Cynorida
Under attack?Book a walkthrough

Managed detection and response

Threat detection and response, run in the open.

Cynorida analysts watch your endpoints, identities and cloud accounts 24 hours a day, 365 days a year. Every alert, query and containment step shows up in a console your team shares with ours.

Book a 30-minute walkthroughFollow a sample incident

Sample incident with synthetic data

Reads the telemetry you already collect

  • Microsoft Defender for Endpoint
  • CrowdStrike Falcon
  • SentinelOne
  • Microsoft Entra ID
  • Okta
  • Google Workspace
  • AWS CloudTrail
  • Microsoft 365

Watch for attacks, and test for them. Only ever on systems you have authorised us to test.

Every engagement starts with an agreed scope and is written down as it happens, from the playbooks we may run to the targets we may test.

All services

Defend

Day-to-day monitoring, response and detection.

Test

Testing on systems you own, with your written authorisation.

Offensive testing starts only after written authorisation and a signed scope. How we engage

One console for the whole investigation. Your team and ours see the same alerts, evidence and notes as they happen.

Rules, sign-ins, cloud activity, playbooks and reports live in the same workspace our analysts use. You can read every rule we run against your data and decide which actions we may take without calling you first.

Detections you can read

Every rule we run is in your console as Sigma, with the KQL and SPL versions next to it so your team can run the same search in its own tools.

proc_creation_win_office_script_child.yml
title: Office application starts a script interpreterid: 3b7e2c41-9d58-4f0a-a6e2-71c4d08f5b93status: stabledescription: Word, Excel or PowerPoint launching a shell, often a macro at workauthor: Cynorida detection engineeringdate: 2026-09-14tags:  - attack.execution  - attack.t1059.001  - attack.t1204.002logsource:  product: windows  category: process_creationdetection:  selection_parent:    ParentImage|endswith:      - '\WINWORD.EXE'      - '\EXCEL.EXE'      - '\POWERPNT.EXE'  selection_child:    Image|endswith:      - '\powershell.exe'      - '\pwsh.exe'      - '\cmd.exe'      - '\wscript.exe'  condition: selection_parent and selection_childfalsepositives:  - Signed add-ins that call PowerShell during setuplevel: high
level: highT1059.001T1204.002Maintained by Cynorida detection engineering · Mapped to MITRE ATT&CK

Identity

Each sign-in is compared with the one before it, so a login from Singapore 41 minutes after Lisbon gets a person looking at it.

Cloud

CloudTrail is watched for the API calls attackers make to cover their tracks, such as turning logging off.

CloudTraileu-west-1 · 111122223333
  1. 03:41:08ConsoleLoginsvc-backup
  2. 03:42:30CreateAccessKeysvc-backup
  3. 03:44:02PutBucketPolicyAKIA…EXAMPLE
  4. 03:45:19StopLoggingAKIA…EXAMPLE
T1562.008Trail org-audit stopped from 203.0.113.91

Response

Analysts act only through playbooks you have approved in advance. Anything else waits for a yes from your team.

PlaybooksSet by your team
  • Isolate hostPB-03Pre-approved
  • Revoke sessionsPB-05Pre-approved
  • Disable accountPB-07Ask first
  • Block file hashPB-08Pre-approved
Last changed by it-admin@example.com · 2 Oct

Reporting

Each month you get a short report written for the people who were not in the incident channel.

October summarySent 1 Nov · 4 pages
  • Two incidents, both closed. Neither reached a server.
  • Most alerts came from one noisy backup job, now tuned.
  • One admin account still signs in without MFA. Fix on page 3.
  • Six new detection rules went live for your identity provider.
1 OctIncident opened31 Oct

Interface examples use synthetic data.

Follow one incident from first alert to closed ticket. This is the view your team gets while it happens.

Here is INC-2417 from the console above, one step at a time: the raw alert, the analyst’s note, the query and its rows, the scope check, the containment action, the message to your team and the closing summary. Your team watches all of it live, not in a PDF a week later.

IncidentsINC-2417Detection

Sample incident · synthetic data

02:14:07 UTCT+00:00

The alert arrives exactly as the EDR sent it

The EDR on WS-0412 sees winword.exe start PowerShell with an encoded command. The raw alert lands in the shared console untouched, so your team sees the same fields the analyst does.

alert.jsonRaw from EDR · unedited
{  "alert_id": "edr-7f3a91c2",  "detected_at": "2026-09-17T02:14:07Z",  "severity": "high",  "rule": "Office application started encoded PowerShell",  "host": "WS-0412",  "user": "j.doe@example.com",  "parent_process": "winword.exe",  "process": "powershell.exe",  "command_line": "powershell.exe -nop -w hidden -enc SQBFAFgA…",  "source_file": "invoice_0915.docm",  "techniques": ["T1566.001", "T1059.001"]}

Step 1 of 7 · Detection

A monthly report your auditor and your board can both read. Built from the record your team watched live.

Each month the console record becomes one report: what happened, what was done about it, which ATT&CK techniques you can detect and what is still open. INC-2417 from the walkthrough above appears in it as written.

Sample report pages for a demo month, synthetic data

What each report contains

  • A plain-language summary for leadership, on one page.Page 1
  • Every incident, with its full timeline and root cause.Pages 2–5
  • ATT&CK coverage, including the tactics with no detections yet.Page 6
  • Open recommendations, each with an owner and a due date.Page 7
  • Export to PDF for the board and CSV for the auditor.PDF · CSV
Ask for a sample report

Questions security teams ask before they sign.

Something else on your list? Ask the people who would be watching your alerts.

Talk to an analyst
Do we have to replace our EDR?

No. We connect to the tools you already run: your endpoint agent, such as Microsoft Defender for Endpoint, CrowdStrike Falcon or SentinelOne; your identity provider, such as Microsoft Entra ID, Okta or Google Workspace; your cloud audit logs; and your email platform. You keep your licences and your own admin access to every one of them.

What can your analysts do without asking us?

Only the actions written into playbooks you approve, such as isolating a laptop or revoking a session for a specific type of alert. Anything outside those playbooks waits for a named approver on your side.

Every action, pre-approved or not, is logged in the shared console with the analyst who took it and the time it happened.

Where is our data stored and who can see it?

Your data stays in the region you choose at onboarding. Only the analysts assigned to your account can open it, and each time one of them does, the access is logged where your team can review it.

What happens at 3 a.m. on a Sunday?

The same as at 3 p.m. on a Tuesday. Analysts are on shift around the clock and work from the same playbooks. If an alert needs a decision from you, they page the people in your escalation tree, in the order you set.

How long does onboarding take?

It depends on how many sources you connect and how quickly your team agrees the playbooks, so we plan the dates with you instead of quoting a number up front. The steps are always the same:

  1. Connect your EDR, identity provider and cloud accounts.
  2. Agree the playbooks our analysts may run without asking.
  3. Tune detections against what normal looks like in your environment.
  4. Go live, with your team watching in the shared console.
Can we leave and take our data with us?

Yes. Incidents, timelines and reports export as CSV, PDF or JSON whenever you want them, not only when you leave. Because we work on your own EDR and identity provider, there is no agent of ours to remove on the way out.

See a live investigation before you decide.

In 30 minutes an analyst walks you through a real alert queue, the playbooks you would approve, and the report you would receive.

Book a 30-minute walkthroughEmail contact@cynorida.com

Under attack right now? Reach our incident line