Who does what
Provider
- Log correlation
- Threat validation
- Tickets and mitigation advice
Your team
- Containment and recovery
- Incident-response staffing
Details
Service scope
Best for Teams retaining a staffed incident-response function
Operation
Analysts investigate related logs before raising validated incidents.
Tiers
Baseline, Enhanced and Advanced differ in sources, use cases and coverage.
Retention
The current brochure specifies at least 180 days for standard logs.
Full service analysis
CGI Protective Monitoring correlates logs, validates suspicious events and sends incident tickets with containment or eradication advice. The buyer's response team acts on those tickets and retains recovery unless separately contracted.
- Your team owns
- Containment and recovery
- Incident-response staffing
Pricing & contract
- Billing
- Per-asset, Custom
Pricing is per device and varies with the mix of sources and service level. Request separate costs for extended hours, custom sources, additional use cases and the DFIR retainer.
Tradeoffs & buying questions
Strengths
-
The documented handoff identifies the buyer's response team explicitly.
Considerations
-
Core business-hours alerting is distinct from optional 24/7 coverage.
Ask before buying
- Which monitoring and alerting hours apply to our selected tier?
- Who executes containment after a validated ticket?
- What custom sources, use cases and DFIR hours are included in the quote?
Common questions
Does the base service include digital forensics?
The brochure presents DFIR as a retainer-based option. Confirm its scope and incident activation terms separately.