Guardian 365 is Forsyte’s comprehensive managed security service that provides 24x7x365 monitoring, proactive threat detection, incident response, and security management as an outsourced vendor for your team. Guardian 365 allows you to prioritize cybersecurity with extended detection and response, human-powered 24x7x365 SOC. Organizations receive automated responses, AI-driven insights, and efficient remediations. The service is backed by expert security operations team members who provide customized security management tailored to fit our clients’ needs.

Guardian 365 covers a range of security controls, including real-time alerts, patch management, system updates, threat investigation, and advanced remediation. It ensures organizations stay secure around the clock with expert security resources you can trust.

Guardian 365 utilizes both the Microsoft security graph and new Defender APIs to oversee and safeguard a customer’s environment. These resources are accessed through an application established in the customer’s Entra ID. The permissions granted are structured to emulate the Security Administrator role, ensuring the appropriate level of access to protect the customer’s environment. Alerts and incidents are gathered from various APIs regularly. While the specific data in these events depends on the threat type, only information related to the affected objects is captured. Once an event is received, the service collects secondary log data pertinent to that event. This secondary data can come from:

• Audit Logs
• URL Click Events
• Sign-In Logs
• Inbox Rules

Additionally, analyzed email objects from Defender for Office are collected and supplemented with the following data from the message object:

• Links
• Message ID
• Folder ID
• Sender
• From
• toRecipients
• ccRecipients
• bccRecipients
• replyTo

All secondary data collected is attached to the same record, and a 30-day TTL (Time-To-Live) is applied. This TTL will automatically delete the record from our database once it expires.  Using an application account for data collection may obscure logs for the customer, showing the application instead of a named account.  Forsyte ensures transparency by auditing all application actions and making this information available to customers upon request.  Additionally, comments are automatically applied to all events when actions occur.

Organizations supported by Guardian 365 are assigned a team of dedicated SOC analysts, cybersecurity engineers, infrastructure architects, Client Success Account Managers (CSAMs), and help desk support. The members of your Guardian 365 team become an extension of your team and work together to keep your organization safe.

• 185,418 alerts ingested this month for analysis
• 6,180 daily average of alerts
• 102 tickets related to phishing, malware, or spam alerts
• 465 total tickets since 5/1/2024
• 222 escalations related to compromised accounts or suspicious behavior
• 137 escalations outside of working hours

• As a broad statistic, Guardian 365 can achieve full remediation* of an entire account in <1 HOUR.
• There are many cases where the Guardian 365 SOC gets an account remediated within 10 minutes of the alert being generated, especially when part of a campaign.
  *NOTE: Full remediation includes revoking active sessions, resetting passwords, deleting inbox rules, disabling the account, and deleting emails.
• If we leave it to the client, there are cases where it takes up to 24 hours or more to respond to our escalations, if they wish to handle the remediation as part of their agreement.