.
MDR360 Standard — Detect & Notify
Investigation and escalation without DIAMATIX-executed containment.
- 1. Detect
- 2. Validate
- 3. Investigate
- 4. Notify & Escalate
- 5. Customer/MSP Responds
- 6. Document & Report
MDR360 Advanced & Ultimate — Detect & Respond
Authorized active response. Ultimate extends it into supported identity and network sources.
- 1. Detect
- 2. Validate
- 3. Investigate
- 4. Verify Response Authorization
- 5. DIAMATIX Contains
- 6. Execute/Coordinate Supported Remediation
- 7. Document & Report
Service levels
Response times we commit to in writing
Every incident is classified by severity, and each severity has a contractual clock.
| Severity | Triage starts | You are notified | Containment* |
|---|---|---|---|
Severity 1 · Critical Ransomware, domain admin takeover | 10 min | 15 min | 30 min |
Severity 2 · High Compromised endpoint, lateral movement | 15 min | 1 hour | 4 hours |
Severity 3 · Medium Suspicious PowerShell, anomalous logins | 2 hours | 8 hours | Case basis |
Severity 4 · Low Informational, weak signals | 1 business day | Monthly report | — |
- • Severity 1 incident report within 3 business days of closure
- • Service credits of up to 15% for missed Severity 1 targets
- • Monitored 24×7×365 by the DIAMATIX SOC
Targets from the DIAMATIX MDR SLA (Advanced tier). Triage and notification targets are monitoring SLAs; containment targets are active-response SLAs and do not apply to Standard. Tier-specific Standard and Ultimate targets are awaiting DIAMATIX approval. Times run from a qualifying alert reaching the SOC. *Containment applies to pre-authorised actions on in-scope assets with working integrations. The signed agreement governs.
Escalation
What happens when a real threat is found
- Analyst confirms the incident and assesses scope and impact
- Advanced & Ultimate: authorization is verified and supported containment is executed (e.g. isolate host)
- Standard: the incident is escalated so your team or MSP can contain it
- Your designated contacts are notified according to severity
- SOC guides remediation and coordinates with your IT team or partner
- Incident is documented with timeline, actions and recommendations
Monthly security report
Illustrative sample4.2M
Events analysed
318
Investigated
3
Confirmed incidents
Escalated alerts per week
Telemetry coverage
Recommendations closed
See the workflow applied to your environment
We will walk you through onboarding, permissions and reporting for your stack.